Audit.FileSystem 27.0.3

There is a newer version of this package available.
See the version list below for details.
dotnet add package Audit.FileSystem --version 27.0.3                
NuGet\Install-Package Audit.FileSystem -Version 27.0.3                
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="Audit.FileSystem" Version="27.0.3" />                
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add Audit.FileSystem --version 27.0.3                
#r "nuget: Audit.FileSystem, 27.0.3"                
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install Audit.FileSystem as a Cake Addin
#addin nuget:?package=Audit.FileSystem&version=27.0.3

// Install Audit.FileSystem as a Cake Tool
#tool nuget:?package=Audit.FileSystem&version=27.0.3                

Audit.FileSystem

File System Extension for Audit.NET library.

Generate Audit Logs by intercepting file system events via FileSystemWatcher.

Audit.FileSystem provides the infrastructure to create audit logs from the file system events, like creating, renaming, modifying or deleting files and directories. It relies on FileSystemWatcher class to intercept the events, so the same limitations applies.

Install

NuGet Package

To install the package run the following command on the Package Manager Console:

PM> Install-Package Audit.FileSystem

NuGet Status NuGet Count

Usage

To enable the audit log for a directory, create an instance of FileSystemMonitor clas, and call its Start() method:

var fsMon = new Audit.FileSystem.FileSystemMonitor(@"c:\");
fsMon.Options.IncludeSubdirectories = true;
fsMon.Start();

Or by using the FileSystemMonitorOptions to provide the configuration:

var fsMon = new Audit.FileSystem.FileSystemMonitor(new FileSystemMonitorOptions()
{
    Path = @"c:\",
    IncludeSubdirectories = true,
    Filter = "*.txt",
    IncludeContentPredicate = fi => fi.Length <= 1024 ? FileSystem.ContentType.Text : FileSystem.ContentType.None,
    CustomFilterPredicate = e => !e.FullPath.StartsWith("$RECYCLE.BIN")                    
});

Configuration

Output

The audit events are stored using a Data Provider. You can use one of the available data providers or implement your own. Please refer to the data providers section on Audit.NET documentation.

Settings

The FileSystemMonitorOptions class include the following settings:

Mandatory:

  • Path: The path of the directory to monitor.

Optional:

  • EventTypeName: A string that identifies the event type. Default is "[{type}] {name}". Can contain the following placeholders:
    • {type}: replaced with the event type (Change, Rename, Create or Delete)
    • {name}: replaced with the file/directory name
    • {path}: replaced with the full file/directory path
  • IncludeSubdirectories: To indicate if the subdirectories of the provided Path should be monitored. Default is false.
  • IncludedEventTypes: A list indicating the event types (Change, Rename, Create or Delete) that should be included on the audit. Default is NULL meaning all the event types will be logged.
  • Filter: The filter string used to determine what files are monitored. Default is "*.*"
  • CustomFilterPredicate: Allows to filter events with a custom function that given a file event, returns true if the entry should be logged and false otherwise. Default includes all the files satisfying the provided Filter string.
  • IncludeContentPredicate: Allows to determine if the file contents should be included in the log with a custom function that given a file event, returns a ContentType indicating whether the contents should be included as a string (Text), as a byte array (Binary) or not included (None). By default content is not included.
  • NotifyFilters: The notify filters. Default is DirectoryName | FileName | LastAccess | LastWrite.
  • IgnoreMD5: To indicate if the MD5 computation should be ignored. By default the MD5 hash of the file is included on the log.
  • InternalBufferSize: Gets or sets the size (in bytes) of the internal buffer.
  • AuditDataProvider: To indicate the Audit Data Provider to use. Default is NULL to use the globally configured data provider.
  • CreationPolicy: To indicate the event creation policy to use. Default is NULL to use the globally configured creation policy.
  • AuditScopeFactory: Allows to set a specific audit scope factory. By default the globally configured AuditScopeFactory is used.

Output

Audit.FileSystem output includes:

  • Execution time.
  • Environment information.
  • File/Directory name, attributes and properties
  • File MD5 hash (optional)
  • File contents (optional)

Output Details

The following table describes the Audit.FileSystem output fields:

FileSystemEvent

Describes an event from the file system.

