EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Event viewer error

Posted: 02/23/2015 08:59:56
by Gianandrea Terzi (Standard support level)
Joined: 11/13/2014
Posts: 9

Hi there,
on one of the machines where cbfs is deployed, I've noticed that sometimes I get an event viewer error entry under 'application'. The error text just says '5' and nothing more. My cbfs based application runs without problems.
Below you see the entry XML data:

     <Provider Name="cbfs5" />
     <EventID Qualifiers="0">1</EventID>
     <TimeCreated SystemTime="2015-02-23T14:08:30.000000000Z" />
     <Security />
Posted: 02/23/2015 09:38:34
by Eugene Mayevski (Team)

That is ok. This is kind of diagnostics information.

Since the latest build this information is not save to the event log by default anymore.

Sincerely yours
Eugene Mayevski
Posted: 02/23/2015 09:40:19
by Gianandrea Terzi (Standard support level)
Joined: 11/13/2014
Posts: 9

Is there a way to disable that by code or should I upgrade to latest build?
Posted: 02/23/2015 10:11:17
by Eugene Mayevski (Team)

Update is the only way to get rid of those records.

Sincerely yours
Eugene Mayevski
Posted: 03/25/2015 05:34:47
by Gianandrea Terzi (Standard support level)
Joined: 11/13/2014
Posts: 9

Sorry to bump up again this thread but it seems that on some OS every time that event viewr entry happens the disk gets dismounted (not by my app).
Any way I can check what is happening?
Posted: 03/25/2015 05:48:11
by Eugene Mayevski (Team)

Are you saying that the disk is mysteriously gone due to some external factor?

Sincerely yours
Eugene Mayevski
Posted: 03/25/2015 06:03:56
by Gianandrea Terzi (Standard support level)
Joined: 11/13/2014
Posts: 9

No, of course. The test app runs in a command shell for debugging purposes.

This is what happens:

- Disk is mounted successfully and becomes visible in explorer
- Another application starts writing on the disk. Every time something is written to the disk, I've a console log entry
- At some point, without any error on my side, the disk becomes unaccessibile. It is still visible, but without 'Total Size' and 'Free Space'. If I click on it, I'm asked if I want to format it.
- the writing application hangs. More strangely...it dos not stop writing, as I still get the write logs on the console.

I'm using version v.5.1.156
Posted: 03/25/2015 06:21:20
by Eugene Mayevski (Team)

If you have a test application that you run, it would be great if you could post it to HelpDesk together with instructions of how to reproduce the issue. Then we'll be able to run it locally and see what's going on inside.

Sincerely yours
Eugene Mayevski
Posted: 03/25/2015 07:41:06
by Volodymyr Zinin (Team)

Perhaps your application that contains CBFS callbacks does something wrong. Try to kill it and it should "unhang" the writing application.
Also you can try to use Process Monitor from sysinternals.com to see what happens on the file system driver level. Most of the requests there are easy to correspond with the CBFS callbacks. In order to minimize quantity of logs set there some filter rules (for example "Path"->"begins with"->"X:", where "X:" is a drive letter for your virtual disk). Look in the logs requests that are finished with error. Especially those requests that were processed right before the problem happened.

Posted: 03/25/2015 09:12:34
by Gianandrea Terzi (Standard support level)
Joined: 11/13/2014
Posts: 9

I've tried copying multiple files from different sources simultaneously but no problem at all. I've used again the app mentioned earlier and I get again the problem so maybe is a matter of how this app writes data to my disk? (it's a c++ tool using VMWare VDDK to read a VM data).
I think we're going in the right direction with the process monitor. About when the disk starts to give me that behaviour, I've multiple entries like this:

15.00.34,4918574   vmware_bck.exe   31440   FileSystemControl   W:\server   INVALID DEVICE REQUEST   Control: FSCTL_GET_REPARSE_POINT

Followed by multiple like this:
15.00.34,6361039   vmware_bck.exe   31440   QueryAllInformationFile   W:\server\serverdisk.local.vmdk   BUFFER OVERFLOW   CreationTime: 25/03/2015 15.00.34, LastAccessTime: 25/03/2015 15.00.34, LastWriteTime: 25/03/2015 15.00.34, ChangeTime: 25/03/2015 15.00.34, FileAttributes: A, AllocationSize: 3.473.408, EndOfFile: 3.473.408, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x118d30, EaSize: 0, Access: Generic Read, Position: 16.384, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Byte

After this, WriteFile and ReadFile operations in process monitor works and data is written but the disk cannot be accessed anymore.



Topic viewed 7219 times

Number of guests: 1, registered members: 0, in total hidden: 0


Back to top

As of July 15, 2016 EldoS business operates as a division of /n software, inc. For more information, please read the announcement.

Got it!