FileIo class

This class is the parent class for file I/O events.

The following syntax is simplified from MOF code.

Syntax

[Guid("{90cbdc39-4a3e-11d1-84f4-0000f80464e3}"), EventVersion(2)]class FileIo : MSNT_SystemTrace
{
};

Members

The FileIo class does not define any members.

Remarks

To enable the File IO events in an NT Kernel logging session, specify the EVENT_TRACE_FLAG_DISK_FILE_IO flag in the EnableFlags member of an EVENT_TRACE_PROPERTIES structure when calling the StartTrace function. You can also specify one or more of the following flags:

  • EVENT_TRACE_FLAG_FILE_IO
  • EVENT_TRACE_FLAG_FILE_IO_INIT

Event trace consumers can implement special processing for file I/O events by calling the SetTraceCallback function and specifying FileIoGuid as the pGuid parameter. Use the following event types to identify the actual event when consuming events.

Event typeDescription
Event type value is 0File name event. The FileIo_Name MOF class defines the event data for this event.
Event type value is 32File create event. The FileIo_Name MOF class defines the event data for this event.
Event type value is 35File delete event. The FileIo_Name MOF class defines the event data for this event.
Event type value is 36File rundown event. Enumerates all open files on the computer at the end of the trace session. The FileIo_Name MOF class defines the event data for this event.
Event type value is 64File create event. The FileIo_Create MOF class defines the event data for this event.
Event type value is 72Directory enumeration event. The FileIo_DirEnum MOF class defines the event data for this event.
Event type value is 77Directory notification event. The FileIo_DirEnum MOF class defines the event data for this event.
Event type value is 69Set information event. The FileIo_Info MOF class defines the event data for this event.
Event type value is 70Delete file event. The FileIo_Info MOF class defines the event data for this event.
Event type value is 71Rename file event. The FileIo_Info MOF class defines the event data for this event.
Event type value is 74Query file information event. The FileIo_Info MOF class defines the event data for this event.
Event type value is 75File system control event. The FileIo_Info MOF class defines the event data for this event.
Event type value is 76End of operation event. The FileIo_OpEnd MOF class defines the event data for this event.
Event type value is 67File read event. The FileIo_ReadWrite MOF class defines the event data for this event.
Event type value is 68File write event. The FileIo_ReadWrite MOF class defines the event data for this event.
Event type value is 65Clean up event. The event is generated when the last handle to the file is released. The FileIo_SimpleOp MOF class defines the event data for this event.
Event type value is 66Close event. The event is generated when the file object is freed. The FileIo_SimpleOp MOF class defines the event data for this event.
Event type value is 73Flush event. This event is generated when the file buffers are fully flushed to disk. The FileIo_SimpleOp MOF class defines the event data for this event.

 

File IO events are logged at the beginning of the operation.

Requirements

Minimum supported client

Windows Vista [desktop apps only]

Minimum supported server

Windows Server 2008 [desktop apps only]

See also

FileIo_V0
FileIo_V1

 

 

Community Additions

ADD
Show:
© 2014 Microsoft. All rights reserved.