Question

I thought this could’ve been a common question, but it has been very difficult to find an answer. I’ve tried searching here and other forums with no luck.

I’m writing a C# (.net version 4) program to monitor a process. It already raises an event when the process starts and when it stops, but I also need to check where is this process reading from and writing to; specially writing to since I know this process writes a large amount of data every time it runs. We process batches of data, and the path where the process writes to contains the Batch ID, which is an important piece of information to log the results of the process.

I’ve looked into the System.Diagnostics.Process.BeginOutputReadLine method, but since the documentation says that StandardOutput must be redirected, I’m not sure if this can be done on a process that is currently running, or if it affects the write operation originally intended by the process.

It is a console application in C#. If anyone have any idea on how to do this, it would be much appreciated.

Thanks in advance!

Answer 1

Output redirection would only help you solve the problem of intercepting the process’ standard output stream. This would have no effect on read/write operations to other files or streams that the program would use.

The easiest way to do this would be to avoid reverse engineering this information and exert some control over where the process writes its data (e.g. pass a command line parameter to it to specify the output path and you can monitor that output path yourself).

If that is impossible for some reason, you can look into these approaches, all of which are quite advanced and have various drawbacks:

• Use Detours to launch the process and redirect calls to CreateFile to a function that you define (e.g. you could call into some other function to track the file name that it used and then call the real CreateFile). Note that a license to use Detours costs money and it requires you to build an an unmanaged DLL to define your replacement function.
• Read the data from the Microsoft-Windows-Kernel-File event tracing provider. This provider tracks all file operations for everything on the system. Using this data requires advanced knowledge of ETW and a lot of P/Invoke calls if you are trying to consume it from C#.
• Enumerate the open handles of the process once it is started. A previous stackoverflow.com question has several possible solutions. Note that this is not foolproof as it only gives you a snapshot of the activity at a point in time (e.g. the process may open and close handles too quickly for you to observe it between calls to enumerate them) and most of those answers require calling into undocumented functions.