Considerations for File Changes on High-Volume Systems 

  • Article

Your FileSystemWatcher component has the potential to receive an enormous number of events, particularly if you have set it to watch a very high-traffic directory. This can cause problems, as the FileSystemWatcher component can only receive event notifications at a manageable rate. If the rate at which events are coming in exceeds the rate at which the component can receive them, the excess events are stored in a buffer that is then passed to the component. The component translates each entry in the buffer to an event to be raised to the user's code. This buffer can cause a problem in that it can overflow. If the number of changes in a directory is so large that they cannot all fit in the buffer, the operating system will issue a "blanket" notification, and the component will raise an exception.

Security noteSecurity Note

A denial-of-service attack is possible if a malicious program gains access to a directory your FileSystemWatcher component is monitoring and generates so many changes that the component cannot manage them. Follow the recommendations in this Help page and use access control lists properly to reduce the risk of a denial-of-service attack.

To avoid this problem, you should do several things. First, you should set your buffer to an appropriate size for the approximate number of events you expect to receive. By default, the buffer is set to a size of 4 KB. A 4 KB buffer can track changes on approximately 80 files in a directory. Each event takes up 16 bytes in the buffer, plus enough bytes to store the name of the file, in Unicode (2 bytes per character), that the event occurred on. You can use this information to approximate the buffer size you will need.

You reset the buffer size by setting the InternalBufferSize property in the Properties window. If you are using Microsoft Windows 2000, you should increase the buffer size in increments of 4 KB, because this corresponds to the operating system's default page size. With any other operating system, you should increase the buffer size in increments that correspond to the operating system's default page size.

NoteTip

If you are unsure of the default page size for the operating system you are using, the safest way to proceed is to just double the original size of the buffer. This will maintain the original interval needed for your operating system.

In addition to setting an appropriate buffer size, you can use the following three properties to control the amount of information that the buffer receives:

  • Use the NotifyFilter property to determine whether the FileSystemWatcher component looks for all changes or only specified changes in the watched directory.

  • Use the IncludeSubdirectories property to indicate whether or not you want to include the subdirectories of the directory you are watching. If you turn this off when you do not need it, you will receive fewer events than when it is turned on.

  • If you have set the FileSystemWatcher component to watch for the Changed event, you can use the NotifyFilter property to specify only those events in which you are interested.

    NoteNote

    Although you can also use the Filter property to specify files or subdirectories that you want watched, this property is applied after changes are added to your buffer and will not reduce the buffer size at all. Instead, use the NotifyFilter property to control the amount of information written to the buffer.

See Also

Tasks

How to: Configure FileSystemWatcher Component Instances

Concepts

Introduction to Monitoring File System Events