Using python 2.7 on windows 7 64 bit machine.
How to get a file close event:
- when file is opened in a new process of file opener (like notepad, wordpad which opens file everytime in new process of wordpad)
- when file is opened in a tab of file opener (like notepad++, which opens all files in new tab but there exist only a single process of notepad++ running)
So, how to get file close event in above cases? Is it possible to achieve above cases through a common code? I am dealing with different file types
You can use Pyfanotyfi or butter.
I think you'll find this link very usefull: Linux file system events with C, Python and Ruby
There you will find an example about doing exactly what you want(using pyinotify) this is the code:
The problem you are facing is not with Python, but with Windows. It can be done, but you will have to write some non-trival C/C++ code for it.
A file open or a file close user mode notification does not exist in userland on Windows. That's why the libraries suggested by others do not have file close notification. In Windows, the API to detect changes in userland is ReadDirectoryChangesW. It will alert you of one of the following notifications :
FILE_ACTION_ADDED
if a file was added to the directory.FILE_ACTION_REMOVED
if a file was removed from the directory.FILE_ACTION_MODIFIED
if a file was modified. This can be a change in the time stamp or attributes.FILE_ACTION_RENAMED_OLD_NAME
if a file was renamed and this is the old name.FILE_ACTION_RENAMED_NEW_NAME
if a file was renamed and this is the new name.No amount of Python can change what Windows provides you with.
To get a file close notification, tools like Process Monitor install a Minifilter that lives in the kernel, near the top of other filters like EFS.
To acheive what you want, you would need to:
user
program to make it a Python extension (minispy.pyd
) that exposes a generator that produces the events. This is the hard part, I will get back to that.The whole thing looks something like this :
Of course you can have EFS over NTFS, this is just to show that your minifilter would be above all that.
The hard parts :
The last two are the hardest.
I have not found a package that captures
open
andclose
events on Windows. As others have mentioned, pyinotify, is an excellent option for Linux based operating systems.Since I wasn't able to watch for the closed event, I settled for the modified event. It's very much an 'after the fact' type of solution (ie. I can't pause until I see a file is closed). But, this has worked surprisingly well.
I've used the watchdog package. The code below is from their sample implementation and watches the current directory if you don't pass a path on the command line, otherwise it watches the path you pass.
Example call:
python test.py
orpython test.py C:\Users\Administrator\Desktop
This code will show you when files are created, modified, deleted or renamed/moved. You can filter by just modified by watching for the
on_modified
event.This has proven to be a very easy task for *nix systems, but on Windows, getting a file close event is not a simple task. Read below the summary of common methods grouped by OS'es.
For Linux
On Linux, the filesystem changes can be easily monitored, and in great detail. The best tool for this is the kernel feature called
inotify
, and there is a Python implementation that uses it, called Pynotify.Pynotify
Pyinotify
is a Python module for monitoring filesystems changes. Pyinotify relies on a Linux Kernel feature (merged in kernel 2.6.13) calledinotify
, which is an event-driven notifier. Its notifications are exported from kernel space to user space through three system calls.Pyinotify
binds these system calls and provides an implementation on top of them offering a generic and abstract way to manipulate those functionalities.Here you can find the list of the events that can be monitored with
Pynotify
.Example usage:
import pyinotify
For Windows
Situation for Windows is quite a bit more complex than for Linux. Most libraries rely on
ReadDirectoryChanges
API which is restricted and can't detect finer details like file close event. There are however other methods for detecting such events, so read on to find out more.Watcher
Note: Watcher has been last updated in February 2011, so its probably safe to skip this one.
Watcher
is a low-levelC
extension for receiving file system updates using theReadDirectoryChangesW
API on Windows systems. The package also includes a high-level interface to emulate most of the .NETFileSystemWatcher
API.The closest one can get to detecting file close events with Watcher is to monitor the
FILE_NOTIFY_CHANGE_LAST_WRITE
and/orFILE_NOTIFY_CHANGE_LAST_ACCESS
events.Example usage:
Watchdog
Python API and shell utilities to monitor file system events. Easy install:
$ pip install watchdog
. For more info visit the documentation.Watchdog on Windows relies on the
ReadDirectoryChangesW
API, which brings its caveats as with Watcher and other libraries relying on the same API.Pywatch
A python near-clone of the Linux
watch
command. Thepywatch.watcher.Watcher
class can be told to watch a set of files, and given a set of commands to run whenever any of those files change. It can only monitor the file changed event, since it relies on polling the stat's st_mtime.Bonus for Windows with NTFS:
NTFS USN Journal
The NTFS USN (Update Sequence Number) Journal is a feature of NTFS which maintains a record of changes made to the volume. The reason it is listed as a Bonus is because unlike the other entries, it is not a specific library, but rather a feature existing on NTFS system. So if you are using other Windows filesystems (like FAT, ReFS, etc..) this does not apply.
The way it works it that the system records all changes made to the volume in the USN Journal file, with each volume having its own instance. Each record in the Change Journal contains the USN, the name of the file, and information about what the change was.
The main reason this method is interesting for this question is that, unlike most of the other methods, this one provides a way to detect a file close event, defined as USN_REASON_CLOSE. More information with a complete list of events can be found in this MSDN article. For a complete documentation about USN Journaling, visit this MSDN page.
There are multiple ways to access the USN Journal from Python, but the only mature option seems to be the ntfsjournal module.
The "proper" way for Windows:
File system filter driver
As descibed on the MSDN page:
It is not an easy task to implement a file system filter driver, but for someone who would like to give it a try, there is a good introduction tutorial on CodeProject.
P.S. Check @ixe013's answer for some additional info about this method.
Multiplatform
Qt's QFileSystemWatcher
The
QFileSystemWatcher
class provides an interface for monitoring files and directories for modifications. This class was introduced inQt 4.2
.Unfortunately, its functionality is fairly limited, as it can only detect when a file has been modified, renamed or deleted, and when a new file was added to a directory.
Example usage: