The File System Guardian -- Yet Another Dos Snoop Utility (c) 1994 Martin Mares, MJSoft System Software ================================================================================ Preface ======= FSG, its documentation and the ss.library are Copyright (c) Martin Mares, MJSoft System Software, Prague, Czech Republic. This archive can be freely redistributed, as long as all of its files are included in their original form without any additions, deletions or modifications, and no more than a nominal fee is charged for its distribution. All copyright notices in the programs and accompanying documentation files must remain on their places. Also '.displayme' and other similar files may not be added. This is generally known as FREEWARE. This software is provided "AS IS" without warranty of any kind, either expressed or implied. The author is not responsible for any damage caused by it. Introduction ============ There exist people which need to monitor disk / file activity. And there also exist AmigaDOS / disk / file activity monitors. Oh yes, they are not quite the same, there are many differences between them... and FSG tries to be the best of them. A long time ago, there were some ancient operating systems called 1.3 and there also were numerous tools for monitoring file access under them. But all of them used a very stupid method -- they simply patched all dos.library calls and watched who and when is calling them. The authors probably didn't know that calling dos.library is one, but not the only one method of accessing files. You can: (1) Call dos -- the most usual case. (2) Call BCPL functions through the Global Vector. Most 1.3 commands do this. (3) Use asynronous I/O with your own packet sending mechanism. It's the reason why most DOS snoppers don't catch all the accesses. And (what is even worse) they are usually designed for being used by unexperienced users thus they don't show detailed information about what is going on. FSG tries to be better. Requirements ============ - Kickstart 2.04 or higher. - The ss.library version 5.0 or newer (included in this archive) Usage ===== FSG must be started from the shell. Usage: FSG [NORES] [MIN] [RESOLVE] - list of DOS devices you want to look at. Usually all hard drives, floppy drives and the RAM disk. NORES - disable waiting for packet results. In all normal cases, all packets are reported as soon as the result code is returned back to the caller. In some cases, you need to report the packets immediately (for example when debugging a file system) and you can force it by this option. MIN - show only important events - opening of files, locking of directories etc. If you are not an experienced user, turn it on to hide a lot of confusing output. RESOLVE - show full names instead of file handles and locks. This slightly slows down system operation, but displays a more useful output. (no one usually knows what does a file handle 0x221234 mean). After invocation, FSG starts looking for packets and displaying all caught events. It can be stopped by CTRL-C (or by sending a BREAK to it). If stopped, you must wait a moment while the buffers are deallocated and unread messages thrown away. Only one FSG may be active at given time. Output ====== The output consists has the following format: -> - the device handler or filesystem this packet is sent to. It's the name of the handler task that needn't to be the same as the device name given. - task requesting the operation. If it's a CLI process running a command, the command name is displayed instead. - packet type (see the table below) - packet parameters - displayed as hexadecimal numbers or strings. - primary result of the packet. Zero or FFFFFFFF used to signalize failure. In this case, contains detailed description of the error. - I/O Error code. If it's some standard code, its name is shown instead. If no error occured, this needn't to be zero (but usually is). Known packets ============= - This table is not complete. If you know anything better than me, let me know. NIL - GET_BLOCK ????? ? TIMER bool SET_MAP ????? ? DISK_TYPE ????? ? DISK_CHANGE bool READ_RETURN ??? (does return?) WRITE_RETURN ??? (does return?) EVENT ????? ? WRITE_PROTECT flag passkey bool STARTUP ? startup devnode bool DIE bool FINDINPUT fh lock name bool FINDOUTPUT fh lock name bool FINDUPDATE fh lock name bool READ arg1 &buf len len WRITE arg1 &buf len len END arg1 bool SEEK arg1 pos mode oldpos SET_FILE_SIZE arg1 pos mode oldpos EXAMINE_NEXT lock fib bool EXAMINE_OBJECT lock fib bool INFO lock info bool DISK_INFO info bool PARENT lock lock DELETE_OBJECT lock name bool CREATE_DIR lock name lock LOCATE_OBJECT lock name mode lock COPY_DIR lock lock FREE_LOCK lock bool SET_PROTECT - lock name mask bool SET_COMMENT - lock name comment bool RENAME_OBJECT slock sname dlock dname bool RENAME_DISK name bool MORECACHE num bool WAITCHAR ticks bool FLUSH bool SCRMODE bool bool CURRENT_VOLUME [arg1] volume SET_DATE - lock name stamp bool SET_OWNER - - lock userinfo bool INHIBIT bool bool SAME_LOCK lock lock bool CHANGE_SIGNAL arg1 task 0 bool FORMAT volname dostype bool MAKE_LINK lock name dest!# soft bool READ_LINK lock name!C buf size len FH_FROM_LOCK fh lock bool IS_FILESYSTEM bool CHANGE_MODE type lk/fh newmode bool COPY_DIR_FH arg1 lock PARENT_FH arg1 lock EXAMINE_ALL lock buffer size data ctrl bool EXAMINE_ALL_END lock buffer size data ctrl bool EXAMINE_FH arg1 fib bool LOCK_RECORD arg1 offset length mode timout bool FREE_RECORD arg1 offset length bool START_NOTIFY notreq bool REMOVE_NOTIFY notreq bool SERIALIZE_DISK bool !C = stored as C-string. !# = BPTR Lock if hard, C-string if soft. ???,????? = I know nothing about it. ? = Unknown parameter, always zero. For novices: FINDINPUT open existing file FINDOUTPUT create new file FINDUPDATE open existing file or create new one if it doesn't exist LOCATE_OBJECT find and lock given object Notes ===== Send suggestions, flames and bug reports to .