FileIo_ReadWrite class

This class is the event type class for file read and write events.

The following syntax is simplified from MOF code.

Syntax

[EventType{67, 68}, EventTypeName{"Read", "Write"}]
class FileIo_ReadWrite : FileIo
{
  uint64 Offset;
  uint32 IrpPtr;
  uint32 TTID;
  uint32 FileObject;
  uint32 FileKey;
  uint32 IoSize;
  uint32 IoFlags;
};

Members

The FileIo_ReadWrite class has these types of members:

• Properties

Properties

The FileIo_ReadWrite class has these properties.

FileKey

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(5), Pointer

To determine the file name, match the value of this property to the FileObject property of a FileIo_Name event.

FileObject

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(4), Pointer

Identifier that can be used for correlating operations to the same opened file object instance between file create and close events.

IoFlags

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(7)

IO request packet flags specified for this operation.

IoSize

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(6)

Number of bytes requested.

IrpPtr

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(2), Pointer

IO request packet. This property identifies the IO activity.

Offset

Data type: uint64

Access type: Read-only

Qualifiers: WmiDataId(1)

Starting file offset for the requested operation.

TTID

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(3), Pointer

Thread identifier of the thread that is performing the operation.

Requirements

See also

FileIo