How to detect if file is deleted

[Kiran]

Hi,

I have program, which opens file at the startup and logs error
messages to the file, file handle is closed at the end of the program.
However if file is deleted in-between, program do not report any error
while writing to the open file handle. On Windows, file shows-up again
in explorer and automatically deleted finally when program ends. On
Unix, same thing happens if file is on nfs mounted drive, but in this
case, actual file is deleted and some dummy file is showsup and logs
goes to that file, which again automatically removed once program
terminates.

If file is deleted, I want to re-create the file and log to the new
file, which should not disappear when program terminates.

Any thoughts?

Thanks,
Kiran

 

[Mark McIntyre]

Hi,

I have program, which opens file at the startup and logs error
messages to the file, file handle is closed at the end of the program.
However if file is deleted in-between, program do not report any error
while writing to the open file handle. ....

If file is deleted, I want to re-create the file and log to the new
file, which should not disappear when program terminates.

Open the file for each write, close it afterwards, and handle the error
that arises if the file disappears between writes. This may be
time-expensive due to all the file-open/closes but oughtnt to be on a
decent OS.

writedata()
{
open file for append
if failure, open for create/write
if still failure, gracefully notify user - file cannot be created
write data
close file
}

 

[Default User]

Hi,

I have program, which opens file at the startup and logs error
messages to the file, file handle is closed at the end of the program.
However if file is deleted in-between, program do not report any error
while writing to the open file handle.

What you really need is file-locking. However, that is beyond the scope
of this newsgroup, as there is no way to do that in ISO standard C.
There probably is a way offered by your platform.



Brian

 

[Keith Thompson]

Open the file for each write, close it afterwards, and handle the error
that arises if the file disappears between writes. This may be
time-expensive due to all the file-open/closes but oughtnt to be on a
decent OS.

writedata()
{
open file for append
if failure, open for create/write
if still failure, gracefully notify user - file cannot be created
write data
close file
}

If you're worried about the file being deleted while the program is
running (presumably by something external to the program), you might
also need to worry about the file being deleted and recreated behind
your program's back. There's a chance that the file could be deleted,
and another file of the same name created, between calls to
writedata().

There may be some system-specific things you can do to prevent the
file from being deleted while the program is running.

Another option might be to save all the error messages internally, and
write them out all at once just before the program terminates. This
may be unacceptable if you want to see the messages before the program
finishes, or if the program might be killed before it can write the
log.

How you want to handle this may depend on whether you're concerned
about the file being deleted accidentally, or being deleted
deliberately and maliciously (e.g., by an attacker trying to cover his
tracks). In the former case, it may suffice to create the file with
an obscure name (perhaps using tmpnam()) and rename it when you're
finished.

Since standard C, and therefore this newsgroup, only barely
acknowledges the existence of anything external to the program, you
should probably try a newsgroup that's specific to your system (e.g.,
comp.unix.programmer or comp.os.ms-windows.programmer.win32).

 

[Walter Roberson]

:I have program, which opens file at the startup and logs error
:messages to the file, file handle is closed at the end of the program.
:However if file is deleted in-between, program do not report any error
:while writing to the open file handle.

It's not supposed to in POSIX. POSIX.1 says specifically that
the removal of the file contents shall be postponed until
all references to the file have been closed. Until that time,
you can work with the file.

The standard C function tmpfile() is pretty much based upon this
assumption that the file will stick around until it is closed.
[It could be implimented a different way, though, such as by setting
an attribute that marked it for closure upon deletion.]


:On Windows, file shows-up again
:in explorer and automatically deleted finally when program ends. On
:Unix, same thing happens if file is on nfs mounted drive, but in this
:case, actual file is deleted and some dummy file is showsup and logs
:goes to that file, which again automatically removed once program
:terminates.

Ummm, nfs v1 and v2 are theoretically stateless, which makes it difficult
to refer to deleted files, so you should expect kind of odd results...


:If file is deleted, I want to re-create the file and log to the new
:file, which should not disappear when program terminates.

I can't think of anything within Standard C, but chances are you
can use one of the common extensions to fstat() the file and examine
the link count. You don't want to use stat() for this because stat()
relies on the pathname, and if the file was deleted and another
file with that name was created, stat() would show the file as existing.


Some operating systems have extensions that allow you to monitor
the state of a file and get notified when the file gets deleted.
I'm thinking in particular of SGI's IRIX 'fam' (file alteration monitor).
That wouldn't be portable to Windows though, or even to many other
unix.

 

[junky_fellow]

Hi,

I have program, which opens file at the startup and logs error
messages to the file, file handle is closed at the end of the program.
However if file is deleted in-between, program do not report any error
while writing to the open file handle. On Windows, file shows-up again
in explorer and automatically deleted finally when program ends. On
Unix, same thing happens if file is on nfs mounted drive, but in this
case, actual file is deleted and some dummy file is showsup and logs
goes to that file, which again automatically removed once program
terminates.

If file is deleted, I want to re-create the file and log to the new
file, which should not disappear when program terminates.

Any thoughts?

Thanks,
Kiran

On a Unix System, if a file has been opened by one processs and some
other process deletes the same file, only the directory entry for that
file is removed whereas the data blocks remain allocated. The process
that has opened the file is allowed to do read/write operations on
that file. The disk blocks will be freed only after the last close on
this file.
So, what you can do is before closing the file, check whether that file
is deleted (use fstat for that). If the file is deleted, create the
file
again (with the same name if you want) and then read the contents from
the deleted file and write to the this new created file.

 

[Lawrence Kirby]

:I have program, which opens file at the startup and logs error
:messages to the file, file handle is closed at the end of the program.
:However if file is deleted in-between, program do not report any error
:while writing to the open file handle.

It's not supposed to in POSIX. POSIX.1 says specifically that
the removal of the file contents shall be postponed until
all references to the file have been closed. Until that time,
you can work with the file.

Perhaps not even then if there other hard links to the file. In a
desperate bid for topicality I would point out that the standard says:

"The remove function causes the file whose name is the string pointed to
by filename to be no longer accessible by that name."

So the remove() function isn't required in any sense to "delete" a file.

The standard C function tmpfile() is pretty much based upon this
assumption that the file will stick around until it is closed.
[It could be implimented a different way, though, such as by setting
an attribute that marked it for closure upon deletion.]

Deletion upon closure? removge() upon closure perhaps if it is implemented
using an actual filename.

:On Windows, file shows-up again
:in explorer and automatically deleted finally when program ends. On
:Unix, same thing happens if file is on nfs mounted drive, but in this
:case, actual file is deleted and some dummy file is showsup and logs
:goes to that file, which again automatically removed once program
:terminates.

Ummm, nfs v1 and v2 are theoretically stateless, which makes it
difficult to refer to deleted files, so you should expect kind of odd
results...

Depends on whether the files are referred to by name or by a token/handle.

:If file is deleted, I want to re-create the file and log to the new
:file, which should not disappear when program terminates.

I can't think of anything within Standard C, but chances are you can use
one of the common extensions to fstat() the file and examine the link
count. You don't want to use stat() for this because stat() relies on
the pathname, and if the file was deleted and another file with that
name was created, stat() would show the file as existing.

[OT]
fstat() alone is no good, e.g. a rename won't change the link count, but
you typically do want to detect this. The normal approach is to use both
stat() and fstat() and compare the filesystem and inode numbers to verify
that the filename refers to the same file that you have open. [/OT]

Lawrence