Field Name Type Description
Object FileSystemObjectType Indicates the object type: File, Directory or Unknown
Event FileSystemEventType The file system event type: Create, change, Rename or Delete
Errors string Any error encountered when processing the file/directory
Attributes string The file/directory attributes
Name string The file/directory name
OldName string In case of rename, the old file/directory name
Extension string The file extension including the point
FullPath string The full path to the file/directory
Length long The file length in bytes
CreationTime datetime The file/directory creation date and time
LastAccessTime datetime The file/directory last access date and time
LastWriteTime datetime The file/directory last write date and time
ReadOnly boolean Value indicating if the file is read only
MD5 boolean The MD5 hash of the file
FileContent FileContent The file contents when included

FileContent

Represents the contents of an audited file.

Field Name Type Description
Type ContentType The content type: Text or Binary
Value string/byte array The string (text) or byte array (binary) with the file contents

Output Sample

File creation:

{
  "EventType": "[Created] file.txt",
  "Environment": {
    "UserName": "Federico",
    "MachineName": "HP",
    "DomainName": "HP",
    "Culture": "en-US"
  },
  "StartDate": "2017-11-26T23:01:44.5567169-06:00",
  "EndDate": "2017-11-26T23:01:44.5567169-06:00",
  "Duration": 0,
  "FileSystemEvent": {
    "Object": "File",
    "Event": "Create",
    "Attributes": "Archive",
    "Name": "file.txt",
    "Extension": ".txt",
    "FullPath": "c:\\Users\\Federico\\Documents\\file.txt",
    "Length": 694,
    "CreationTime": "2017-11-26T23:01:11.750589-06:00",
    "LastAccessTime": "2017-11-26T23:01:11.750589-06:00",
    "LastWriteTime": "2017-11-26T23:01:11.7515849-06:00",
    "MD5": "ddc032e5fe9bb3aa15144cdc35d959c5"
  }
}

File renaming

{
  "EventType": "[Renamed] renamed.txt",
  "Environment": {
    "UserName": "Federico",
    "MachineName": "HP",
    "DomainName": "HP",
    "Culture": "en-US"
  },
  "StartDate": "2017-11-26T23:01:37.8409103-06:00",
  "EndDate": "2017-11-26T23:01:37.8409103-06:00",
  "Duration": 0,
  "FileSystemEvent": {
    "Object": "File",
    "Event": "Rename",
    "OldName": "file.txt",
    "Name": "renamed.txt",
    "Extension": ".txt",
    "FullPath": "c:\\Users\\Federico\\Documents\\renamed.txt"
  }
}

IO Exception:

{
  "EventType": "[Created] tmpFC2D.tmp",
  "Environment": {
    "UserName": "Federico",
    "MachineName": "HP",
    "DomainName": "HP",
    "Culture": "en-US"
  },
  "StartDate": "2017-11-26T23:01:03.7363727-06:00",
  "EndDate": "2017-11-26T23:01:03.7363727-06:00",
  "Duration": 0,
  "FileSystemEvent": {
    "Object": "File",
    "Event": "Create",
    "Errors": [
      "IOException when getting file attributes: Could not find file 'c:\\Users\\Federico\\AppData\\Local\\Temp\\tmpFC2D.tmp'."
    ],
    "Name": "tmpFC2D.tmp",
    "Extension": ".tmp",
    "FullPath": "c:\\Users\\Federico\\AppData\\Local\\Temp\\tmpFC2D.tmp"
  }
}
Product Compatible and additional computed target framework versions.
.NET net5.0 was computed.  net5.0-windows was computed.  net6.0 is compatible.  net6.0-android was computed.  net6.0-ios was computed.  net6.0-maccatalyst was computed.  net6.0-macos was computed.  net6.0-tvos was computed.  net6.0-windows was computed.  net7.0 was computed.  net7.0-android was computed.  net7.0-ios was computed.  net7.0-maccatalyst was computed.  net7.0-macos was computed.  net7.0-tvos was computed.  net7.0-windows was computed.  net8.0 was computed.  net8.0-android was computed.  net8.0-browser was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed. 
.NET Core netcoreapp2.0 was computed.  netcoreapp2.1 was computed.  netcoreapp2.2 was computed.  netcoreapp3.0 was computed.  netcoreapp3.1 was computed. 
.NET Standard netstandard2.0 is compatible.  netstandard2.1 was computed. 
.NET Framework net461 was computed.  net462 is compatible.  net463 was computed.  net47 was computed.  net471 was computed.  net472 was computed.  net48 was computed.  net481 was computed. 
MonoAndroid monoandroid was computed. 
MonoMac monomac was computed. 
MonoTouch monotouch was computed. 
Tizen tizen40 was computed.  tizen60 was computed. 
Xamarin.iOS xamarinios was computed. 
Xamarin.Mac xamarinmac was computed. 
Xamarin.TVOS xamarintvos was computed. 
Xamarin.WatchOS xamarinwatchos was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (1)

