Submit a ticketCall us

Systems Monitoring for Dummies
Our new eBook will teach you the fundamentals and help you create monitors and alerts that are effective, meaningful, and actionable. Monitoring is more than a checkbox on your to-do list. This free eBook will give you practical advice to help you succeed in all aspects of monitoring – discovery, alerting, remediation, and troubleshooting. Don’t miss out on this indispensable resource for newbies, experienced IT pros, and everyone in between. Register Now.

Home > Success Center > Log & Event Manager (LEM) > Opening a File with Notepad using Windows Explorer does not log the File Read action

Opening a File with Notepad using Windows Explorer does not log the File Read action

Table of contents
No headers
Created by Interspire Import, last modified by MindTouch on Jun 23, 2016

Views: 19 Votes: 0 Revisions: 8


This happens because the file has already been read into the system cache and notepad uses memory mapped IO to access files. Because the data is already in the system cache there will not be any reads on the file from notepad or the system and you won't see the IO requests as you would expect. If you use another editor such as WordPad or WinWord which does not use memory mapped IO, you will see IOs as expected.
 
Note:  Windows maintains the data in the system cache until it is forced to release the section due to memory pressures or other triggers like a reboot. To see File Read events reboot the system and navigate to Explorer to open the file again. Even still, it may not be notepad that the read is issued under, Explorer does attempt to read content to display icons, etc, which will force the data to be in the system cache leading back to the above case.

Last modified

Tags

Classifications

Public