CBMonitor Class

Properties   Methods   Events   Configuration Settings   Errors  

The CBMonitor class allows applications to monitor filesystem requests.

Syntax

cbfsfilter.Cbmonitor

Remarks

The CBMonitor class is a "monitoring-only" subset of the CBFilter class; it gives applications the ability to monitor filesystem requests, allowing them to be logged, reported, etc. Applications use standard filter rules to specify which requests they're interested in monitoring.

To learn more about the class's capabilities, please refer to the product's General Information topics.

Getting Started

  1. If the class's system driver hasn't been installed yet, call the Install method to do so. This only needs to be done once.
    • In production, the driver can be installed (or updated) ahead-of-time by the application's installation script using the Installer DLL. Please refer to the Driver Installation topic for more information.
  2. Call the Initialize method to initialize the CBMonitor class. This must be done each time the application starts.
  3. Add one or more filter rules using methods like AddFilterRule. (Rules can also be added/removed after the filter is started.)
  4. Call the StartFilter method to start monitoring filesystem requests.
  5. When finished, call the StopFilter method to stop monitoring filesystem requests.
  6. To uninstall the class's system driver, call the Uninstall method. This should not be done as part of the driver upgrade process.
    • In production, the driver can be uninstalled by the application's uninstallation script using the Installer DLL. Please refer to the Driver Installation topic for more information.

Property List


The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

ActiveWhether the class is active and processing requests.
AltitudeThe altitude the class's system driver should use when operating in minifilter mode.
FilterModeThe filter mode the class's system driver should use.
FilterRulesCollection of filter rules.
FireVolumeEventsThe events that should be fired when a filesystem volume is mounted to or unmounted from the system.
PassthroughRulesCollection of passthrough rules.
ProcessCachedIORequestsWhether cached file read/write requests should be processed.
ProcessFailedRequestsWhether failed requests should be processed.
SerializeEventsWhether events should be fired on a single worker thread, or many.
TagStores application-defined data specific to this instance of the class.

Method List


The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

AddFilterRuleAdds a standard filter rule.
AddFilterRuleExAdds a standard filter rule with additional match qualifiers.
AddPassthroughRuleAdds a passthrough rule.
AddPassthroughRuleExAdds a passthrough rule with additional match qualifiers.
ConfigSets or retrieves a configuration setting.
DeleteAllFilterRulesDeletes all standard filter rules.
DeleteAllPassthroughRulesDeletes all passthrough rules.
DeleteFilterRuleDeletes a particular standard filter rule.
DeletePassthroughRuleDeletes a particular passthrough rule.
FileMatchesMaskChecks whether a particular file or directory name matches the specified mask.
FlushNotificationQueueFlushes the notification event queue.
GetDriverStatusRetrieves the status of the class's system driver.
GetDriverVersionRetrieves the version of the class's system driver.
GetOriginatorProcessIdRetrieves the Id of the process (PID) that initiated the operation.
GetOriginatorProcessNameRetrieves the name of the process that initiated the operation.
GetOriginatorThreadIdRetrieves the Id of the thread that initiated the operation.
GetVolumeGUIDRetrieves the volume GUID of the device targeted by a filesystem operation.
InitializeInitializes the class.
InstallInstalls (or upgrades) the class's system driver.
NtStatusToWin32ErrorConverts a native status code to a Win32 error code.
ShutdownSystemShuts down or reboots the operating system.
StartFilterStart filtering filesystem operations.
StopFilterStop filtering filesystem operations.
UninstallUninstalls the class's system driver.

Event List


The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

AfterFilterAttachToVolumeFires after the filter attaches to a newly-mounted filesystem volume.
AfterFilterDetachFromVolumeFires after the filter detaches from a filesystem volume.
BeforeFilterAttachToVolumeFires before the filter attaches to a newly-mounted filesystem volume.
ErrorFires if an unhandled error occurs during an event.
FilterStartFires once the filter has attached and filtering has started.
FilterStopFires once filtering has stopped and the filter has detached.
NotifyCanFileBeDeletedFires when the OS marks a file or directory for deletion or removes such a mark.
NotifyCleanupFileFires when a file or directory handle has been closed.
NotifyCloseFileFires when a file or directory has been closed.
NotifyCreateFileFires when a file or directory has been created.
NotifyCreateHardLinkFires when a hard link has been created.
NotifyDeleteFileFires when a file or directory has been deleted.
NotifyEnumerateDirectoryFires when a directory entry has been returned during directory enumeration.
NotifyFilterAttachToVolumeFires when the filter has been attached to a newly-mounted filesystem volume.
NotifyFilterDetachFromVolumeFires when the filter has been detached from a filesystem volume.
NotifyFsctlFires when an IRP_MJ_FILE_SYSTEM_CONTROL operation has occurred.
NotifyGetFileSecurityFires when a file or directory's security attributes have been retrieved.
NotifyGetFileSizesFires when a file's size information has been retrieved.
NotifyIoctlFires when an IRP_MJ_DEVICE_CONTROL operation has occurred.
NotifyLockFires when a range of bytes in a file has been locked.
NotifyOpenFileFires when a file or directory has been opened.
NotifyQueryFileInfoFires when information about a file or directory has been retrieved.
NotifyReadFileFires when data has been read from a file.
NotifyRenameOrMoveFileFires when a file or directory has been renamed or moved.
NotifySetAllocationSizeFires when a file's allocation size has been changed.
NotifySetFileAttributesFires when a file or directory's attributes and/or times have been changed.
NotifySetFileInfoFires when information about a file or directory has been changed.
NotifySetFileSecurityFires when a file or directory's security attributes have been changed.
NotifySetFileSizeFires when a file has been resized.
NotifyUnlockAllFires when all locked byte ranges in a file have been unlocked.
NotifyUnlockAllByKeyFires when all locked byte ranges in a file, associated with a particular key, have been unlocked.
NotifyUnlockSingleFires when a particular locked byte range in a file has been unlocked.
NotifyWriteFileFires when data has been written to a file.
WorkerThreadCreationFires just after a new worker thread is created.
WorkerThreadTerminationFires just before a worker thread is terminated.

Configuration Settings


The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.

AlwaysPrepareFilesWhether the driver should keep track of information for files that are already open when (i.e., were opened before) the class is initialized.
FilterOwnRequestsWhether the class's system driver should filter requests made by the application itself.
ForceAppPermissionCheckWhether the driver should require the controller process to have elevated or system privileges.
ForceSecurityChecksWhether the driver should prevent the controller process from filtering files that it would not normally have access to.
LoggingEnabledWhether extended logging is enabled.
MaxWorkerThreadCountThe maximum number of worker threads to use to fire events.
MinWorkerThreadCountThe minimum number of worker threads to use to fire events.
PreprocessedRulesCacheSizeMaximum number of preprocessed rules to keep cached.
ResolveNtDeviceToDriveLetterWhether native device names are translated to drive letters.
SendRequestsViaDriverStackWhether internal requests to the filesystem are sent directly to the filesystem driver or through the stack of filesystem filter drivers.
WorkerInitialStackSizeThe initial stack size to create worker threads with.
BuildInfoInformation about the product's build.
LicenseInfoInformation about the current license.

Copyright (c) 2022 Callback Technologies, Inc. - All rights reserved.
CBFS Filter 2020 Java Edition - Version 20.0 [Build 8317]