9

I have written a tool to collect log files within a time window specified by the user of the tool. Up until now I was basing the collection of log files by using the File.GetLastWriteTime method on the log files, comparing this to the times the user entered and collecting based on the outcome of these comparisions. Here is a small code snippet:

DateTime logFileEnd = File.GetLastWriteTime(matchingActiveLogFile);

However I noticed my tool didnt collect some log files I thought it should have done. It seems the DateTime returned by this method was out of date, (there was more recent logging in the file than the value of this datetime).

When I looked at the 'Date Modified' of the file in question, it too was 'out of date', there was more recent logging in the file than the 'Date Modified'.

How I can I get an accurate 'GetLastWriteTime' or Date Modified value?

DukeOfMarmalade
  • 2,680
  • 10
  • 41
  • 70
  • What do you mean by *DateTime returned by this method was out of date* ? – V4Vendetta Apr 03 '12 at 11:32
  • 1
    date doesn't update after a while? For example when you see that date modified is 'out of date' wait ~30s and then check date again. – Renatas M. Apr 03 '12 at 11:42
  • 1
    Also read this article: http://blogs.technet.com/b/asiasupp/archive/2010/12/14/file-date-modified-property-are-not-updating-while-modifying-a-file-without-closing-it.aspx might be that you experiencing same – Renatas M. Apr 03 '12 at 11:50
  • Possible duplicate of [.NET FileInfo.LastWriteTime & FileInfo.LastAccessTime are wrong](https://stackoverflow.com/questions/1448716/net-fileinfo-lastwritetime-fileinfo-lastaccesstime-are-wrong) – StayOnTarget Aug 09 '18 at 14:19

2 Answers2

15

During my experience I went throw a couple of issues like yours. On Windows Vista/7 systems that function not always returns a reliable result.

After a while we found this link: Disabling Last Access Time in Windows Vista to improve NTFS performance

An observant Windows Vista user noticed a registry named NtfsDisableLastAccessUpdate under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ControlFileSystem and asked us what this means.

Last Access Time is a file attribute that’s updated when a file is accessed or otherwise touched. (This is often confused with the Last Modified Time, which is only updated when the file changes.) Last Access Time has a loose granularity that only guarantees that the time is accurate to within one hour.

In Windows Vista, we’ve disabled updates to Last Access Time to improve NTFS performance. If you are using an application that relies on this value, you can enable it using the following command:

fsutil behavior set disablelastaccess 0

You must restart the computer for this change to take effect. For more information about the Fsutil command and Last Access Time, see the Fsutil online Help.

Based on this it became clear that last access time can not be used as a "strong key". To resolve that issue, we just stop relaying on GetLastWriteTime call, but store last changed value of the file or in its name, like "FileName_yyyymmdd", or inside that file in some field.

There is another solution for GetLastAccessTime can find here:

.NET FileInfo.LastWriteTime & FileInfo.LastAccessTime are wrong, could be useful in your case too.

My general opinion on this would be: do not relay on that parameter, but invent something else in your architecture.

Good luck

StayOnTarget
  • 11,743
  • 10
  • 52
  • 81
Tigran
  • 61,654
  • 8
  • 86
  • 123
  • 7
    I had head ache with file creation date. if you create file, delete it and create it again(with same name) creation date will be of previously created file. After a while I found that OS restores date from cache if file recreated during 15s. Solution was change file name every time, like you mentioned. – Renatas M. Apr 03 '12 at 11:57
  • 1
    @Reniuz: sounds familiar :) Infact, as we had a lot of clients in completely different countries/cultures, from WindowsXp -> Windows7 64 bit, the non reliable information like that was absolutely unacceptable. – Tigran Apr 03 '12 at 12:02
  • 1
    Is this fixed in Windows 10? – Martin Braun Apr 15 '19 at 11:39
2

Tigran is right:

You can try to compare file size changes, in addition to last write time. It's what I do (with FileSystemWatcher, but it's similar to compare fields within a time window).

Eric Boumendil
  • 2,318
  • 1
  • 27
  • 32