Using ST_ATIME to watch for files being read

[Chris]

I need to monitor a bunch of files to see what is being opened, read,
and closed, with no modifications being made. This is being done
first on Windows machines, and later on Solaris.

Looking through Python Programming on Win32, I saw the ST_ATIME (page
311) which looked promising, but when I did a little test, the results
weren't good (read: sucked):

# from the i.shell. st_atime date is inside >>><<<(33206, 0L, 2, 1, 0, 0, 3L, >>>1080919329<<<, 1080919329, 1080918583)

# now i open c:\devtemp\python\1.txt, close it, and rerun(33206, 0L, 2, 1, 0, 0, 3L, >>>1080919329<<<, 1080919329, 1080918583)

The Win32 books states that stat.ST_ATIME is "the time the file was
last accessed or zero if the filesystem doesn't support this
information". Obviously I'm missing something, or maybe atime isn't
the best thing for me to use in this situation. Hoping someone can
provide guidance.

TIA
-cjl

 

[Christos TZOTZIOY Georgiou]

On 2 Apr 2004 07:39:38 -0800, rumours say that (e-mail address removed)
(Chris) might have written:

Hi Chris,

I need to monitor a bunch of files to see what is being opened, read,
and closed, with no modifications being made. This is being done
first on Windows machines, and later on Solaris.

# from the i.shell. st_atime date is inside >>><<<
(33206, 0L, 2, 1, 0, 0, 3L, >>>1080919329<<<, 1080919329, 1080918583)

# now i open c:\devtemp\python\1.txt, close it, and rerun

How exactly do you open the file? Through python or through an external
program (eg notepad)? If only through python, do you read any data? I
believe you have to read data for the access time to be updated.

(33206, 0L, 2, 1, 0, 0, 3L, >>>1080919329<<<, 1080919329, 1080918583)

The Win32 books states that stat.ST_ATIME is "the time the file was
last accessed or zero if the filesystem doesn't support this
information". Obviously I'm missing something, or maybe atime isn't
the best thing for me to use in this situation. Hoping someone can
provide guidance.

Windows has a weird behaviour even with st_mtime... I have a directory
structure in a USB disk, which, taking advantage of NTFS capability for
hard links, I present under two different views for the users of my
network. To avoid re-reading the contents of all files, I keep a cache
of (relative-filename, size, modification time); by comparing the cache
to the actual directory structure, every time I change a couple of
files, I read only the changed ones to decide where in the linked
structures I will present them.

I have found (through trial and error) that the modification time does
not show up immediately, esp. if the file is modified in the linked
directory structures... I tried even using a sync.exe from sysinternals,
but that doesn't change a lot. So, after a change, I wait a couple of
minutes and then I run the python script that relinks the files.
Everything works this way.