如何在Windows下监控/记录文件对远程文件夹的访问？

Question

I would like to log the name of all the files I access from a particular network share (and the process accessing the the file).

What are the solutions in C++ / Win32 preferably ?

Answer 1

You need ReadDirectoryChangesW and the FILE_NOTIFY_CHANGE_LAST_ACCESS notification flag.

I don't think the old FindFirstChangeNotification will work for you as it only notifies on changes, not access, but I've traditionally used that for file/directory notifications.

Answer 2

Process Monitor from sysinternals.com can be set up to filter on the path. You can set the path to the UNC you're interested in watching.

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Answer 3

If it's for after-the-fact, you could use the Windows' security auditing .

If you need to do it in real-time, then you might need to interface with the Windows message queue and sniff the specific events that interest you.