Question

we are currently in the process of moving a coldfusion web site from server to server.
In order to do that, we’d like to do some cleanup at the file system level. As ColdFusion is using includes, it makes pretty hard to figure out which files are really used.

One of the solution I found was to use Procmon from Sysinternals. With the right filter in place, it provides the correct information. However, I’m a bit worried about the number of events that will recorded.

On the other hand, the .NET FileSystemWatcher class looks promising, but does not handle the access event.

Finally, using the Audit feature of the file system seems interesting but does not allow to filter by process. Therefore, the log might get rotated because of too many events polluting the event logs.

Does anyone know any .NET class that could be used to mimic procmon?

Answer 1

FileSystemWatcher relies on operating system features to provide events when files are changed. There is no such built in feature to notify of every access to a file. ProcMon handles that through a custom file system filter driver that handles the notification. It is not possible to write such a function entirely in C# as it requires some kernel level code running in a driver.

Unless this is a problem large enough to justify a large investment I would recommend using ProcMon anyways, spending time setting up the right filters.