Date Accessed index doesn't work consistently

[helicopter]

It appears that Everything doesn't see changes made to the last access date of a file (for example when i view the file in notepad). The access date changes under windows explorer just fine but Everything doesnt update itself to reflect it. Only a forced rebuild of the indices updates it.

In context, i'm trying to use Everything as a real-time filesystem activity monitor and it is important for me to view all file reads. I'm trying to avoid Procmon due to how disk heavy it is to start and it has a memory leak that slows applications if it runs for too much time.
To add to that, windows 7 is very reluctant to update the last access date to begin with even after "fsutil behavior set disablelastaccess 0". This combined with Everything's lack of realtime updating makes my use case very hard. Any advice is welcome.

[NotNull]

When using NTFS indexing, that info gets updated when your document is closed.
Use Folder Indexing instead.
See this thread for more information: viewtopic.php?f=6&t=6678

Another alternative: look for utilities that can read the NTFS USN Journal (aka Change Journal) in real-time.
I saw one once, but can't remember the details, but Google undoubtedly does.

BTW: I use procmon *a lot* (several times a day) but never noticed memory leakage.
How did you confu=igure History Depth (Menu: Options > History Depth)? If you only use it for real-time monitoring, 1 (million) should be enough.
And don't forget to Menu: Filter > Drop Filtered Events

[helicopter]

Just tried Date Recently Changed with Index Recent Changes and it still doesn't pick up accesses. I don't know what "Folder Indexing" is. I also make sure that i close the file before checking. For "close" i mean closing notepad altogether (i assume it closes the opened file with it), perhaps you have another procedure in mind?
I looked around for USN Journal-related apps and i found interesting things, including surprisingly (or suspiciously) simple source code that i can modify and compile. Writing my own program is quite the last resort tho so i'll stick to whatever apps i can find first.
While i was aware of the history depth setting, i did not know about dropping events, huge thanks for that also.

[NotNull]

Just tried Date Recently Changed with Index Recent Changes and it still doesn't pick up accesses. I don't know what "Folder Indexing" is. I also make sure that i close the file before checking. For "close" i mean closing notepad altogether (i assume it closes the opened file with it), perhaps you have another procedure in mind?
I looked around for USN Journal-related apps and i found interesting things, including surprisingly (or suspiciously) simple source code that i can modify and compile. Writing my own program is quite the last resort tho so i'll stick to whatever apps i can find first.
While i was aware of the history depth setting, i did not know about dropping events, huge thanks for that also.

That Date Recently changed wasn't a good idea (I removed it, but not quick enough for you to pick it up ) Sorry for confusion .. I'm a bit chaotic today :S

You can find Folder Indexing under Menu:tools > OPtions > Indexes > Folders.
Add (for example) C:\ here and check all boxes. That way changes anywhere on your C:-drive will be monitored. Now you will see the same results as you can see in Explorer.
Disadvantage is that you will see files twice: one that was found during NTFS indexing and one found by Folder Indexing. In one of the the threads I mentioned, are ways to deduplicate that.

[void]

Everything will not detect date accessed changes.

The USN Journal does not receive a notification about date accessed changes.

Everything updates the file times when it receives a BASIC_INFO_CHANGE notification in the USN Journal.

Also, ReadDirectoryChanges (for folder indexes) does not receive any notification when the date accessed changes.
Neither does SHChangeNotify.

I've put on my TODO list to research this some more and see if it possible to monitor date accessed.

[helicopter]

Everything will not detect date accessed changes.
The USN Journal does not receive a notification about date accessed changes.
Everything updates the file times when it receives a BASIC_INFO_CHANGE notification in the USN Journal.
Also, ReadDirectoryChanges (for folder indexes) does not receive any notification when the date accessed changes.
Neither does SHChangeNotify.
I've put on my TODO list to research this some more and see if it possible to monitor date accessed.

This surely settles it, thanks alot for the heads up!
Just my two cents, because of how inconsistent i found windows to be when it comes to updating the "date accessed" bit anywhere near realtime, i would advise to rely more on normal file read operations and/or metadata query operations to sort the files instead. yet i have no evidence to support this.

[mczerski]

Everything will not detect date accessed changes.

The USN Journal does not receive a notification about date accessed changes.

Everything updates the file times when it receives a BASIC_INFO_CHANGE notification in the USN Journal.

Also, ReadDirectoryChanges (for folder indexes) does not receive any notification when the date accessed changes.
Neither does SHChangeNotify.

I've put on my TODO list to research this some more and see if it possible to monitor date accessed.

Have you managed to add this "TODO" to ET? If yes, which ET version should I use to enjoy it, how does it work and how is it accessible for the user?

[void]

Everything doesn't have a way to detect date accessed changes in real-time.

I recommend using folder indexing and scheduling an update every minute.
I don't recommend doing this for folders with over 1 million files.

[mczerski]

Thank you for your reply and advise – a little bit tedious, but works anyway.