監視我的應用程序執行的文件活動

Question

我正在構建基於.NET WinForms的應用程序（當前使用.NET 3.5）。

應用程序在某些情況下從文件寫入/讀取。

我希望能夠跟蹤所有這些文件寫入活動（我想應用程序只寫入文件在其自己的文件夾，而不是任何其他文件夾，如C：\ TEMP）

有沒有簡單的方法，我可以在這個活動「嗅」，看看哪些文件被寫入

Answer 1

您是否嘗試過FileSystemWatcher類？

它想要給你完整的堆棧跟蹤，但你至少會得到關於使用相當簡單的api編寫的信息。

從MSDN：

using System; 
using System.IO; 

class Program 
{ 
    static void Main(string[] args) 
    { 
     // Create a FileSystemWatcher to monitor all files on drive C. 
     FileSystemWatcher fsw = new FileSystemWatcher("C:\\"); 

     // Watch for changes in LastAccess and LastWrite times, and 
     // the renaming of files or directories. 
    fsw.NotifyFilter = NotifyFilters.LastAccess | NotifyFilters.LastWrite 
     | NotifyFilters.FileName |NotifyFilters.DirectoryName; 

    // Register a handler that gets called when a 
    // file is created, changed, or deleted. 
    fsw.Changed += new FileSystemEventHandler(OnChanged); 

    fsw.Created += new FileSystemEventHandler(OnChanged); 

    fsw.Deleted += new FileSystemEventHandler(OnChanged); 

    // Register a handler that gets called when a file is renamed. 
    fsw.Renamed += new RenamedEventHandler(OnRenamed); 

    // Register a handler that gets called if the 
    // FileSystemWatcher needs to report an error. 
    fsw.Error += new ErrorEventHandler(OnError); 

    // Begin watching. 
    fsw.EnableRaisingEvents = true; 

    Console.WriteLine("Press \'Enter\' to quit the sample."); 
    Console.ReadLine(); 


} 

// This method is called when a file is created, changed, or deleted. 
private static void OnChanged(object source, FileSystemEventArgs e) 
{ 
    // Show that a file has been created, changed, or deleted. 
    WatcherChangeTypes wct = e.ChangeType; 
    Console.WriteLine("File {0} {1}", e.FullPath, wct.ToString()); 
} 

// This method is called when a file is renamed. 
private static void OnRenamed(object source, RenamedEventArgs e) 
{ 
    // Show that a file has been renamed. 
    WatcherChangeTypes wct = e.ChangeType; 
    Console.WriteLine("File {0} {2} to {1}", e.OldFullPath, e.FullPath, wct.ToString()); 
} 

// This method is called when the FileSystemWatcher detects an error. 
private static void OnError(object source, ErrorEventArgs e) 
{ 
    // Show that an error has been detected. 
    Console.WriteLine("The FileSystemWatcher has detected an error"); 
    // Give more information if the error is due to an internal buffer overflow. 
    if (e.GetException().GetType() == typeof(InternalBufferOverflowException)) 
    { 
     // This can happen if Windows is reporting many file system events quickly 
     // and internal buffer of the FileSystemWatcher is not large enough to handle this 
     // rate of events. The InternalBufferOverflowException error informs the application 
     // that some of the file system events are being lost. 
     Console.WriteLine(("The file system watcher experienced an internal buffer overflow: " + e.GetException().Message)); 
    } 
} 

} 

Answer 2

您可以使用ProcessMonitor這個（沒有應用程序的堆棧跟蹤）（與也許堆棧跟蹤一起）：

過程監視器是一個先進的監視工具f或顯示 實時文件系統，註冊表和進程/線程活動的Windows。

Process Monitor - Hands-On Labs and Examples

建議你搜索你的代碼爲FileStream和StreamWriter

Answer 3

所有occurrances您可以使用Process Monitor Sysinternals公司做到這一點（和更多）。