跨平台文件访问跟踪
我希望能够跟踪特定程序调用的文件读/写。 不需要有关实际事务的信息，只需要涉及的文件名。
有没有跨平台的解决方案？
各种平台特定的方法有哪些？
在 Linux 上我知道有 strace/ptrace （如果有更快的方法那就太好了）。
我认为在 macOS 上有 ktrace。
那么 Windows 呢？
另外，如果能够阻止（拖延）文件访问直到稍后的时间，那就太棒了。
谢谢！
I'd like to be able to track file read/writes of specific program invocations. No information about the actual transactions is required, just the file names involved.
Is there a cross platform solution to this?
What are various platform specific methods?
On Linux I know there's strace/ptrace (if there are faster methods that'd be good too).
I think on mac os there's ktrace.
What about Windows?
Also, it would be amazing if it would be possible to block (stall out) file accesses until some later time.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
只要你的程序启动了你想要监视的进程，你就可以编写一个调试器，然后每次进程启动或退出时你都会收到通知。 当进程启动时，您可以注入一个 DLL 来挂钩每个进程的 CreateFile 系统调用。 然后，挂钩可以使用管道或套接字向调试器报告文件活动。
As long as your program launches the processes you want to monitor, you can write a debugger and then you'll be notified every time a process starts or exits. When a process starts, you can inject a DLL to hook the CreateFile system calls for each individual process. The hook can then use a pipe or a socket to report file activity to the debugger.
最简洁的答案是不。 有很多特定于平台的解决方案，它们可能都具有相似的接口，但它们本质上不是跨平台的，因为文件系统往往是特定于平台的。
同样，这取决于平台:) 对于 Windows，如果您想跟踪飞行中的读/写，您可能必须使用 IFS。 如果您只想收到更改通知，可以使用 ReadDirectoryChangesW 或 NTFS 更改日志。
我建议使用 NTFS 更改日志，因为它往往更可靠。
The short answer is no. There are plenty of platform specific solutions which all probably have similar interfaces, but they aren't inherently cross platform since file systems tend to be platform specific.
Again, it will depend on the platform :) For Windows, if you want to track reads/writes in flight, you might have to go with IFS. If you just want to get notified of changes, you can use
ReadDirectoryChangesWor the NTFS change journal.I'd recommend using the NTFS change journal only because it tends to be more reliable.
在 Windows 上，您可以使用命令行工具 Handle 或 GUI 版本 Process Explorer查看给定进程打开了哪些文件。
如果您正在寻找在自己的程序中获取此信息，您可以使用 IFS 工具包，来自 Microsoft，用于编写文件系统过滤器。 文件系统过滤器将显示所有进程的所有文件系统操作。 文件系统过滤器在 AV 软件中用于在文件打开之前对其进行扫描或扫描新创建的文件。
On Windows you can use the command line tool Handle or the GUI version Process Explorer to see which files a given process has open.
If you're looking for a get this information in your own program you can use the IFS kit from Microsoft to write a file system filter. The file system filter will show all file system operation for all process. File system filters are used in AV software to scan files before they are open or to scan newly created files.