Filewatcher, additional need to monitor User making changes

Ruchi Gupta

I have a need to monitor a server. I found out that this can be done using FileWatcher. But filewatcher just tells what change & kind of change (delete, rename etc) that has taken place. I also want to know who (User) made the chane and the machine name or address from where changes has taken place. Any pointers in this regard :-) Thanks Ruchi

Heath Stewart

The FileSystemWatcher component - nor the underlying ReadDirectoryChangesW API - record this information. In fact, IIRC, NTFS filesystem doesn't even record this information. There's no entries in it for the journal, at least (NTFS is now a journaling file system). If you want to see who's got what files open (which may help indicate who changed what) and since this is on a server (so I assume people are accessing files via a UNC share), you could P/Invoke NetFileEnum. I've included some code below that can help and that I wrote some time back to assist with closing open file handles (for executables) in our shared build directory. I make no warranty of it in any way:

using System;
using System.Collections;
using System.Runtime.InteropServices;
using System.Security;

namespace Example
{
public class NetFiles
{
private const int ErrorFileNotFound = 2;
private const int ErrorAccessDenied = 5;
private const int ErrorMoreData = 234;
private const int MaxPreferredLength = -1; // Get all records
private const int BufferSize = 4000; // (sizeof(FileInfo) == 160) * 25 < 4096 (under 4 kb)

\[DllImport("netapi32.dll", CharSet=CharSet.Unicode)\]
private static extern int NetFileEnum
(
  \[MarshalAs(UnmanagedType.LPWStr)\]string serverName,
  \[MarshalAs(UnmanagedType.LPWStr)\]string basePath,
  \[MarshalAs(UnmanagedType.LPWStr)\]string userName,
  \[MarshalAs(UnmanagedType.U4)\]int level,
  \[MarshalAs(UnmanagedType.SysUInt), Out\]out IntPtr buffer,
  \[MarshalAs(UnmanagedType.U4)\]int preferredMaxLength,
  \[MarshalAs(UnmanagedType.U4), Out\]out int entriesRead,
  \[MarshalAs(UnmanagedType.U4), Out\]out int totalEntries,
  \[MarshalAs(UnmanagedType.U4), In, Out\]ref int resumeHandle
);

\[DllImport("netapi32.dll", CharSet=CharSet.Unicode)\]
private static extern int NetFileClose
(
  \[MarshalAs(UnmanagedType.LPWStr)\]string serverName,
  \[MarshalAs(UnmanagedType.U4)\]int fileID
);

\[DllImport("netapi32.dll")\]
private static extern int NetApiBufferFree
(
  IntPtr buffer
);

private NetFiles()
{
}

public static IList GetOpenFiles()
{
  return GetOpenFiles(null, null, null);
}

public static IList GetOpenFilesOnServer(string server)
{
  return GetOpenFiles(server, null, null);
}

public static IList GetOpenFilesWithPath(string basePath)
{
  return GetOpenFiles(null, basePath,