Every 12 seconds have a software, a file to a directory do WriteFile operation, the first in a offset WriteFile an increasing timestamp, after in the offset of the WriteFile other content, the last call FlushFileBuffer, this one minute to write five times, with the process monitor to monitor, as shown in the figure below:



Increasing red box part is to write the timestamp of the operating


My task is to monitor the software of the directory of this file each time update, and then parse the file content, sent out,

I use the API is ReadDirectoryChangesW () combined with complete routines, to monitor the directory of the file, if the files in the directory update response is complete routines (callback function),
Specific methods, refer to a lot of examples, should be no problem, at the same time, the callback function response times and five times a minute, this is no problem, that is to say, the change of the file, is to monitor

The software every time a location on the file written to increasing timestamp, normal should be

.

The NTH file change response, and then read the file, read the timestamp is 20180503143009
N + 1 times file change response, then read files, read the timestamp is 20180503143021

.

But always there

.

The NTH file change response, and then read the file, read the timestamp is 20180503143009
N + 1 times file change response, then read files, read the timestamp is 20180503143009

.

Or

.

The NTH file change response, and then read the file, read the timestamp is 20180503143021
N + 1 times file change response, then read files, read the timestamp is 20180503143021

.

That is to say, every monitor to file change after, I went to read the timestamp of part of file's contents, the timestamp should be incremented, arguably, monitoring to the file after the change, write operations should be flush to disk before, this should not happen,

I wonder if the ReadDirectoryChangesW () mechanism, the best is only the change of the notice to the file, but does not guarantee that after receiving callback notice, content is thoroughly was FlushFileBuffer to disk,

Do you have good Suggestions for this?

CodePudding user response:

Advice directly to Hook the API

CodePudding user response:

reference 1st floor zgl7903 response:

advice directly Hook these API

Leads didn't consider other options, the hook procedure is not very familiar with, and write my own simulation software, also do not appear such problems,

CodePudding user response:

MSDN98_1. ISO http://pan.baidu.com/s/1dDF41ix, MSDN98_2. ISO http://pan.baidu.com/s/1bnGo0Vl

The inside of the reference example fwatch:
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ FWATCH DSP
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ FWATCH C
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ MAKEFILE
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ FWATCH INI
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ README. TXT

CodePudding user response:

reference zhao4zhong1 reply: 3/f

MSDN98_1. ISO http://pan.baidu.com/s/1dDF41ix, MSDN98_2. ISO http://pan.baidu.com/s/1bnGo0Vl

The inside of the reference example fwatch:
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ FWATCH DSP
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ FWATCH C
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ MAKEFILE
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ FWATCH INI
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ README. TXT

The method is to use the ReadDirectoryChangesW here?

CodePudding user response:

reference zhao4zhong1 reply: 3/f

MSDN98_1. ISO http://pan.baidu.com/s/1dDF41ix, MSDN98_2. ISO http://pan.baidu.com/s/1bnGo0Vl

The inside of the reference example fwatch:
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ FWATCH DSP
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ FWATCH C
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ MAKEFILE
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ FWATCH INI
MSDN98 \ SAMPLES \ VC98 \ SDK \ WINBASE \ IO \ FWATCH \ README. TXT

Try this example, or the problems,

CodePudding user response:

FDump - Dumping File Sectors Directly from Disk using Logical Offsets http://www.codeproject.com/Articles/32169/FDump-Dumping-File-Sectors-Directly-from-Disk-usin

CodePudding user response:

WinAPIOverride http://jacquelin.potier.free.fr/winapioverride32/

CodePudding user response:

refer to 6th floor zhao4zhong1 response:

FDump - Dumping File Sectors Directly from Disk using Logical Offsets http://www.codeproject.com/Articles/32169/FDump-Dumping-File-Sectors-Directly-from-Disk-usin

Is some actual sector read disk method, reach the effect of event notification,


The

reference 7 floor zhao4zhong1 response:

WinAPIOverride http://jacquelin.potier.free.fr/winapioverride32/

This is somewhat complex, including MonitoringFileBuilder this just didn't know how to use

Is not I don't study, but time is tight requirements must use event notification on at the same time, because before a colleague with a PYTHON implementation of the function, didn't appear similar problems, so the organization also wants to
To achieve this kind of event notification way,
Do you know why the python file change notification function without this problem? Do you see there are other methods recommended?

CodePudding user response:

Python files notification calls the Windows API implementation isn't it?
Monitor monitoring Python is how to use API calls the Windows API,

CodePudding user response:

If a read content, as well as the last time, and then close the file, to open, read, retry several times