[BUG] LogMonitor keeps executing CreateFile Operations for deleted files, skyrocketing the cost of running this in AKS + Azure File Shares

[israelvaldez]

Describe the bug
After a file is deleted on a folder monitored by LogMonitor.exe, it keeps on getting attempted to be used by it unless the LogMonitor.exe process is stopped.
This causes a lot of reads if you delete files that you no longer need, like for example you're looking to only keep log files older than a month in storage.

To Reproduce

1. Create a container that has the following LogMonitor.exe configuration:

{
    "LogConfig": {
        "sources": [
            {
                "directory": "C:\\my\\folder\\appserverlogs",
                "filter": "*.txt",
                "includeFileNames": true,
                "includeSubdirectories": true,
                "type": "File"
            }
        ]
    }
}

2. Add multiple files into that folder
3. Delete some of the files in that folder
4. Open procmon.exe and monitor for the deleted files, you'll get the following entries, which would result in Cloud providers, like for example Azure, charge the customer with additional writes for every attempt of the deleted files to be read via a CreateFile Operation
5. 

Expected behavior
Deleted files from the monitored locations should stop being monitored if they no longer exist.

Screenshots
Screenshot provided of procmon.exe, a memory dump and a procmon.exe PML file are available to be sent to your team for analysis

Configuration
-Tool: Log Monitor
-Version: 2.0.0.0 or 2.0.0._LM_BUILDMIINNOVERSION

Additional context
NA

[israelvaldez]

In addition to files specified in the filter, files that are not part of the filter are also being constantly running into CreateFile events.

[bobsira]

Israel (@israelvaldez) thanks for bringing this to our attention. I'll give it a look and get back.