Отслеживание создания файлов

[5naip]

Здравствуйте.
Появилась идея написать программку,которая будет постоянно висеть в памяти и отслеживать появление новых файлов на харде. Дело в том, что компьютер подключен к локалке и некоторые папки расшарены и дана возможность изменять файлы,а соответственно и добавлять. Вот я бы и хотел оперативно узнавать,что где и от кого появилось
я не прошу дать исходный код,мне нужно только мнение знающих по поводу -
может есть какие-нить готовые компоненты со сходными функциями?
где и что можно почитать на эту тему?
кодю я на Delphi.

[Квэнди]

ReadDirectoryChangesW

из F1:

ReadDirectoryChangesW

The ReadDirectoryChangesW function retrieves information describing the changes occurring within a directory.

To track changes on a volume, see change journals.


BOOL ReadDirectoryChangesW(
HANDLE hDirectory,
LPVOID lpBuffer,
DWORD nBufferLength,
BOOL bWatchSubtree,
DWORD dwNotifyFilter,
LPDWORD lpBytesReturned,
LPOVERLAPPED lpOverlapped,
LPOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine
);

Parameters
hDirectory
[in] Handle to the directory to be monitored. This directory must be opened with the FILE_LIST_DIRECTORY access right.
lpBuffer
[in, out] Pointer to the formatted buffer in which the read results are to be returned. The structure of this buffer is defined by the FILE_NOTIFY_INFORMATION structure. This buffer is filled either synchronously or asynchronously, depending on how the directory is opened and what value is given to the lpOverlapped parameter. For more information, see the Remarks section.
nBufferLength
[in] Length of the buffer pointed to by the lpBuffer parameter, in bytes.
bWatchSubtree
[in] If this parameter is TRUE, the function monitors the directory tree rooted at the specified directory. If this parameter is FALSE, the function monitors only the directory specified by the hDirectory parameter.
dwNotifyFilter
[in] Filter criteria the function checks to determine if the wait operation has completed. This parameter can be one or more of the following values. Value Meaning
FILE_NOTIFY_CHANGE_FILE_NAME Any file name change in the watched directory or subtree causes a change notification wait operation to return. Changes include renaming, creating, or deleting a file.
FILE_NOTIFY_CHANGE_DIR_NAME Any directory-name change in the watched directory or subtree causes a change notification wait operation to return. Changes include creating or deleting a directory.
FILE_NOTIFY_CHANGE_ATTRIBUTES Any attribute change in the watched directory or subtree causes a change notification wait operation to return.
FILE_NOTIFY_CHANGE_SIZE Any file-size change in the watched directory or subtree causes a change notification wait operation to return. The operating system detects a change in file size only when the file is written to the disk. For operating systems that use extensive caching, detection occurs only when the cache is sufficiently flushed.
FILE_NOTIFY_CHANGE_LAST_WRITE Any change to the last write-time of files in the watched directory or subtree causes a change notification wait operation to return. The operating system detects a change to the last write-time only when the file is written to the disk. For operating systems that use extensive caching, detection occurs only when the cache is sufficiently flushed.
FILE_NOTIFY_CHANGE_LAST_ACCESS Any change to the last access time of files in the watched directory or subtree causes a change notification wait operation to return.
FILE_NOTIFY_CHANGE_CREATION Any change to the creation time of files in the watched directory or subtree causes a change notification wait operation to return.
FILE_NOTIFY_CHANGE_SECURITY Any security-descriptor change in the watched directory or subtree causes a change notification wait operation to return.

