FileIo_SimpleOp class

This class is the event type class for simple file operation events.

The following syntax is simplified from MOF code.

Syntax

[EventType{65, 66, 73}, EventTypeName{"Cleanup", "Close", "Flush"}]
class FileIo_SimpleOp : FileIo
{
  uint32 IrpPtr;
  uint32 TTID;
  uint32 FileObject;
  uint32 FileKey;
};

Members

The FileIo_SimpleOp class has these types of members:

• Properties

Properties

The FileIo_SimpleOp class has these properties.

FileKey

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(4), Pointer

To determine the file name, match the value of this property to the FileObject property of a FileIo_Name event.

FileObject

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(3), Pointer

Identifier that can be used for correlating operations to the same opened file object instance between file create and close events.

IrpPtr

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(1), Pointer

IO request packet. This property identifies the IO activity.

TTID

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(2), Pointer

Thread identifier of the thread that is performing the operation.

Remarks

The Cleanup event is logged when the last handle to the file is closed. The Close event specifies that a file object is being freed. The Flush event specifies when the file buffers are fully flushed to disk.

Requirements

See also

FileIo