check_file_system_changes

Project Notes

.. It relies on the System.IO.FileSystemWatcher class which is part of the .NET Framework (since v1.0).

Three files can be excluded by argument:

1) Any file which contains 'DfsrPrivate' in it's path.
2) Any file which contains '_smbtestfile' in it's path (refer to the check_smb_speed plugin).
3) Any file which contains a given string in it's path.

It is written in C# and the source code will be available via github.

Attached is the .cs file of this plugin so far.

Arguments:
check_file_system_changes

-NSCA server_IP:port:enc_algo:password [not required, colon separated list to pass to send_nsca, you must always set the port]
-N [number of changes]
-D [directory]
-S [not required, boolean, include it... include subdirectories]
-WL [watch list made up of FileSystemWatcher events changed, created, deleted and renamed (error is not included) in a colon separated list: as CH:CR:DE:RE)
-FL [filter list made up of FileSystemWatcher event notify filters File Name, Directory Name, Attributes, Size, Last Write, Last Access, Creation Time, Security; as FN:DN:AT:SZ:LW:LA:CT:SEC)
-EX [not required, exclude any file which contains 'DfsrPrivate', and '_smbtestfile'; as D:S respectively]
-EXSTR [not required, exclude any file which contains any of the case-insensitive strings contained in a colon separated list]
-INCSTR [not required, include only any file which contains any of the case-insensitive strings contained in a colon separated list**]
-BUFF [not required, change the buffer size utilized by the FileSystemWatcher to do it's thing, defaults to 8KB, acceptable 4-64KB (from the non-paged pool so it is sort of "dangerous" as the non-paged pool is finite); see http://goo.gl/TBFnP]

returns:
Total time it takes for N number of operations to occur.

ex:
Both of these command line examples pass the following NSCA configuration causing send_nsca to:
...send results to an NSCA server instance bound to 192.168.20.117:5667. The resultant data will be encrypted using Simple XOR (as documented in the send_nsca.exe win32 port of the send_nsca binary) with the password 'p@ssw0rd'.

check_file_system_changes -NSCA 192.168.20.117:5667:1:p@ssw0rd -N 100 -D 'D:shares' -S -WL CH:CR:DE:RE -EX D:S -EXSTR 'Home':'company_photos'

Watches for 100 change, create, delete and rename events in d:shares and all it's subdirectories, excluding any file that has 'DfsrPrivate' (case sensitive), '_smbtestfile' (case sensitive), 'home' or 'company_photos' (case-insensitive) in it's path name.

check_file_system_changes -NSCA 192.168.20.117:5667:1:p@ssw0rd -N 1 -D 'D:shares' -S -WL DE -EX D:S -INCSTR 'contacts'
Watches for 1 delete event in d:shares and all it's subdirectories, only including files with the string 'contacts' (case-insensitive) in it's path name.

** if the INCSTR argument contains only one string, then this will be used most efficiently, by utilizing the .Filter property of the FileSystemWatcher. Unfortunately, the .Filter property isn't very advanced; it doesn't take in conditional OR/multiple strings and it doesn't allow logical negation/"NOT these strings". The only way to do this is to allow the FileSystemWatcher to raise an event, then use a conditional statement to qualify if the FileSystemEventArgs.FileName contains the given string. An operation uses up our magical buffer space, obviously. If I was MSFT, I'd change this.