When to capture FILE_CREATED Information

OSR_Community_User · January 23, 2006, 11:38pm

Hi

I am writting a file system filter driver. My purpose is to log files that are either created or overwritten only.
For this I have to capture the FILE_CREATED or FILE_OVERWRITTEN information which is available in Irp->IoStatus.Information at IRP_MJ_CREATE.

The solution i found from the forum is to set the Completion routine for IRP_MJ_CREATE. The below are the problems i face when i try to get the FILE_CREATED information.

I already have a completion routine common for all IRPs. Here in case of IRP_MJ_CREATE the completion routine is called only when IRP_MJ_CLOSE occurs. Is it correct to have a common completion routine for all IRPs? Also the value of Irp->IoStatus->Information is always FILE_OPENED.
If it is wrong how to set completion routine only for IRP_MJ_CREATE?

Yahoo! Photos
Got holiday prints? See all the ways to get quality prints in your hands ASAP.

OSR_Community_User · January 24, 2006, 12:07am

I AM GETTING FAILURE DELIVERY REPORT. IS THERE ANY PROBLEM IN THE SERVER.

Hi

I am writting a file system filter driver. My purpose is to log files that are either created or overwritten only.
For this I have to capture the FILE_CREATED or FILE_OVERWRITTEN information which is available in Irp->IoStatus.Information at IRP_MJ_CREATE.

The solution i found from the forum is to set the Completion routine for IRP_MJ_CREATE. The below are the problems i face when i try to get the FILE_CREATED information.

I already have a completion routine common for all IRPs. Here in case of IRP_MJ_CREATE the completion routine is called only when IRP_MJ_CLOSE occurs. Is it correct to have a common completion routine for all IRPs? Also the value of Irp->IoStatus->Information is always FILE_OPENED.
If it is wrong how to set completion routine only for IRP_MJ_CREATE?

Yahoo! Photos
Ring in the New Year with Photo Calendars. Add photos, events, holidays, whatever.

OSR_Community_User · January 24, 2006, 12:20am

Hi

I am writting a file system filter driver. My purpose is to log files that are either created or overwritten only.
For this I have to capture the FILE_CREATED or FILE_OVERWRITTEN information which is available in Irp->IoStatus.Information at IRP_MJ_CREATE.

The solution i found from the forum is to set the Completion routine for IRP_MJ_CREATE. The below are the problems i face when i try to get the FILE_CREATED information.

I already have a completion routine common for all IRPs. Here in case of IRP_MJ_CREATE the completion routine is called only when IRP_MJ_CLOSE occurs. Is it correct to have a common completion routine for all IRPs? Also the value of Irp->IoStatus->Information is always FILE_OPENED.
If it is wrong how to set completion routine only for IRP_MJ_CREATE?

Yahoo! Autos. Looking for a sweet ride? Get pricing, reviews, & more on new and used cars.

Lyndon_J_Clarke-2 · January 24, 2006, 5:57am

You have to have the completion routine called for the IRP_MJ_CREATE and you
have to look at the completion information for the IRP_MJ_CREATE instead of
the IRP_MJ_CLOSE. AFAIK that field is not defined for IRP_MJ_CLOSE anyway!
Look like it will be a GoodThing™ if you go read the beginner design
documentation in the IFS KIT and look at the sample filters there also for
example filespy. You should also be giving serious thought to a minifilter
instead of a traditional (aka legacy) filter.

“veera jothi” wrote in message
news:xxxxx@ntfsd…
Hi

I am writting a file system filter driver. My purpose is to log files
that are either created or overwritten only.
For this I have to capture the FILE_CREATED or FILE_OVERWRITTEN
information which is available in Irp->IoStatus.Information at
IRP_MJ_CREATE.

The solution i found from the forum is to set the Completion routine for
IRP_MJ_CREATE. The below are the problems i face when i try to get the
FILE_CREATED information.

1. I already have a completion routine common for all IRPs. Here in case
of IRP_MJ_CREATE the completion routine is called only when IRP_MJ_CLOSE
occurs. Is it correct to have a common completion routine for all IRPs? Also
the value of Irp->IoStatus->Information is always FILE_OPENED.

