Cached and Non-Cached Requests

Windows has an extremely robust file caching system which it makes extensive use of in order to provide optimal file I/O performance at all times. To accomplish this, file read/write requests are routed to the cache manager by default, and the cache manager attempts to service said requests with as few actual filesystem calls as possible. These behaviors result in a file I/O model that has three separate "paths" for file data to flow over:

1. From an application (or system component) to the system file cache.
2. From the system file cache to the filesystem.
3. From an application to the filesystem (bypassing the system file cache).

By default, the CBFilter and CBMonitor classs only track file read/write requests on paths (2) and (3); such operations are referred to as non-cached requests (or, non-cached operations). To include requests on path (1) (referred to as cached requests/operations), the ProcessCachedIORequests property must be enabled. This property is disabled by default, as there is no need to intercept cached requests in most cases.

To distinguish between cached and non-cached file read/write requests, applications can check the Direction parameter provided in the following events:

• BeforeReadFile
• BeforeWriteFile
• AfterReadFile
• AfterWriteFile
• NotifyReadFile
• NotifyWriteFile

(Note: All API members discussed in this topic are available in both CBFilter and CBMonitor, except for the Control Events, which are only available in CBFilter.)