How to tell when a file is opened

[Adam]

Hello,

I want to know if it possible to tell when a file is opened. However I
don't want it to be the last access time. I want to know how many
times a file opened so I can generate statistics of file usage.

I will be wanting to watch all files on a server so this will be on
quite a large scale. So checking a directory on a loop for accesses
won't work.

Maybe some way to monitor the Open Files section of Computer
Management?

I check through Tim Golden's site but nothing jumped out at me.
Any pointers would be great.

Thanks,
Adam

 

[Tim Golden]

I want to know if it possible to tell when a file is opened. However I
don't want it to be the last access time. I want to know how many
times a file opened so I can generate statistics of file usage.

I will be wanting to watch all files on a server so this will be on
quite a large scale. So checking a directory on a loop for accesses
won't work.

Maybe some way to monitor the Open Files section of Computer
Management?

I check through Tim Golden's site but nothing jumped out at me.
Any pointers would be great.

I take it from the fact that you mention my site (and
your reference to "Computer Management") that you're
looking at Win32? It's always best to be explicit when
you're asking for help; a lot of people on this list
will be using Linux or Mac where the answers are
probably very different.

This is no small task you've set yourself! As far as I know,
you're going to have to go down to the level of change journals
for this kind of thing. (Search for "NTFS change journal").

Although you might think: the filesystem knows when files are
being accessed; can't I hook into that directly? I think the
answer is: no. But I could be wrong.

TJG

 

[Terry Reedy]

| Hello,
|
| I want to know if it possible to tell when a file is opened.

Just by Python? (Hack the file and open and possibly os.open code)
or by any program? (Hack the OS -- good luck!)

 

[Adam]

I take it from the fact that you mention my site (and
your reference to "Computer Management") that you're
looking at Win32? It's always best to be explicit when
you're asking for help; a lot of people on this list
will be using Linux or Mac where the answers are
probably very different.

This is no small task you've set yourself! As far as I know,
you're going to have to go down to the level of change journals
for this kind of thing. (Search for "NTFS change journal").

Although you might think: the filesystem knows when files are
being accessed; can't I hook into that directly? I think the
answer is: no. But I could be wrong.

TJG

Sorry about not mentioning my platform.

What you mention looks promising. Will look into it. Like I said
knowing the last access time is not useful as I would have to be
constantly looping through the directory looking for changes.

Will look into NTFS change journals when I get some spare time.

Thanks for the reply.
Adam

 

[Gabriel Genellina]

You may look into some tools like FileMon and Process Monitor from
www.sysinternals.com; I think that doing the processing in Python
would slow down your system a lot (or not, just try!)

 

[Adam]

You may look into some tools like FileMon and Process Monitor fromwww.sysinternals.com;I think that doing the processing in Python
would slow down your system a lot (or not, just try!)

You see I was mainly hoping that python would not be doing the
processing per se. More that, as Tim put it, it would hook itself into
whatever monitors the shares to see when files are open and dump that
info somewhere (like a database or xml) then at a set time (at night
for example) Python would take that information collect it into
historical logs and update a web page with recent stats.

Obviously I have to check that the most vital part is even possible or
at least within my limit programming knowledge (which is why I ask
here.)

Adam

 

[momobear]

Will look into NTFS change journals when I get some spare time.

How can we get NTFS change journals? Is there any API for this purpose
or we could implement our own?
there're an api in windows help us montior file changes.
win32file.ReadDirectoryChangesW

 

[Tim Golden]

How can we get NTFS change journals? Is there any API for this purpose
or we could implement our own?
there're an api in windows help us montior file changes.
win32file.ReadDirectoryChangesW

Don't know what the API is but whatever it ends up being,
there's always ctypes. This article:

http://www.codeproject.com/useritems/Eyes_on_NTFS.asp

points to DeviceIOControl and CreateFile, both in the
win32file module.

The problem with win32file.ReadDirectoryChangesW, which the
OP probably saw when he looked at my site (though he doesn't
actually say so) is that you're trying to monitor *an entire
hard disk*, maybe more. And you'll almost certainly run into
buffer shortfalls or even performance issues. But I don't
really have access to a big enough or used enough disk to
carry out a meaningful test.

TJG