FileIo class
This class is the parent class for file I/O events.
The following syntax is simplified from MOF code.
Syntax
[Guid("{90cbdc39-4a3e-11d1-84f4-0000f80464e3}"), EventVersion(2)]
class FileIo : MSNT_SystemTrace
{
};
Members
The FileIo class does not define any members.
Remarks
To enable the File IO events in an NT Kernel logging session, specify the EVENT_TRACE_FLAG_DISK_FILE_IO flag in the EnableFlags member of an EVENT_TRACE_PROPERTIES structure when calling the StartTrace function. You can also specify one or more of the following flags:
- EVENT_TRACE_FLAG_FILE_IO
- EVENT_TRACE_FLAG_FILE_IO_INIT
Event trace consumers can implement special processing for file I/O events by calling the SetTraceCallback function and specifying FileIoGuid as the pGuid parameter. Use the following event types to identify the actual event when consuming events.
| Event type | Description |
|---|---|
| Event type value is 0 | File name event. The FileIo_Name MOF class defines the event data for this event. |
| Event type value is 32 | File create event. The FileIo_Name MOF class defines the event data for this event. |
| Event type value is 35 | File delete event. The FileIo_Name MOF class defines the event data for this event. |
| Event type value is 36 | File rundown event. Enumerates all open files on the computer at the end of the trace session. The FileIo_Name MOF class defines the event data for this event. |
| Event type value is 64 | File create event. The FileIo_Create MOF class defines the event data for this event. |
| Event type value is 72 | Directory enumeration event. The FileIo_DirEnum MOF class defines the event data for this event. |
| Event type value is 77 | Directory notification event. The FileIo_DirEnum MOF class defines the event data for this event. |
| Event type value is 69 | Set information event. The FileIo_Info MOF class defines the event data for this event. |
| Event type value is 70 | Delete file event. The FileIo_Info MOF class defines the event data for this event. |
| Event type value is 71 | Rename file event. The FileIo_Info MOF class defines the event data for this event. |
| Event type value is 74 | Query file information event. The FileIo_Info MOF class defines the event data for this event. |
| Event type value is 75 | File system control event. The FileIo_Info MOF class defines the event data for this event. |
| Event type value is 76 | End of operation event. The FileIo_OpEnd MOF class defines the event data for this event. |
| Event type value is 67 | File read event. The FileIo_ReadWrite MOF class defines the event data for this event. |
| Event type value is 68 | File write event. The FileIo_ReadWrite MOF class defines the event data for this event. |
| Event type value is 65 | Clean up event. The event is generated when the last handle to the file is released. The FileIo_SimpleOp MOF class defines the event data for this event. |
| Event type value is 66 | Close event. The event is generated when the file object is freed. The FileIo_SimpleOp MOF class defines the event data for this event. |
| Event type value is 73 | Flush event. This event is generated when the file buffers are fully flushed to disk. The FileIo_SimpleOp MOF class defines the event data for this event. |
File IO events are logged at the beginning of the operation.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client |
Windows Vista [desktop apps only] |
| Minimum supported server |
Windows Server 2008 [desktop apps only] |
See also