I have managed to get ReadDirectoryChangesW() working for the folders I need to monitor. I am using the IO Completion routine and all of the change monitoring is done by a thread that does nothing except wait for changes and a signal to stop. That all works fine. The completion routine is currently just logging the changed filename and Action from the notify record to the system debug log. Again, seems to be working fine. While testing, I am waiting on all of the available events (mask of 0x017F).
My question is: Why do I NEVER see any LAST WRITE change events when, say Notepad, saves a changed file?
I originally waited on only FILE_NOTIFY_CHANGE_CREATION, _LAST_WRITE and _FILE_NAME events and wondered why I never saw last write events (but I did see _DIR_NAME events, which I was NOT waiting on), so I changed to wait for everything.
My code is currently very similar to what I found here as an example: ReadDirectoryChangesW
While debugging, I used FindFirstFile() to get a copy of the WIN32_FIND_DATA before and after changing the file being monitored to verify that the last write time changed -- it did. So why no notification? Is there something special I need to do in order to enable that?
It turns out I didn't read enough documentation. I incorrectly assumed that the action given to the completion routine would use the same bit mask values as the FILE_NOTIFY_CHANGE_*** symbols. After all, it only makes sense to get back what I put in, right?
Nope. The completion routine gets a value from 1..5 for the action for Added, Removed, Modified, Renamed(oldName), Renamed(newName). For reference, the actual names of the symbols are like FILE_ACTION_REMOVED.
This is disappointing because 5 of the 8 things one can monitor will all become FILE_ACTION_MODIFIED while the remaining 3 things one can monitor map to the remaining 4 FILE_ACTION symbols.
I'm going to leave my dumb question in case others have a similar issue.