Edit

FileIo_SimpleOp class

  • Article

This class is the event type class for simple file operation events.

The following syntax is simplified from MOF code.

Syntax

[EventType{65, 66, 73}, EventTypeName{"Cleanup", "Close", "Flush"}]
class FileIo_SimpleOp : FileIo
{
  uint32 IrpPtr;
  uint32 TTID;
  uint32 FileObject;
  uint32 FileKey;
};

Members

The FileIo_SimpleOp class has these types of members:

Properties

The FileIo_SimpleOp class has these properties.

FileKey

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(4), Pointer

To determine the file name, match the value of this property to the FileObject property of a FileIo_Name event.

FileObject

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(3), Pointer

Identifier that can be used for correlating operations to the same opened file object instance between file create and close events.

IrpPtr

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(1), Pointer

IO request packet. This property identifies the IO activity.

TTID

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(2), Pointer

Thread identifier of the thread that is performing the operation.

Remarks

The Cleanup event is logged when the last handle to the file is closed. The Close event specifies that a file object is being freed. The Flush event specifies when the file buffers are fully flushed to disk.

Requirements

Requirement Value
Minimum supported client
 Windows Vista [desktop apps only]
Minimum supported server
 Windows Server 2008 [desktop apps only]

See also

FileIo