Windows USN Journals

[nathany]

@pkrnjevic mentioned Windows USN Journals here: fsnotify/fsevents#1 (comment)

"On Windows NT 4.0, these tasks were accomplished with functions like FindFirstChangeNotification and ReadDirectoryChangesW. Anyone who has attempted to use these functions knows how limited they can be. The Change Journal provides a new level of detailed information for applications that need to monitor changes on an NTFS volume."

[nathany]

FYI, Go currently requires Windows XP or later, so there is no need to support anything older than that.

[pkrnjevic]

For those interested, here is a small example of using Windows Journals I wrote in Go, based on the MSJ Windows Change Journal article and sample.
I can confirm this works with Windows 7 (32 bit) with Go 1.3.3. Must be run with Administrator privileges.

[nathany]

Is it possible to use USN Journals without Administrator privileges?

[pkrnjevic]

Not that I know of.
My plan was to use it in a Windows service, with a user space client interface, though there are probably better ideas.

[elvarb]

Would love for this to get implemented, such a powerful feature.

Found this that could be of help.
https://blogs.technet.microsoft.com/heyscriptingguy/2015/08/12/use-poshusnjournal-module-to-work-with-change-journal/

[arp242]

To add this to fsnotify adding support for it in x/sys/windows would be required first. The example that was posted earlier would be a good starting point for that.

Change Journals on the Microsoft site gives a nice general overview on how it works, how to use it from the fsutil, and how to use it programmatically.