USN problem RRS feed

  • 问题

  •  Dear all,

    I use usn journal for monitoring file change and do not aware of how to handle the situation as follows:

    1)     There are two reason (USN_REASON_FILE_CREATE|USN_REASON_FILE_DELETE) in a USN. May I should handle Create , Delete or both?

    2)     I accept a usn with reason (USN_REASON_DATA_OVERWRITE | USN_REASON_DATA_EXTEND| USN_REASON_DATA_TRUNCATION | USN_REASON_INDEXABLE_CHANGE | USN_REASON_FILE_CREATE | USN_REASON_CLOSE ). The FileReferenceNumber and ParentFileReferenceNumber of the usn is the same with the existing file, such as file named *.etl. Why open a existing file has a USN_REASON_FILE_CREATE reason Thanks you in advance!

    2018年1月19日 6:30