{"action":"created","issue":{"url":"https://api.github.com/repos/billziss-gh/winfsp/issues/206","repository_url":"https://api.github.com/repos/billziss-gh/winfsp","labels_url":"https://api.github.com/repos/billziss-gh/winfsp/issues/206/labels{/name}","comments_url":"https://api.github.com/repos/billziss-gh/winfsp/issues/206/comments","events_url":"https://api.github.com/repos/billziss-gh/winfsp/issues/206/events","html_url":"https://github.com/billziss-gh/winfsp/issues/206","id":387684907,"node_id":"MDU6SXNzdWUzODc2ODQ5MDc=","number":206,"title":"PT sample with Windows Defender - file never gets a Close event.","user":{"login":"alfaunits","id":42452677,"node_id":"MDQ6VXNlcjQyNDUyNjc3","avatar_url":"https://avatars0.githubusercontent.com/u/42452677?v=4","gravatar_id":"","url":"https://api.github.com/users/alfaunits","html_url":"https://github.com/alfaunits","followers_url":"https://api.github.com/users/alfaunits/followers","following_url":"https://api.github.com/users/alfaunits/following{/other_user}","gists_url":"https://api.github.com/users/alfaunits/gists{/gist_id}","starred_url":"https://api.github.com/users/alfaunits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alfaunits/subscriptions","organizations_url":"https://api.github.com/users/alfaunits/orgs","repos_url":"https://api.github.com/users/alfaunits/repos","events_url":"https://api.github.com/users/alfaunits/events{/privacy}","received_events_url":"https://api.github.com/users/alfaunits/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-12-05T10:15:48Z","updated_at":"2018-12-05T20:02:44Z","closed_at":null,"author_association":"NONE","body":"OS: W10 x64, 1703, latest WinFSP as of today.\r\n\r\nRun PassThrough sample, mount any folder on any drive. Suppose we create a file, write any data to it and close (specifically I did a test with a C++ app that does fopen/fwrite/fclose). This does not occur with simply doing \"echo test >test.dat\".\r\n\r\nWindows Defender reads the file, and the file never gets a Close. I suspected a caching issue, but the close does not arrive for an hour at least ;)\r\n\r\npassthough -p C:\\PassthroughPoint -m E:\r\n\r\nC++ sample:\r\n```\r\n                    io_err = _wfopen_s(&pFile, \"E:\\\\Test.dat\", L\"w+b\");\r\n                    if (io_err)\r\n                    {\r\n                        std::wcout << L\"\\nError \" << io_err << L\" occurred during fopen call on the file \" << std::endl;\r\n                    }\r\n                    else\r\n                        if (fwrite(buffer, 1024 * 128, 1, pFile) != 1)\r\n                        {\r\n                            std::wcout << L\"\\nError \" << errno << L\" occurred during write for the file \" << std::endl;\r\n                        }\r\n                    if (!io_err) fclose(pFile);\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/billziss-gh/winfsp/issues/comments/444625867","html_url":"https://github.com/billziss-gh/winfsp/issues/206#issuecomment-444625867","issue_url":"https://api.github.com/repos/billziss-gh/winfsp/issues/206","id":444625867,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NDYyNTg2Nw==","user":{"login":"alfaunits","id":42452677,"node_id":"MDQ6VXNlcjQyNDUyNjc3","avatar_url":"https://avatars0.githubusercontent.com/u/42452677?v=4","gravatar_id":"","url":"https://api.github.com/users/alfaunits","html_url":"https://github.com/alfaunits","followers_url":"https://api.github.com/users/alfaunits/followers","following_url":"https://api.github.com/users/alfaunits/following{/other_user}","gists_url":"https://api.github.com/users/alfaunits/gists{/gist_id}","starred_url":"https://api.github.com/users/alfaunits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alfaunits/subscriptions","organizations_url":"https://api.github.com/users/alfaunits/orgs","repos_url":"https://api.github.com/users/alfaunits/repos","events_url":"https://api.github.com/users/alfaunits/events{/privacy}","received_events_url":"https://api.github.com/users/alfaunits/received_events","type":"User","site_admin":false},"created_at":"2018-12-05T20:02:44Z","updated_at":"2018-12-05T20:02:44Z","author_association":"NONE","body":"I am aware of this. However, a close delayed for so long is a symptom\nof a bug, not a feature.\n\nYou will not see this exhibited on NTFS, or with Windows Defender\ndisables (I reckon most other AVs would cause the problem).\n\nI wrote a transpoarent encryption filter, 16 years now (the product is\nstill active). I remember a delayed close always being a cause for\nalarm (as in \"My driver has bug\").\n\nOften it is an interaction issue, especially with those pesky AVs :)\n\n-- \n\n\nKind regards, Dejan.\n"}}
{"actor":{"display_login":"alfaunits"}}