Why ReadDirectoryChangesW, with only FILE_NOTIFY_CHANGE_LAST_WRITE filter, does signal more than one event on file editing?

Question

I am monitoring in separate thread application configuration file, which in some cases may be INI in another XML or another. Code of thread monitoring directory (in Delphi) is something like this:

procedure TWatcherThread.Execute;
type
  PFileNotifyInformation = ^TFileNotifyInformation;
  TFileNotifyInformation = record
    NextEntryOffset: DWORD;
    Action: DWORD;
    FileNameLength: DWORD;
    FileName: WideChar;
  end;
const
  BufferLength = 65536;
var
  Filter, BytesRead: DWORD;
  InfoPointer: PFileNotifyInformation;
  Offset, NextOffset: DWORD;
  Buffer: array[0..BufferLength - 1] of byte;
  Overlap: TOverlapped;
  Events: array[0..1] of THandle;
  WaitResult: DWORD;
  FileName, s: string;
begin
  if fDirHandle <> INVALID_HANDLE_VALUE then begin
    Filter := FILE_NOTIFY_CHANGE_LAST_WRITE;

    FillChar(Overlap, SizeOf(TOverlapped), 0);
    Overlap.hEvent := fChangeHandle;

    Events[0] := fChangeHandle;
    Events[1] := fShutdownHandle;

    while not Terminated do begin
      FillChar(Buffer,SizeOf(Buffer),0);
      if ReadDirectoryChangesW (fDirHandle, @Buffer[0], BufferLength, TRUE,
        Filter, @BytesRead, @Overlap, nil)
      then begin
        WaitResult := WaitForMultipleObjects(2, @Events[0], FALSE, INFINITE);
        if WaitResult = WAIT_OBJECT_0 then begin
          InfoPointer := @Buffer[0];
          Offset := 0;
          repeat
            NextOffset := InfoPointer.NextEntryOffset;
            FileName := WideCharToString(@InfoPointer.FileName);

            if (InfoPointer.Action = FILE_ACTION_MODIFIED) and (CompareText(FileName, 'MyConfig.ini') = 0) then begin //read changes in config or INI file
              // Do Action.. refresh runtime flags
            end;
            PByte(InfoPointer) := PByte(DWORD(InfoPointer) + NextOffset);
            Offset := Offset + NextOffset;
          until NextOffset = 0;
        end;
      end;
    end;
  end;
end;

Why it signals at least 2 times and how to get correct signal when some flag in config file was changed and was saved?

Answer 1

Raymond Chen explained this nicely on his blog: http://blogs.msdn.com/b/oldnewthing/archive/2014/05/07/10523172.aspx

In short "Because multiple things were modified."