Showing the top 1 NuGet packages that depend on Audit.FileSystem:

Package Downloads
RezisFramework

Package Description

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last updated
27.2.0 73 11/23/2024
27.1.1 79 10/28/2024
27.1.0 81 10/24/2024
27.0.3 104 9/25/2024
27.0.2 96 9/19/2024
27.0.1 121 9/4/2024
27.0.0 102 9/3/2024
26.0.1 121 8/22/2024
26.0.0 92 7/19/2024
25.0.7 166 7/4/2024
25.0.6 105 6/24/2024
25.0.5 90 6/18/2024
25.0.4 148 3/24/2024
25.0.3 127 3/13/2024
25.0.2 113 3/12/2024
25.0.1 119 2/28/2024
25.0.0 111 2/16/2024
24.0.1 130 2/12/2024
24.0.0 128 2/12/2024
23.0.0 224 12/14/2023
22.1.0 119 12/9/2023
22.0.2 137 12/1/2023
22.0.1 164 11/16/2023
22.0.0 126 11/14/2023
21.1.0 170 10/9/2023
21.0.4 147 9/15/2023
21.0.3 214 7/9/2023
21.0.2 183 7/6/2023
21.0.1 198 5/27/2023
21.0.0 297 4/15/2023
20.2.4 294 3/27/2023
20.2.3 291 3/17/2023
20.2.2 290 3/14/2023
20.2.1 287 3/11/2023
20.2.0 272 3/7/2023
20.1.6 321 2/23/2023
20.1.5 356 2/9/2023
20.1.4 358 1/28/2023
20.1.3 411 12/21/2022
20.1.2 343 12/14/2022
20.1.1 351 12/12/2022
20.1.0 402 12/4/2022
20.0.4 389 11/30/2022
20.0.3 724 10/28/2022
20.0.2 445 10/26/2022
20.0.1 508 10/21/2022
20.0.0 608 10/1/2022
19.4.1 591 9/10/2022
19.4.0 540 9/2/2022
19.3.0 499 8/23/2022
19.2.2 511 8/11/2022
19.2.1 566 8/6/2022
19.2.0 690 7/24/2022
19.1.4 869 5/23/2022
19.1.3 482 5/22/2022
19.1.2 590 5/18/2022
19.1.1 689 4/28/2022
19.1.0 631 4/10/2022
19.0.7 1,199 3/13/2022
19.0.6 776 3/7/2022
19.0.5 766 1/28/2022
19.0.4 560 1/23/2022
19.0.3 513 12/14/2021
19.0.2 435 12/11/2021
19.0.1 821 11/20/2021
19.0.0 441 11/11/2021
19.0.0-rc.net60.2 169 9/26/2021
19.0.0-rc.net60.1 213 9/16/2021
18.1.6 608 9/26/2021
18.1.5 442 9/7/2021
18.1.4 431 9/6/2021
18.1.3 457 8/19/2021
18.1.2 539 8/8/2021
18.1.1 500 8/5/2021
18.1.0 541 8/1/2021
18.0.1 539 7/30/2021
18.0.0 519 7/26/2021
17.0.8 538 7/7/2021
17.0.7 531 6/16/2021
17.0.6 549 6/5/2021
17.0.5 530 5/28/2021
17.0.4 532 5/4/2021
17.0.3 518 5/1/2021
17.0.2 501 4/22/2021
17.0.1 497 4/18/2021
17.0.0 521 3/26/2021
16.5.6 499 3/25/2021
16.5.5 516 3/23/2021
16.5.4 538 3/9/2021
16.5.3 486 2/26/2021
16.5.2 505 2/23/2021
16.5.1 530 2/21/2021
16.5.0 486 2/17/2021
16.4.5 447 2/15/2021
16.4.4 471 2/5/2021
16.4.3 557 1/27/2021
16.4.2 499 1/22/2021
16.4.1 562 1/21/2021
16.4.0 512 1/11/2021
16.3.3 548 1/8/2021
16.3.2 554 1/3/2021
16.3.1 571 12/31/2020
16.3.0 503 12/30/2020
16.2.1 582 12/27/2020
16.2.0 617 10/13/2020
16.1.5 533 10/4/2020
16.1.4 580 9/17/2020
16.1.3 708 9/13/2020
16.1.2 592 9/9/2020
16.1.1 624 9/3/2020
