home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Meeting Pearls 3
/
Meeting_Pearls_III.iso
/
Pearls
/
debug
/
Snooper
/
FSG
/
FSG.doc
< prev
next >
Wrap
Text File
|
1995-06-25
|
7KB
|
209 lines
The File System Guardian -- Yet Another Dos Snoop Utility
(c) 1994 Martin Mares, MJSoft System Software
================================================================================
Preface
=======
FSG, its documentation and the ss.library are Copyright (c) Martin Mares,
MJSoft System Software, Prague, Czech Republic.
This archive can be freely redistributed, as long as all of its files are
included in their original form without any additions, deletions or
modifications, and no more than a nominal fee is charged for its distribution.
All copyright notices in the programs and accompanying documentation files must
remain on their places. Also '.displayme' and other similar files may not be
added. This is generally known as FREEWARE.
This software is provided "AS IS" without warranty of any kind, either
expressed or implied. The author is not responsible for any damage caused by
it.
Introduction
============
There exist people which need to monitor disk / file activity. And there
also exist AmigaDOS / disk / file activity monitors. Oh yes, they are not quite
the same, there are many differences between them... and FSG tries to be the
best of them.
A long time ago, there were some ancient operating systems called 1.3 and
there also were numerous tools for monitoring file access under them. But all
of them used a very stupid method -- they simply patched all dos.library calls
and watched who and when is calling them. The authors probably didn't know that
calling dos.library is one, but not the only one method of accessing files. You
can:
(1) Call dos -- the most usual case.
(2) Call BCPL functions through the Global Vector. Most 1.3 commands do
this.
(3) Use asynronous I/O with your own packet sending mechanism.
It's the reason why most DOS snoppers don't catch all the accesses. And
(what is even worse) they are usually designed for being used by unexperienced
users thus they don't show detailed information about what is going on.
FSG tries to be better.
Requirements
============
- Kickstart 2.04 or higher.
- The ss.library version 5.0 or newer (included in this archive)
Usage
=====
FSG must be started from the shell.
Usage:
FSG <devices> [NORES] [MIN] [RESOLVE]
<devices> - list of DOS devices you want to look at. Usually all hard drives,
floppy drives and the RAM disk.
NORES - disable waiting for packet results. In all normal cases, all packets
are reported as soon as the result code is returned back to the
caller. In some cases, you need to report the packets immediately
(for example when debugging a file system) and you can force it by
this option.
MIN - show only important events - opening of files, locking of
directories etc. If you are not an experienced user, turn it on to
hide a lot of confusing output.
RESOLVE - show full names instead of file handles and locks. This slightly
slows down system operation, but displays a more useful output.
(no one usually knows what does a file handle 0x221234 mean).
After invocation, FSG starts looking for packets and displaying all caught
events. It can be stopped by CTRL-C (or by sending a BREAK to it). If stopped,
you must wait a moment while the buffers are deallocated and unread messages
thrown away.
Only one FSG may be active at given time.
Output
======
The output consists has the following format:
<device> <task> <action> <parameters> -> <result> <ioerr>
<device> - the device handler or filesystem this packet is sent to. It's the
name of the handler task that needn't to be the same as the
device name given.
<task> - task requesting the operation. If it's a CLI process running a
command, the command name is displayed instead.
<action> - packet type (see the table below)
<parameters> - packet parameters - displayed as hexadecimal numbers or strings.
<result> - primary result of the packet. Zero or FFFFFFFF used to signalize
failure. In this case, <ioerr> contains detailed description of
the error.
<ioerr> - I/O Error code. If it's some standard code, its name is shown
instead. If no error occured, this needn't to be zero (but
usually is).
Known packets
=============
- This table is not complete. If you know anything better than me, let me
know.
NIL -
GET_BLOCK ????? ?
TIMER bool
SET_MAP ????? ?
DISK_TYPE ????? ?
DISK_CHANGE bool
READ_RETURN ??? (does return?)
WRITE_RETURN ??? (does return?)
EVENT ????? ?
WRITE_PROTECT flag passkey bool
STARTUP ? startup devnode bool
DIE bool
FINDINPUT fh lock name bool
FINDOUTPUT fh lock name bool
FINDUPDATE fh lock name bool
READ arg1 &buf len len
WRITE arg1 &buf len len
END arg1 bool
SEEK arg1 pos mode oldpos
SET_FILE_SIZE arg1 pos mode oldpos
EXAMINE_NEXT lock fib bool
EXAMINE_OBJECT lock fib bool
INFO lock info bool
DISK_INFO info bool
PARENT lock lock
DELETE_OBJECT lock name bool
CREATE_DIR lock name lock
LOCATE_OBJECT lock name mode lock
COPY_DIR lock lock
FREE_LOCK lock bool
SET_PROTECT - lock name mask bool
SET_COMMENT - lock name comment bool
RENAME_OBJECT slock sname dlock dname bool
RENAME_DISK name bool
MORECACHE num bool
WAITCHAR ticks bool
FLUSH bool
SCRMODE bool bool
CURRENT_VOLUME [arg1] volume
SET_DATE - lock name stamp bool
SET_OWNER - - lock userinfo bool
INHIBIT bool bool
SAME_LOCK lock lock bool
CHANGE_SIGNAL arg1 task 0 bool
FORMAT volname dostype bool
MAKE_LINK lock name dest!# soft bool
READ_LINK lock name!C buf size len
FH_FROM_LOCK fh lock bool
IS_FILESYSTEM bool
CHANGE_MODE type lk/fh newmode bool
COPY_DIR_FH arg1 lock
PARENT_FH arg1 lock
EXAMINE_ALL lock buffer size data ctrl bool
EXAMINE_ALL_END lock buffer size data ctrl bool
EXAMINE_FH arg1 fib bool
LOCK_RECORD arg1 offset length mode timout bool
FREE_RECORD arg1 offset length bool
START_NOTIFY notreq bool
REMOVE_NOTIFY notreq bool
SERIALIZE_DISK bool
!C = stored as C-string.
!# = BPTR Lock if hard, C-string if soft.
???,????? = I know nothing about it.
? = Unknown parameter, always zero.
For novices:
FINDINPUT open existing file
FINDOUTPUT create new file
FINDUPDATE open existing file or create new one if it doesn't exist
LOCATE_OBJECT find and lock given object
Notes
=====
Send suggestions, flames and bug reports to <mjsoft@k332.feld.cvut.cz>.