Introduction to Monitoring File System Events

Article
11/16/2012

You use the FileSystemWatcher component to monitor a file system and react when changes to the directories or files it contains occur. This makes it possible for you to quickly and easily launch business processes when certain files or directories are created, modified, or deleted. For example, suppose you and a group of coworkers are collaborating on a document that is stored on a shared directory on your server. Using an instance of the FileSystemWatcher component, you can program your application to watch for changes to the contents of that shared directory. When a change is detected, the component can run procedures that notify each of the group members via e-mail.

Note

The FileSystemWatcher component is designed to watch for changes within a directory, not to changes to the root directory's attributes themselves. For example, if you are watching a directory called c:\MyProjects, the component will monitor changes within the directory but not changes to the root directory itself.

You can configure the component to watch either an entire directory and its contents or a specific file or set of files within a given directory. The FileSystemWatcher component raises an event whenever a file or subdirectory within the specified root directory is created, deleted, renamed, or changed in some other way. The types of changes that the component monitors include changes in the file's or subdirectory's attributes, size, last write time, last access time, and security settings.

Security Note:
A denial-of-service attack is possible if a malicious program gains access to a directory your FileSystemWatcher component is monitoring and generates so many changes that the component cannot manage them. Follow the recommendations in Considerations for File Changes on High-Volume Systems and use access control lists properly to reduce the risk of a denial-of-service attack.

Directory-Level Events

When changes occur within a root directory or to a file your application is monitoring, one or more events are raised, stored in a buffer, and ultimately passed to your component for processing. The FileSystemWatcher component gives you access to the following events:

Created — raised whenever a directory or file is created.
Deleted — raised whenever a directory or file is deleted.
Renamed — raised whenever the name of a directory or file is changed.
Changed — raised whenever changes are made to the size, system attributes, last write time, last access time, or security permissions of a directory or file.

Note

Although some common occurrences, such as copying or moving a file, do not correspond directly to an event, these occurrences do cause events to be raised. When you copy a file, the system raises a Created event in the directory to which the file was copied but does not raise any events in the original directory. When you move a file, the server raises two events: a Deleted event in the source directory, followed by a Created event in the target directory.

Each change to a file in a directory raises a separate event. If a user makes multiple changes to a single file, the application raises a separate event for each change. For example, if you are watching a directory that contains five files and the security permissions for all of the files suddenly change, you will receive five Changed events. If the user renames and assigns new security permissions to each of those files, you will receive 10 event notifications — a Changed event and a Renamed event for each of the five files.

Share via

Introduction to Monitoring File System Events

Directory-Level Events

See Also

Tasks

Concepts

Additional resources