Click here to Skip to main content
15,886,422 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I am creating an application that is supposed to monitor file changes on all available drives on the device using FileSystemWatcher. The problem is that monitoring doesn't work on the system drive ("C:\"). Application has the highest permissions used in the manifest. I do not know why it is, so I am asking for help in solving this problem. Code snippet available below.

What I have tried:

string[] drives = Environment.GetLogicalDrives();
            foreach (string strDrive in drives)
            {
                DriveInfo df = new DriveInfo(strDrive);
                FileWat = new FileSystemWatcher();
                FileWat.IncludeSubdirectories = true;
                FileWat.Filter = "*";
                FileWat.Path = df.Name;
                FileWat.NotifyFilter = NotifyFilters.FileName | NotifyFilters.DirectoryName | NotifyFilters.Attributes | NotifyFilters.Size | NotifyFilters.LastWrite | NotifyFilters.LastAccess | NotifyFilters.CreationTime | NotifyFilters.Security;
                FileWat.Created += new FileSystemEventHandler(FilewatCreated);
                FileWat.Changed += new FileSystemEventHandler(FileChanged);             
                FileWat.Renamed += new RenamedEventHandler(FileRenamed);
                FileWat.InternalBufferSize = 65536; // 64 KB – the maximum allowed buffer size.
                FileWat.EnableRaisingEvents = true;
            }
Posted
Updated 26-Aug-21 11:51am

1 solution

You should not be monitoring entire drives. The FSW isn't really built for that.

The FSW has to walk the entire directory tree, taking a snapshot of the directory content of each folder on the drive. That can take a while as the typical folder tree of the C: drive can be quite large.

Once that snapshot is taken, the FSW has to walk the entire tree again, comparing what it sees now to what is saw before. Events are fired for the changes it sees and the snapshot is updated to include any new changes.

Once the "poll" is done, it starts over and starting another polling cycle.

The larger the directory tree is, the longer it takes to do a single poll. If you've got a couple hundred thousand files on the C: drive, you could be waiting 10 minutes or more for a single event to start firing, and just as long for any subsequent events.
 
Share this answer
 
Comments
BillWoodruff 26-Aug-21 20:33pm    
+5 what a great explanation !
Richard Deeming 27-Aug-21 4:46am    
Is that accurate though? The FSW uses ReadDirectoryChangesW[^], but I can't see any details of precisely how that's implemented at the kernel level.
Dave Kreskowiak 27-Aug-21 10:49am    
That's how the FSW used to work.

ReadDirectoryChangesW is so poorly documented, it seems nobody but the few MS hermits who wrote it knows what goes on under the hood.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900