How to monitor file access?

Question

I want to monitor when some process reads a specific file

When I use procmon to monitor the said file I can see that it gets queried and read a lot

Now I want to monitor a specific file and act once the CloseFile operation was executed on said file.

So I've installed the Microsoft.Diagnostics.Tracing.TraceEvent nuget package and tried numerous things to get this working. It seems to work randomly? But it hasn't worked in a while.

Couple of things to mention:

• My IDE runs w/ admin privileges.
• I've disabled procmon just to make sure it doesn't interfere..
• I've made sure that the callback is executed (I can log tons of filenames here. but just not the one I'm looking for)
• I've set the keywords to All because w/ FileIO keywords it never worked
• I've checked the LostEvents number provided by the callback. But it never was not 0

Here is my code. What am I doing wrong?

await Task.Run(() =>
{
    using TraceEventSession session = new("MySession");
    session.EnableKernelProvider(KernelTraceEventParser.Keywords.All);
    session.Source.Kernel.FileIOClose+= data =>
    {
        if (data.FileName == @"c:\foo.txt")
        {
            // do stuff
        }
    };
    session.Source.Process();
});