16.1.0 587 8/19/2020
16.0.3 645 8/15/2020
16.0.2 640 8/9/2020
16.0.1 656 8/8/2020
16.0.0 575 8/7/2020
15.3.0 629 7/23/2020
15.2.3 615 7/14/2020
15.2.2 1,674 5/19/2020
15.2.1 616 5/12/2020
15.2.0 642 5/9/2020
15.1.1 605 5/4/2020
15.1.0 671 4/13/2020
15.0.5 672 3/18/2020
15.0.4 659 2/28/2020
15.0.3 619 2/26/2020
15.0.2 748 1/20/2020
15.0.1 650 1/10/2020
15.0.0 678 12/17/2019
14.9.1 667 11/30/2019
14.9.0 657 11/29/2019
14.8.1 684 11/26/2019
14.8.0 673 11/20/2019
14.7.0 691 10/9/2019
14.6.6 678 10/8/2019
14.6.5 661 9/27/2019
14.6.4 706 9/21/2019
14.6.3 1,161 8/12/2019
14.6.2 719 8/3/2019
14.6.1 717 8/3/2019
14.6.0 694 7/26/2019
14.5.7 769 7/18/2019
14.5.6 747 7/10/2019
14.5.5 744 7/1/2019
14.5.4 707 6/17/2019
14.5.3 748 6/5/2019
14.5.2 733 5/30/2019
14.5.1 748 5/28/2019
14.5.0 750 5/24/2019
14.4.0 753 5/22/2019
14.3.4 743 5/14/2019
14.3.3 746 5/9/2019
14.3.2 775 4/30/2019
14.3.1 825 4/27/2019
14.3.0 800 4/24/2019
14.2.3 746 4/17/2019
14.2.2 743 4/10/2019
14.2.1 774 4/5/2019
14.2.0 747 3/16/2019
14.1.1 773 3/8/2019
14.1.0 845 2/11/2019
14.0.4 821 1/31/2019
14.0.3 875 1/22/2019
14.0.2 896 12/15/2018
14.0.1 887 11/29/2018
14.0.0 922 11/19/2018
13.3.0 941 11/16/2018
13.2.2 927 11/15/2018
13.2.1 934 11/13/2018
13.2.0 946 10/31/2018
13.1.5 898 10/31/2018
13.1.4 895 10/25/2018
13.1.3 959 10/18/2018
13.1.2 1,003 9/12/2018
13.1.1 972 9/11/2018
13.1.0 974 9/11/2018
13.0.0 1,024 8/29/2018
12.3.6 1,032 8/29/2018
12.3.5 1,050 8/22/2018
12.3.4 1,023 8/21/2018
12.3.3 25,747 8/21/2018
12.3.2 1,048 8/20/2018
12.3.1 1,016 8/20/2018
12.3.0 996 8/20/2018
12.2.2 1,082 8/15/2018
12.2.1 1,035 8/9/2018
12.2.0 1,075 8/8/2018
12.1.11 1,015 7/30/2018
12.1.10 1,069 7/20/2018
12.1.9 1,191 7/10/2018
12.1.8 1,135 7/2/2018
12.1.7 1,184 6/7/2018
12.1.6 1,047 6/4/2018
12.1.5 1,151 6/2/2018
12.1.4 1,083 5/25/2018
12.1.3 1,275 5/16/2018
12.1.2 1,141 5/15/2018
12.1.1 1,165 5/14/2018
12.1.0 1,178 5/9/2018
12.0.7 1,240 5/5/2018
12.0.6 1,233 5/4/2018
12.0.5 1,183 5/3/2018
12.0.4 1,234 4/30/2018
12.0.3 1,272 4/30/2018
12.0.2 1,224 4/27/2018
12.0.1 1,166 4/25/2018
12.0.0 1,102 4/22/2018
11.2.0 1,143 4/11/2018
11.1.0 1,185 4/8/2018
11.0.8 1,194 3/26/2018
11.0.7 1,205 3/20/2018
11.0.6 1,168 3/7/2018
11.0.5 1,133 2/22/2018
11.0.4 1,220 2/14/2018
11.0.3 1,148 2/12/2018
11.0.2 1,202 2/9/2018
11.0.1 1,100 1/29/2018
11.0.0 1,200 1/15/2018
10.0.3 1,114 12/29/2017
10.0.2 1,170 12/26/2017
10.0.1 1,252 12/18/2017
10.0.0 1,111 12/18/2017
9.3.0 1,177 12/17/2017
9.2.0 1,177 12/17/2017
9.1.3 1,102 12/5/2017
9.1.2 1,145 11/27/2017