Why is OnCloseFile event fired long after the file is actually closed?

When monitoring file operations, you may notice that a certain file was closed by a process, yet your filesystem doesn't receive the OnCloseFile event for a long time (minutes or even hours!). How can this happen?

The problem has roots in how the OS works. After all handles to a file are closed, the OS keeps the file itself open for quite some time (which can be hours) to speed up the subsequent opening of the file. Another possible cause of the delayed file closing is memory-mapped files: a process can open a file handle, map the file into memory, close the handle, and continue to use the mapping. In this scenario, the file will remain open, although all of the handles have been closed.

CBFS Connect has limited control over the file's lifetime. To help developers overcome this OS behavior, we have introduced the ForceFileClose configuration setting that tells the driver to attempt to close files several seconds after the last handle is closed. The driver will ask the OS to release the resources and close the file. If the file is in use or for another reason, the OS may ignore the request. But usually, setting the ForceFileClose configuration setting to true helps with receiving OnCloseFile events earlier. For instance:

There’s also exists the ReleaseUnusedFiles method that does the same as the configuration setting but upon request.