get_originator_process_name Method
Retrieves the name of the process that initiated the operation.
Syntax
def get_originator_process_name() -> str: ...
Remarks
This method can be called within events fired for filesystem operations to retrieve the name of the process that initiated the operation. If the query fails, this method returns empty string.
Applications cannot use this method to retrieve information about remote processes accessing drives shared on the network. Windows does not provide such information due to the nature of remote access.
Note: This method can only be called within events, and must be called in the same thread that the event was originally fired on. However, it must not be called within events that work with opened files since such events can be initiated by system components (e.g., the cache manager, memory manager, etc.). If applications need the information this method returns during such events, they may do the following:
- Call this method within the on_create_file or on_open_file event.
- Store the information somewhere, and store a reference to it in the event's HandleContext parameter.
- In a later event, access the information via the reference stored in HandleContext.
Note: Renaming and deletion of files is performed after the file is opened. Thus, access checks should be performed during file opening as described above.
Note: This method cannot be used from on_cleanup_context event handlers.