on_after_write_file Event
Fires after data is written to a file.
Syntax
class CBFilterAfterWriteFileEventParams(object): @property def file_name() -> str: ... @property def position() -> int: ... @property def buffer() -> c_void_p: ... @property def buffer_length() -> int: ... @property def bytes_to_write() -> int: ... @property def direction() -> int: ... @property def bytes_written() -> int: ... @bytes_written.setter def bytes_written(value) -> None: ... @property def status() -> int: ... @status.setter def status(value) -> None: ... @property def file_context() -> int: ... @file_context.setter def file_context(value) -> None: ... @property def handle_context() -> int: ... @handle_context.setter def handle_context(value) -> None: ... @property def result_code() -> int: ... @result_code.setter def result_code(value) -> None: ... # In class CBFilter: @property def on_after_write_file() -> Callable[[CBFilterAfterWriteFileEventParams], None]: ... @on_after_write_file.setter def on_after_write_file(event_hook: Callable[[CBFilterAfterWriteFileEventParams], None]) -> None: ...
Remarks
This event fires after data is written to the file specified by FileName.
Applications may use this event to inspect the data that was written to the file, but must not attempt to alter said data. If, during on_before_write_file, an application causes less data than was requested to be written to the file, it should use this event to set BytesWritten back to the expected value (i.e., BytesToWrite) in order to prevent the requestor from behaving unexpectedly.
Applications only need to handle this event if they've added a standard filter rule that includes the FS_CE_AFTER_WRITE flag.
The Position parameter reflects the byte offset in the file at which writing started. A value of -1 means "append to the end of the file".
The Buffer parameter points to a memory buffer that contains the data that, if the request was successful, was written to the file. The BufferLength parameter reflects the capacity of Buffer, in bytes. Please refer to the Buffer Parameters topic for more information on how to work with memory buffer event parameters.
The BytesToWrite parameter reflects how many bytes were to be written to the file (i.e., how many bytes the requestor expects will be written).
The Direction parameter indicates the request direction; please refer to the Cached and Non-Cached Requests topic for more information. Possible values are:
| FS_REQUEST_DIR_USER_NONCACHED | 0 | Operations performed in the 'user mode application <--> filesystem' direction. |
| FS_REQUEST_DIR_USER_CACHED | 1 | Operations performed in the 'user mode application <--> system cache' direction. |
| FS_REQUEST_DIR_SYSTEM_NONCACHED | 2 | Operations performed in the 'system cache <--> filesystem' direction. |
| FS_REQUEST_DIR_SYSTEM_CACHED | 3 | Operations performed in the 'system component <--> system cache' direction. |
The BytesWritten parameter specifies how many bytes were actually written to the file. This parameter's value must not exceed BufferLength (and should not exceed BytesToWrite; please refer to on_before_write_file for more information).
The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method. Please note that this event won't fire for failed requests unless the process_failed_requests property is enabled. Applications may change this parameter's value if they want a different NT status code to be returned.
The FileContext and HandleContext parameters are placeholders for application-defined data associated with the file and specific handle, respectively. Please refer to the Contexts topic for more information. (If the system's cache manager or memory manager initiated the operation, HandleContext may be absent, in which case it will be None.)
The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource isn't available, security checks failed, etc.), set it to a non-zero value to report an appropriate error. Please refer to the Error Reporting and Handling topic for more information.
This event is fired synchronously; please refer to the Event Types topic for more information.