CODEWITHSUNDEEP
c#.net
lysergic-acid
lysergic-acid

Reputation: 20050

Monitor File activity performed by my application

I am building a .NET WinForms based application (currently using .NET 3.5).

The application writes/reads from files in certain scenarios.

I would like to be able to trace all these file writing activities (i would like the application to only write to files under its own folder, and not to any other folders such as C:\Temp)

Is there any easy way i could "sniff" on this activity and see which files are being written to (along with the stack trace perhaps)

Upvotes: 0

Views: 932

Answers (3)

Marcin
Marcin

Reputation: 3272

Have you tried maybe FileSystemWatcher class?

It want give you full stack trace, but you will have at least information about writing with quite simple api.

From MSDN:

using System;
using System.IO;

class Program
{
    static void Main(string[] args)
    {
        //  Create a FileSystemWatcher to monitor all files on drive C.
        FileSystemWatcher fsw = new FileSystemWatcher("C:\\");

        //  Watch for changes in LastAccess and LastWrite times, and
        //  the renaming of files or directories. 
    fsw.NotifyFilter = NotifyFilters.LastAccess | NotifyFilters.LastWrite
        | NotifyFilters.FileName |NotifyFilters.DirectoryName;

    //  Register a handler that gets called when a 
    //  file is created, changed, or deleted.
    fsw.Changed += new FileSystemEventHandler(OnChanged);

    fsw.Created += new FileSystemEventHandler(OnChanged);

    fsw.Deleted += new FileSystemEventHandler(OnChanged);

    //  Register a handler that gets called when a file is renamed.
    fsw.Renamed += new RenamedEventHandler(OnRenamed);

    //  Register a handler that gets called if the 
    //  FileSystemWatcher needs to report an error.
    fsw.Error += new ErrorEventHandler(OnError);

    //  Begin watching.
    fsw.EnableRaisingEvents = true;

    Console.WriteLine("Press \'Enter\' to quit the sample.");
    Console.ReadLine();


}

//  This method is called when a file is created, changed, or deleted.
private static void OnChanged(object source, FileSystemEventArgs e)
{
    //  Show that a file has been created, changed, or deleted.
    WatcherChangeTypes wct = e.ChangeType;
    Console.WriteLine("File {0} {1}", e.FullPath, wct.ToString());
}

//  This method is called when a file is renamed.
private static void OnRenamed(object source, RenamedEventArgs e)
{
    //  Show that a file has been renamed.
    WatcherChangeTypes wct = e.ChangeType;
    Console.WriteLine("File {0} {2} to {1}", e.OldFullPath, e.FullPath, wct.ToString());
}

//  This method is called when the FileSystemWatcher detects an error.
private static void OnError(object source, ErrorEventArgs e)
{
    //  Show that an error has been detected.
    Console.WriteLine("The FileSystemWatcher has detected an error");
    //  Give more information if the error is due to an internal buffer overflow.
    if (e.GetException().GetType() == typeof(InternalBufferOverflowException))
    {
        //  This can happen if Windows is reporting many file system events quickly 
        //  and internal buffer of the  FileSystemWatcher is not large enough to handle this
        //  rate of events. The InternalBufferOverflowException error informs the application
        //  that some of the file system events are being lost.
        Console.WriteLine(("The file system watcher experienced an internal buffer overflow: " + e.GetException().Message));
    }
}

}

Upvotes: 2

Mitch Wheat
Mitch Wheat

Reputation: 300759

You can use ProcessMonitor for this (without the application stack trace):

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

Process Monitor - Hands-On Labs and Examples

Suggest you search your codebase for all occurrances of FileStream and StreamWriter

Upvotes: 2

m0sa
m0sa

Reputation: 10940

You can use Process Monitor from sysinternals to do that (and much more).

Upvotes: 1

Related Questions