2. If it is wrong how to set completion routine only for IRP_MJ_CREATE?

Yahoo! Photos
Got holiday prints? See all the ways to get quality prints in your hands
ASAP.

OSR_Community_User · January 24, 2006, 7:07am

Thanks for your reply.

As u say I have a completion routine set for IRP_MJ_CREATE. But it is never invoked.

Also In case of IRP_MJ_CREATE do i have to call IoCompleteRequest or should I pass the IRP down to the lower driver?

Thanks in advance

Lyndon J Clarke wrote:
You have to have the completion routine called for the IRP_MJ_CREATE and you
have to look at the completion information for the IRP_MJ_CREATE instead of
the IRP_MJ_CLOSE. AFAIK that field is not defined for IRP_MJ_CLOSE anyway!
Look like it will be a GoodThing™ if you go read the beginner design
documentation in the IFS KIT and look at the sample filters there also for
example filespy. You should also be giving serious thought to a minifilter
instead of a traditional (aka legacy) filter.

“veera jothi” wrote in message
news:xxxxx@ntfsd…
Hi

I am writting a file system filter driver. My purpose is to log files
that are either created or overwritten only.
For this I have to capture the FILE_CREATED or FILE_OVERWRITTEN
information which is available in Irp->IoStatus.Information at
IRP_MJ_CREATE.

The solution i found from the forum is to set the Completion routine for
IRP_MJ_CREATE. The below are the problems i face when i try to get the
FILE_CREATED information.

1. I already have a completion routine common for all IRPs. Here in case
of IRP_MJ_CREATE the completion routine is called only when IRP_MJ_CLOSE
occurs. Is it correct to have a common completion routine for all IRPs? Also
the value of Irp->IoStatus->Information is always FILE_OPENED.

2. If it is wrong how to set completion routine only for IRP_MJ_CREATE?

Yahoo! Photos
Got holiday prints? See all the ways to get quality prints in your hands
ASAP.

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com

---------------------------------

What are the most popular cars? Find out at Yahoo! Autos

David_J_Craig · January 24, 2006, 12:32pm

Read the documentation as Lyndon suggested. These questions are basic and fundamental to writing file system filter drivers. Do you have the IFS Kit? If so, why not use the samples that provide the information you require? It would be easy to modify one of them to only provide what you need.
“veera jothi” wrote in message news:xxxxx@ntfsd…
Thanks for your reply.

As u say I have a completion routine set for IRP_MJ_CREATE. But it is never invoked.

Also In case of IRP_MJ_CREATE do i have to call IoCompleteRequest or should I pass the IRP down to the lower driver?

Thanks in advance

Lyndon J Clarke wrote:
You have to have the completion routine called for the IRP_MJ_CREATE and you
have to look at the completion information for the IRP_MJ_CREATE instead of
the IRP_MJ_CLOSE. AFAIK that field is not defined for IRP_MJ_CLOSE anyway!
Look like it will be a GoodThing™ if you go read the beginner design
documentation in the IFS KIT and look at the sample filters there also for
example filespy. You should also be giving serious thought to a minifilter
instead of a traditional (aka legacy) filter.

“veera jothi” wrote in message
news:xxxxx@ntfsd…
Hi

I am writting a file system filter driver. My purpose is to log files
that are either created or overwritten only.
For this I have to capture the FILE_CREATED or FILE_OVERWRITTEN
information which is available in Irp->IoStatus.Information at
IRP_MJ_CREATE.

The solution i found from the forum is to set the Completion routine for
IRP_MJ_CREATE. The below are the problems i face when i try to get the
FILE_CREATED information.

1. I already have a completion routine common for all IRPs. Here in case
of IRP_MJ_CREATE the completion routine is called only when IRP_MJ_CLOSE
occurs. Is it correct to have a common completion routine for all IRPs? Also
the value of Irp->IoStatus->Information is always FILE_OPENED.

2. If it is wrong how to set completion routine only for IRP_MJ_CREATE?

Yahoo! Photos
Got holiday prints? See all the ways to get quality prints in your hands
ASAP.

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com

------------------------------------------------------------------------------

What are the most popular cars? Find out at Yahoo! Autos