Thread: Monitering Open Network Shared Files

Ok, sorry if the title didnt explain it well enough but here is my problem. I need to write a program that will monitor a few files on our Server here that are shared. I need to know when someone opens the file, closes the file, who opened it, and preferable with what, although I think that might be a slim chance. I know you can get this information in a static form with "openfiles" or "net files" and thier is an API call I think its something like EnumOpenFiles or some such. But all of that requirs polling, which i hate. Especialy since id need at minimum 10 seconds of percision and thats alot of polling... Id much rather find out thier is a Callback function or a Hook I can use to find out when a file is opened with Microsoft Networking. So thats my question, does anyone know of any such Callback or other equivelent methods. Thanks very much in advance!

Kirk

This may be a good starting point File system spy

Tantalizingly close, but unfortunatly no cigar. The thought occurs to me that I could use the notification for File_Last_Access_Time_Changed and then Enum the open shares to find out who just opened it. But that doesnt give me a way to find out when they close it. Nor does it give me suficient information as to what they opened it with, although at this point ill just settle for knowing when a user opens and then closes the file, never mind what they opened it with. But thanks for the help, even though this doesnt quick solve my problem its still usefull information. So thanks! Anyone else have any ideas?

1. Windows has built-in auditing. I don't think this can be used to tell when a file has been closed.

2. As you eluded to, you can use NetFileEnum to enumerate files that are open across the network.

I don't know anyway of getting notified of opening files. You could set up auditing and then be notified of new event log entries (probably with the WMI class Win32_NTLogEvent).

Id thought of that, but as you said, thiers no way to know when they close the file. Here, ill quickly describe my problem. We have a 200 or so user network here, and a single flat file database that about 100 or so of our employees use. Its a simple access database. Unfortunatly, thier are 3 custom programs plus some Access Forms that use it accross all these users. Now, the problem is, mabye once or twice a day, the database gets currupted. We THINK that its probably not any of the programs that access it because using any of these programs by themselves in our test environment has never caused the problem. We think it is some combination of them all accross several of the computers that causes it but we dont realy have any way to track when people use it so we can track down what the possible causes might be. My only thought was to find some way to track the files usage with some kind of System Callback or Hook that would notify me when the file was opened and then closed and by what user. But no matter how I wrack my brains I cant seam to think of any combination of functions that I know of that will give me the required information. Anyway, I havnt given up yet, if anyone can think of any leads let me know. At this point the only remaining problem seams to be determining when the file is closed. I am trying to avoid polling at ANY cost. Thanks for the help so far!