Submit a ticketCall us

Looking to compare latest NPM features with previous versions of NPM?
The NPM new feature summary offers a comparison of new features and improvements offered with this release.

 

Home > Success Center > Log & Event Manager (LEM) > Opening a File with Notepad using Windows Explorer does not log the File Read action

Opening a File with Notepad using Windows Explorer does not log the File Read action

Table of contents
No headers
Created by Interspire Import, last modified by MindTouch on Jun 23, 2016

Views: 3 Votes: 0 Revisions: 8


This happens because the file has already been read into the system cache and notepad uses memory mapped IO to access files. Because the data is already in the system cache there will not be any reads on the file from notepad or the system and you won't see the IO requests as you would expect. If you use another editor such as WordPad or WinWord which does not use memory mapped IO, you will see IOs as expected.
 
Note:  Windows maintains the data in the system cache until it is forced to release the section due to memory pressures or other triggers like a reboot. To see File Read events reboot the system and navigate to Explorer to open the file again. Even still, it may not be notepad that the read is issued under, Explorer does attempt to read content to display icons, etc, which will force the data to be in the system cache leading back to the above case.

Last modified
20:18, 22 Jun 2016

Tags

Classifications

Public