Using the file system events log

Folder Guard offers you an option to log file system events that apply to a folder of your choice into a file. You may find this option useful when troubleshooting the access and visibility of files and folders protected with Folder Guard.

You can specify the location of the log file by using the Options for file system events log screen. Folder Guard begins logging the file system events into a file when you select the Log file system events option and press the Protect button to resume the protection (or, if the protection is already active, when you press the Apply button to make changes to the options effective.) Folder Guard continues to log the file system events until you pause the protection, or clear the Log file system events option and press the Apply button. Note that every time the protection is resumed, Folder Guard discards any previously recorded events and starts the log file from scratch. If you want to keep the log files pertaining to several protection sessions, you should change the file name of the log file before enabling the protection, or copy the previously created log file to another location, to prevent it from being overwritten with the new information.

Keep in mind that if you keep the Log file system events option enabled for an extended period of time, it may result in producing a log file of a very large size. Also, recording the file system events into the log file makes the CPU of your computer work harder and may result in a slowdown of the computer. For these reasons, you should not keep the Log file system events option enabled for an extended period of time, and use it only for the troubleshooting purposes.

The log file created by Folder Guard is a regular text file encoded in the UNICODE format. It can be opened and viewed with almost any text editor, such as Windows Notepad. Note that the logging must be stopped before the file can be opened for vieweing.

The log file contains a sequence of records, each record describing a particular file system event as it was encoutered and processed by Folder Guard. Below is an example of a typical record that may appear in the log file:

    ALLOWING ACCESS:
      Path: E:\TEST
      Module: \DEVICE\HARDDISKVOLUME2\WINDOWS\EXPLORER.EXE
      User: ADMIN
      LogonId: 0.0
      Status: 0x0

The first line of the record, such as ALLOWING ACCESS, is the description of the event. The lines below it offer additional information about the event, such as:

Path - The path to the folder or file that this event applies to;
Module - The program that caused this particular event;
User - The name of the user account associated with this event;
LogonID - The user session associated with this event;
Status - The status of the operation as reported by Windows after completing the file system operation.

Please note that we do not offer any support in interpretation of the information recorded in the log file. It is up to you review the log file and make conclusions based on the events recorded.