lpBytesReturned
[out] For synchronous calls, this parameter receives the number of bytes transferred into the lpBuffer parameter. For asynchronous calls, this parameter is undefined. You must use an asynchronous notification technique to retrieve the number of bytes transferred.
lpOverlapped
[in] Pointer to an OVERLAPPED structure that supplies data to be used during asynchronous operation. Otherwise, this value is NULL. The Offset and OffsetHigh members of this structure are not used.
lpCompletionRoutine
[in] Pointer to a completion routine to be called when the operation has been completed or canceled and the calling thread is in an alertable wait state. For more information about this completion routine, see FileIOCompletionRoutine.
Return Values
If the function succeeds, the return value is nonzero. For synchronous calls, this means that the operation succeeded. For asynchronous calls, this indicates that the operation was successfully queued.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Remarks
To obtain a handle to a directory, use the CreateFile function with FILE_FLAG_BACKUP_SEMANTICS as follows:


hDir = CreateFile(
DirName, // pointer to the file name
FILE_LIST_DIRECTORY, // access (read/write) mode
FILE_SHARE_READ|FILE_SHARE_DELETE, // share mode
NULL, // security descriptor
OPEN_EXISTING, // how to create
FILE_FLAG_BACKUP_SEMANTICS, // file attributes
NULL // file with attributes to copy
);

[Квэнди]

продолжение:

A call to ReadDirectoryChangesW can be completed synchronously or asynchronously. To specify asynchronous completion, open the directory with CreateFile as shown above, but additionally specify the FILE_FLAG_OVERLAPPED attribute in the dwFlagsAndAttributes parameter. Then specify an OVERLAPPED structure when you call ReadDirectoryChangesW.

Upon successful synchronous completion, the lpBuffer parameter is a formatted buffer and the number of bytes written to the buffer is available in lpBytesReturned. If the number of bytes transferred is zero, the buffer was too small to provide detailed information on all the changes that occurred in the directory or subtree. In this case, you should compute the changes by enumerating the directory or subtree.

For asynchronous completion, you can receive notification in one of three ways:
Using the GetOverlappedResult function. To receive notification through GetOverlappedResult, do not specify a completion routine in the lpCompletionRoutine parameter. Be sure to set the hEvent member of the OVERLAPPED structure to a unique event.
Using the GetQueuedCompletionStatus function. To receive notification through GetQueuedCompletionStatus, do not specify a completion routine in lpCompletionRoutine. Associate the directory handle hDirectory with a completion port by calling the CreateIoCompletionPort function.
Using a completion routine. To receive notification through a completion routine, do not associate the directory with a completion port. Specify a completion routine in lpCompletionRoutine. This routine is called whenever the operation has been completed or canceled while the thread is in an alertable wait state. The hEvent member of the OVERLAPPED structure is not used by the system, so you can use it yourself.

ReadDirectoryChangesW fails with ERROR_INVALID_PARAMETER when the buffer length is greater than 64 KB and the application is monitoring a directory over the network. This is due to a packet size limitation with the underlying file sharing protocols: Server Message Block (SMB) on Windows Me/98/95, and Common Internet File System (CIFS) on Windows Server 2003/XP/2000.


Windows 2000: Clients that attempt multiple simultaneous long-term requests against a server, for example change notifications, should be running Service Pack 2 or higher. See Knowledge Base article Q271148 for more details.


To compile an application that uses this function, define the _WIN32_WINNT macro as 0x0400 or later. For more information, see Using the SDK Headers.

Requirements
Client: Included in Windows XP, Windows 2000 Professional, and Windows NT Workstation 3.51 SP3 and later.
Server: Included in Windows Server 2003, Windows 2000 Server, and Windows NT Server 3.51 SP3 and later.
Unicode: Implemented only as Unicode.
Header: Declared in Winbase.h; include Windows.h.
Library: Use Kernel32.lib.


See Also
CreateFile, CreateIoCompletionPort, Directory Management Functions, FileIOCompletionRoutine, GetOverlappedResult, GetQueuedCompletionStatus, FILE_NOTIFY_INFORMATION, OVERLAPPED

[Stilet]

Если будеш по сети это выяснять то советую на каждый комп кидать такого клиента-шпиена, который в общую базу будет инфу сливать.

[5naip]

спасибо
буду сидеть переводить сегодня-завтра...
2 Stilet, нет, мне всего лишь надо чтоб он висел у меня на машине и отслеживал только мой диск...