Edit

FileIo class

  • Article

This class is the parent class for file I/O events.

The following syntax is simplified from MOF code.

Syntax

[Guid("{90cbdc39-4a3e-11d1-84f4-0000f80464e3}"), EventVersion(2)]
class FileIo : MSNT_SystemTrace
{
};

Members

The FileIo class does not define any members.

Remarks

To enable the File IO events in an NT Kernel logging session, specify the EVENT_TRACE_FLAG_DISK_FILE_IO flag in the EnableFlags member of an EVENT_TRACE_PROPERTIES structure when calling the StartTrace function. You can also specify one or more of the following flags:

  • EVENT_TRACE_FLAG_FILE_IO
  • EVENT_TRACE_FLAG_FILE_IO_INIT

Event trace consumers can implement special processing for file I/O events by calling the SetTraceCallback function and specifying FileIoGuid as the pGuid parameter. Use the following event types to identify the actual event when consuming events.

Event type Description
Event type value is 0 File name event. The FileIo_Name MOF class defines the event data for this event.
Event type value is 32 File create event. The FileIo_Name MOF class defines the event data for this event.
Event type value is 35 File delete event. The FileIo_Name MOF class defines the event data for this event.
Event type value is 36 File rundown event. Enumerates all open files on the computer at the end of the trace session. The FileIo_Name MOF class defines the event data for this event.
Event type value is 64 File create event. The FileIo_Create MOF class defines the event data for this event.
Event type value is 72 Directory enumeration event. The FileIo_DirEnum MOF class defines the event data for this event.
Event type value is 77 Directory notification event. The FileIo_DirEnum MOF class defines the event data for this event.
Event type value is 69 Set information event. The FileIo_Info MOF class defines the event data for this event.
Event type value is 70 Delete file event. The FileIo_Info MOF class defines the event data for this event.
Event type value is 71 Rename file event. The FileIo_Info MOF class defines the event data for this event.
Event type value is 74 Query file information event. The FileIo_Info MOF class defines the event data for this event.
Event type value is 75 File system control event. The FileIo_Info MOF class defines the event data for this event.
Event type value is 76 End of operation event. The FileIo_OpEnd MOF class defines the event data for this event.
Event type value is 67 File read event. The FileIo_ReadWrite MOF class defines the event data for this event.
Event type value is 68 File write event. The FileIo_ReadWrite MOF class defines the event data for this event.
Event type value is 65 Clean up event. The event is generated when the last handle to the file is released. The FileIo_SimpleOp MOF class defines the event data for this event.
Event type value is 66 Close event. The event is generated when the file object is freed. The FileIo_SimpleOp MOF class defines the event data for this event.
Event type value is 73 Flush event. This event is generated when the file buffers are fully flushed to disk. The FileIo_SimpleOp MOF class defines the event data for this event.

 

File IO events are logged at the beginning of the operation.

Requirements

Requirement Value
Minimum supported client
 Windows Vista [desktop apps only]
Minimum supported server
 Windows Server 2008 [desktop apps only]

See also

MSNT_SystemTrace

FileIo_V0

FileIo_V1