EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Event viewer error

Also by EldoS: BizCrypto
Components for BizTalk® and SQL Server® Integration Services that let you securely store and transfer information in your business automation solutions.
#32310
Posted: 02/23/2015 08:59:56
by Gianandrea Terzi (Standard support level)
Joined: 11/13/2014
Posts: 9

Hi there,
on one of the machines where cbfs is deployed, I've noticed that sometimes I get an event viewer error entry under 'application'. The error text just says '5' and nothing more. My cbfs based application runs without problems.
Below you see the entry XML data:

Code
<Event>
   <System>
     <Provider Name="cbfs5" />
     <EventID Qualifiers="0">1</EventID>
     <Level>2</Level>
     <Task>0</Task>
     <Keywords>0x80000000000000</Keywords>
     <TimeCreated SystemTime="2015-02-23T14:08:30.000000000Z" />
     <EventRecordID>6814</EventRecordID>
     <Channel>Application</Channel>
     <Computer>dev01</Computer>
     <Security />
  </System>
  <EventData>
   <Data>5</Data>
   <Binary>0008...6300</Binary>
  </EventData>
</Event>
#32314
Posted: 02/23/2015 09:38:34
by Eugene Mayevski (EldoS Corp.)

That is ok. This is kind of diagnostics information.

Since the latest build this information is not save to the event log by default anymore.


Sincerely yours
Eugene Mayevski
#32315
Posted: 02/23/2015 09:40:19
by Gianandrea Terzi (Standard support level)
Joined: 11/13/2014
Posts: 9

Is there a way to disable that by code or should I upgrade to latest build?
#32317
Posted: 02/23/2015 10:11:17
by Eugene Mayevski (EldoS Corp.)

Update is the only way to get rid of those records.


Sincerely yours
Eugene Mayevski
#32749
Posted: 03/25/2015 05:34:47
by Gianandrea Terzi (Standard support level)
Joined: 11/13/2014
Posts: 9

Sorry to bump up again this thread but it seems that on some OS every time that event viewr entry happens the disk gets dismounted (not by my app).
Any way I can check what is happening?
#32750
Posted: 03/25/2015 05:48:11
by Eugene Mayevski (EldoS Corp.)

Are you saying that the disk is mysteriously gone due to some external factor?


Sincerely yours
Eugene Mayevski
#32751
Posted: 03/25/2015 06:03:56
by Gianandrea Terzi (Standard support level)
Joined: 11/13/2014
Posts: 9

No, of course. The test app runs in a command shell for debugging purposes.

This is what happens:

- Disk is mounted successfully and becomes visible in explorer
- Another application starts writing on the disk. Every time something is written to the disk, I've a console log entry
- At some point, without any error on my side, the disk becomes unaccessibile. It is still visible, but without 'Total Size' and 'Free Space'. If I click on it, I'm asked if I want to format it.
- the writing application hangs. More strangely...it dos not stop writing, as I still get the write logs on the console.

I'm using version v.5.1.156
#32752
Posted: 03/25/2015 06:21:20
by Eugene Mayevski (EldoS Corp.)

If you have a test application that you run, it would be great if you could post it to HelpDesk together with instructions of how to reproduce the issue. Then we'll be able to run it locally and see what's going on inside.


Sincerely yours
Eugene Mayevski
#32756
Posted: 03/25/2015 07:41:06
by Volodymyr Zinin (EldoS Corp.)

Perhaps your application that contains CBFS callbacks does something wrong. Try to kill it and it should "unhang" the writing application.
Also you can try to use Process Monitor from sysinternals.com to see what happens on the file system driver level. Most of the requests there are easy to correspond with the CBFS callbacks. In order to minimize quantity of logs set there some filter rules (for example "Path"->"begins with"->"X:", where "X:" is a drive letter for your virtual disk). Look in the logs requests that are finished with error. Especially those requests that were processed right before the problem happened.

Thanks.
#32758
Posted: 03/25/2015 09:12:34
by Gianandrea Terzi (Standard support level)
Joined: 11/13/2014
Posts: 9

I've tried copying multiple files from different sources simultaneously but no problem at all. I've used again the app mentioned earlier and I get again the problem so maybe is a matter of how this app writes data to my disk? (it's a c++ tool using VMWare VDDK to read a VM data).
I think we're going in the right direction with the process monitor. About when the disk starts to give me that behaviour, I've multiple entries like this:

Code
15.00.34,4918574   vmware_bck.exe   31440   FileSystemControl   W:\server   INVALID DEVICE REQUEST   Control: FSCTL_GET_REPARSE_POINT


Followed by multiple like this:
Code
15.00.34,6361039   vmware_bck.exe   31440   QueryAllInformationFile   W:\server\serverdisk.local.vmdk   BUFFER OVERFLOW   CreationTime: 25/03/2015 15.00.34, LastAccessTime: 25/03/2015 15.00.34, LastWriteTime: 25/03/2015 15.00.34, ChangeTime: 25/03/2015 15.00.34, FileAttributes: A, AllocationSize: 3.473.408, EndOfFile: 3.473.408, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x118d30, EaSize: 0, Access: Generic Read, Position: 16.384, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Byte


After this, WriteFile and ReadFile operations in process monitor works and data is written but the disk cannot be accessed anymore.
Also by EldoS: CallbackFilter
A component to monitor and control disk activity, track file and directory operations (create, read, write, rename etc.), alter file data, encrypt files, create virtual files.

Reply

Statistics

Topic viewed 5328 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!