I've been searching for a solution to get all Read/Write/Open/Close files by a specific process from an event trace (ETW) session (I will process data from a real-time session).
I write this code and get all event in that operation but I can't get FileName
or Path
in events. there is just FileObject
and FileKey
,...
this is my code to get events:
var sessionName = "ETWEventSession";
using (var session = new TraceEventSession(sessionName, null))
{
session.StopOnDispose = true;
using (var source = new ETWTraceEventSource(sessionName, TraceEventSourceType.Session))
{
Action<TraceEvent> logAction = delegate(TraceEvent data)
{
Console.WriteLine(log);
};
var registerParser = new RegisteredTraceEventParser(source);
registerParser.All += logAction;
var fileProviderGuid = TraceEventSession.GetProviderByName("Microsoft-Windows-Kernel-File");
session.EnableProvider(fileProviderGuid, TraceEventLevel.Informational, 0x0200);
source.Process();
}
}
I run my agent and get events like this:
<Event MSec="0.0000" PID="11376" PName="" TID="24668"
EventName="Write" ProviderName="Microsoft-Windows-Kernel-File"
ByteOffset="102386" Irp="0xffffe00148e8c478" FileObject="0xffffe00146c43210"
FileKey="0xffffc0019d3f8140" IssuingThreadId="24668"
IOSize="7" IOFlags="0" ExtraFlags="0"/>
How can I get FileName
that affected in this event?
What is FileObject
or FileKey
?
can I get FileName
from FileObject
or FileKey
?
With this code, can get every thing what I want.
In
ShareAccess
property of event you can find ReadWrite event .FileName
is in each event. also you can restrict your directory for file events and use this instead ofFileSystemWatcher
:).