Submit a ticketCall us

Announcing NCM 7.7
With NCM 7.7, you can examine the rules that make up an access control list for a Cisco ASA device. Then you can apply filters to display only rules that meet the specified criteria, order the rules by line number or by the hit count, and much more.
See new features and improvements.

Home > Success Center > Log & Event Manager (LEM) > Opening a File with Notepad using Windows Explorer does not log the File Read action

Opening a File with Notepad using Windows Explorer does not log the File Read action

Table of contents
No headers
Created by Interspire Import, last modified by MindTouch on Jun 23, 2016

Views: 17 Votes: 0 Revisions: 8


This happens because the file has already been read into the system cache and notepad uses memory mapped IO to access files. Because the data is already in the system cache there will not be any reads on the file from notepad or the system and you won't see the IO requests as you would expect. If you use another editor such as WordPad or WinWord which does not use memory mapped IO, you will see IOs as expected.
 
Note:  Windows maintains the data in the system cache until it is forced to release the section due to memory pressures or other triggers like a reboot. To see File Read events reboot the system and navigate to Explorer to open the file again. Even still, it may not be notepad that the read is issued under, Explorer does attempt to read content to display icons, etc, which will force the data to be in the system cache leading back to the above case.

Last modified
20:18, 22 Jun 2016

Tags

Classifications

Public