监视我的应用程序执行的文件活动

本文关键字：文件 活动 执行 我的 应用程序 监视 | 更新日期: 2023-09-27 18:25:57

我正在构建一个基于.NET WinForms的应用程序（当前使用.NET 3.5）。

应用程序在某些情况下写入/读取文件。

我希望能够跟踪所有这些文件写入活动（我希望应用程序只写入自己文件夹下的文件，而不写入任何其他文件夹，如C:''Temp）

有没有什么简单的方法可以"探查"这个活动，并查看正在写入哪些文件（可能还有堆栈跟踪）

监视我的应用程序执行的文件活动

您尝试过FileSystemWatcher类吗？

它希望为您提供完整的堆栈跟踪，但您至少可以了解有关使用非常简单的api进行编写的信息。

来自MSDN：

using System;
using System.IO;
class Program
{
    static void Main(string[] args)
    {
        //  Create a FileSystemWatcher to monitor all files on drive C.
        FileSystemWatcher fsw = new FileSystemWatcher("C:''");
        //  Watch for changes in LastAccess and LastWrite times, and
        //  the renaming of files or directories. 
    fsw.NotifyFilter = NotifyFilters.LastAccess | NotifyFilters.LastWrite
        | NotifyFilters.FileName |NotifyFilters.DirectoryName;
    //  Register a handler that gets called when a 
    //  file is created, changed, or deleted.
    fsw.Changed += new FileSystemEventHandler(OnChanged);
    fsw.Created += new FileSystemEventHandler(OnChanged);
    fsw.Deleted += new FileSystemEventHandler(OnChanged);
    //  Register a handler that gets called when a file is renamed.
    fsw.Renamed += new RenamedEventHandler(OnRenamed);
    //  Register a handler that gets called if the 
    //  FileSystemWatcher needs to report an error.
    fsw.Error += new ErrorEventHandler(OnError);
    //  Begin watching.
    fsw.EnableRaisingEvents = true;
    Console.WriteLine("Press ''Enter'' to quit the sample.");
    Console.ReadLine();

}
//  This method is called when a file is created, changed, or deleted.
private static void OnChanged(object source, FileSystemEventArgs e)
{
    //  Show that a file has been created, changed, or deleted.
    WatcherChangeTypes wct = e.ChangeType;
    Console.WriteLine("File {0} {1}", e.FullPath, wct.ToString());
}
//  This method is called when a file is renamed.
private static void OnRenamed(object source, RenamedEventArgs e)
{
    //  Show that a file has been renamed.
    WatcherChangeTypes wct = e.ChangeType;
    Console.WriteLine("File {0} {2} to {1}", e.OldFullPath, e.FullPath, wct.ToString());
}
//  This method is called when the FileSystemWatcher detects an error.
private static void OnError(object source, ErrorEventArgs e)
{
    //  Show that an error has been detected.
    Console.WriteLine("The FileSystemWatcher has detected an error");
    //  Give more information if the error is due to an internal buffer overflow.
    if (e.GetException().GetType() == typeof(InternalBufferOverflowException))
    {
        //  This can happen if Windows is reporting many file system events quickly 
        //  and internal buffer of the  FileSystemWatcher is not large enough to handle this
        //  rate of events. The InternalBufferOverflowException error informs the application
        //  that some of the file system events are being lost.
        Console.WriteLine(("The file system watcher experienced an internal buffer overflow: " + e.GetException().Message));
    }
}
}

您可以使用ProcessMonitor（无需应用程序堆栈跟踪）：

Process Monitor是一个适用于Windows的高级监视工具，它显示实时文件系统、注册表和进程/线程活动。

过程监视器-实际操作实验室和示例

建议您在代码库中搜索FileStream和StreamWriter 的所有出现

您可以使用sysinternals中的Process Monitor来实现这一点（以及更多）。

相关文章：