How to detect new changes in a file?

Question

I am trying to build a logViewer which displays log from multiple files. I want to display the new changes in the files as soon as they are modified. I am using a FileSystemWatcher to detect if a file has been changed. But I am not sure how do I detect the change that has been made in the file that I am monitoring. I have seen some of the questions in StackOverflow but they are not helpful. How do I do this?

Edit: All I want is to get the line/lines that have been added. If there are any method other than using FileSystemWatcher I am fine with that also.

score 2 · Accepted Answer · edited May 23 '17 at 11:57

2

Use the filesystemwatcher to detect changes and get new lines using last read position and seek the file.

https://stackoverflow.com/a/19230599/1583653

edited May 23 '17 at 11:57

Community

1
1

answered Jun 20 '14 at 16:11

Faisal

364
1
8

This assumes logs are appended and that every line is still in the file. – Pseudonym Jun 20 '14 at 17:44
seen this. I think this will give me the last line added.I want to get all the lines that were added. – subs Jun 20 '14 at 18:45
You can use Polling instead. because after reading thread you wont rely on FileSystemWatcher http://stackoverflow.com/q/239988/1583653 – Faisal Jun 21 '14 at 11:27

score 1 · Answer 2 · edited Jun 20 '14 at 14:48

1

If you are looking to do this programmatically you will need to have both the previous version and the current version. Then you will have to make a comparison somehow: letter by letter, word by word, etc, and then go from there.

FileSystemWatcher only detects if the change has happened, it doesn't detect the change itself.

edited Jun 20 '14 at 14:48

Peter Ritchie

35,463
9
80
98

answered Jun 20 '14 at 14:47

Pseudonym

2,052
2
17
38

1

And one "change" by the source may appear as multiple updates via `FileSystemWatcher`. – Peter Ritchie Jun 20 '14 at 14:48
The files are huge. Can't do comparison. – subs Jun 20 '14 at 15:19
Thats an assumption that the files will be huge, however I understand your point. I meant the answer to be somewhat generic, how he implements it is up to him. – Pseudonym Jun 20 '14 at 20:05

score 0 · Answer 3 · answered Jun 20 '14 at 18:58

Besides FileSystemWatcher your task can be solved (quite efficiently) using a filesystem filter driver. With such driver you'll know about the changes right when (before or after) they are made, and you know what exactly is done.

You can write a filter yourself if you have experience with kernel-mode development or use our CallbackFilter product, though the latter is an overkill for your needs.

How to detect new changes in a file?

3 Answers3