Hi, We're developing a utility that monitors log files as they are updated, using the SystemFileWatcher to catch changes. Everything works fine on 2003, but I've noticed on 2008 R2 that although the files are being updated, the file properties are not - or at least not reliably, which means that the SystemFileWatcher events never get fired. On 2003, opening the log file folder in explorer, you can see the timestamp and files size change before your eyes each time the log is updated. On 2008, most of the time, there is no change unless you interect in some other way - F5 sometimes helps, but not always (I've seen this update the filesize but not the timestamp). Opening the log file in notepad will cause the watcher event to fire, and will also show the file contents are correct, but still the timestamp can remain stuck in the past. I should point out the log files are kept open during the update, rather than an open-write-close operation. Once the file is finally closed then the timestamp is updated. Is this a "by design" change in 2008? I'm assuming it's down to caching somehow. Is there any way around it, or some other way of reliably obtaining file update notifications in 2008? Cheers

Hi Anthughes, Yes, some of these attributes have been disabled in 2008. If you want for example want to see/use “Last Accessed” time you need to enable the tracking of this attribute. You can enable this by setting HKLM\System\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 0 (this value is REG_DWORD). Please beware that his could impact disk IO performance on busy file servers ! Raymond

HI Raymond Thanks for the tip - The docs for the Last Access tweak imply this is only updated when the file is opened, not each time it is written to - looking in the registry around it I can's see anything that is specific to file writes... is there anything else that controls this behavious? Cheers Ant

Hi AntHughes , Thanks for posting here. After reading your post ,I understand that you had developed a program which get last modify time from event log. it works fine on windows server 2003 but windows server 2008. If I misunderstand please let me know. I studied the introduction of FileSystemWatcher Class, and seems that it is supported in window server 2008. http://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher.aspx Tiger Li Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I thought i read/heard that 2008/Win7 have last access disabled by default? I can't seem to find a reference. Anyway you can check the setting and make sure it is configure appropriately fsutil behavior query disablelastaccess fsutil behavior set disablelastaccess 1|0 1 = disabled, 0 = enabled Restart to take effect

Hi Tiger I was posting here because the issue seems to be in the behaviour of Server 2008 - in that it does not generate the events (update of file modifed timestamp when an open file is written to) that the FileSystemWatcher is monitoring for. When the file is closed, the stamp is updated and FSW sees the change. To me this sounds like a server issue not a FSW issue (also because the effect is visible through the Explorer UI, with FSW completely out of the equation). Also changing the state of DisableLastAccess has no effect on this issue, but in any case I am interested in writes only, not opens/reads. Regards Ant

Hi AntHughes I reproduced the issue on an r2 machine with a small application written by a co-worker. The app subscribes for notification of all possible file watcher events and also uses a 256 KB capture buffer to reduce the possibility of buffer overflows. Does it repro when using a 2008 R2 machine watching a UNC path to a 2003 machine? Does it repro when using a 2003 machine to watch a UNC path to a 2008 R2 machine? BTW - I'm leaving for vacation so I'll try to get my back-up to pick up with the answers to your questions:) Thanks, Ron Stock [MSFT] Microsoft Online Community Support Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”

Ron,. We are experiencing a very similar issue. Was there ever an ultimate resolution to this problem?

Hello, We too are having the same issue. Has anyone found a fix for this problem?

Hi Ron Is there a solution on this problem? Will there be one? When?

Hi Ron Is there a solution on this problem? Will there be one? When?

We are experiencing the exact same issue in a shop I am dealing with. This problem is *NOT* a problem with the FSW, it is (as mentioned) the OS - it simply stops updating a file timestamp while the file is open. This is a pretty big issue, as sometimes log files are kept open for a long time - for example, during a database data move, you might record bulk statistics in the log, updating the log every 10 seconds. It doesn't make sense to close and reopen the file for the whole data move, so you keep it open until the move is done, writing updates to it as you go. As it sits, this example log is NOT updated when data is written to the log, but when the log is closed. As this behaviour is different than Server 2003 (and all other servers as far as I know), I'd have to assume that we have a bug. So the log gets written every 10 seconds (as per our example). If you open the log file, it has the right data in it. It's just that the timestamp is not updated until the file is closed. Are there any updates on this issue??

Yes we are also still missing a update on this :(

This "Community Support" thing isn't really all that great when problems get ignored for SEVERAL MONTHS. I have been through this a number of times with Microsoft in the past year or so. The last problem I had was a lack of communication to MAPS (Action Pack) subscribers regarding Business Contract manager for Office 2010. It took 6 full months to resolve that. Unfortunately I have clients waiting for an answer to this question, and there is just nowhere to turn for help, except here. What should I do, recommend the client move back to Linux??? That has been mentioned to me a number of times. If you want the community support model to work, then SUPPORT THE COMMUNITY.

Have you read the blog post below? I think M$ has noticed this issue: File“Date modified”property are not updating while modifying a file without closing it. http://blogs.technet.com/b/asiasupp/archive/2010/12/14/file-date-modified-property-are-not-updating-while-modifying-a-file-without-closing-it.aspx Yin