监视与System Internal / Microsoft的FileMon / Process Monitor类似的文件 [英] Monitor files similar to System Internal's/Microsoft's FileMon/Process Monitor

问题描述

我需要在另一个应用程序关闭文件时生成一个事件。

不幸的是，ReadDirectoryChangesW不报告关闭事件。我可能会轮询（使用TTimer）由ReadDirectoryChangesW报告的任何文件被修改，等待它被关闭（使用CreateFile检测这个）。

但是，我喜欢的是一个完全事件驱动的解决方案。

有没有办法挂起系统调用并检测所有文件关闭事件？我只想知道路径&任何刚刚关闭的文件的名称。

解决方案

在Delphi中，没有一个很好的简单的解决方案，解决方案是编写一个过滤器驱动程序来监视文件关闭事件。 / p>

I need to generate an event when a file is closed by another app.

Unfortunately, ReadDirectoryChangesW doesn't report the close event. It would be possible for me to poll (with a TTimer) any file that reported by ReadDirectoryChangesW as modified, waiting for it to be closed (using CreateFile to detect this).

However, what I'd prefer is a completely event driven solution.

Is there a way to hook system calls and detect all file closing events? I simply want to know the path & name of any file that has just been closed.

解决方案

There is no good simple solution to your problem in Delphi alone - the real solution is to write a filter driver to monitor file closing events.

这篇关于监视与System Internal / Microsoft的FileMon / Process Monitor类似的文件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！