FileIo_Info class
This class is the event type class for file information event.
The following syntax is simplified from MOF code.
[EventType{69, 70, 71, 74, 75}, EventTypeName{"SetInfo", "Delete", "Rename", "QueryInfo", "FSControl"}]
class FileIo_Info : FileIo
{
uint32 IrpPtr;
uint32 TTID;
uint32 FileObject;
uint32 FileKey;
uint32 ExtraInfo;
uint32 InfoClass;
};
The FileIo_Info class has these types of members:
The FileIo_Info class has these properties.
-
ExtraInfo
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(5), Pointer
For FileDispositionInformation requests, this field contains the requested disposition. For FileEndOfFileInformation and FileAllocationInformation requests, this field contains the specified file size.
-
-
FileKey
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(4), Pointer
To determine the file name, match the value of this property to the FileObject property of a FileIo_Name event.
-
-
FileObject
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(3), Pointer
Identifier that can be used for correlating operations to the same opened file object instance between file create and close events.
-
-
InfoClass
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(6)
Requested file information class.
-
-
IrpPtr
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(1), Pointer
IO request packet. This property identifies the IO activity.
-
-
TTID
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(2), Pointer
Thread identifier of the thread that is performing the operation.
-
Set information and query information events indicate that the file attributes were set or queried. A file system control (FSControl) event is recorded when a FSCTL command is issued.
Requirement | Value |
---|---|
Minimum supported client |
Windows Vista [desktop apps only] |
Minimum supported server |
Windows Server 2008 [desktop apps only] |