Sequence of create, write, cleanup, write?

NTFSD
1

I have a simple C app that writes to a file via Win32 (CreateFile,
WriteFile, CloseHandle). I’ve been watching it with FileSpy (great tool by
the way!)

Looking at a single FileObject, I see:

IRP_MJ_CREATE
IRP_MJ_WRITE

IRP_MJ_CLEANUP

(a little later)

IRP_MJ_WRITE
IRP_MJ_SET_INFORMATION

…

and that’s the end of what I collected. I assume an IRP_MJ_CLOSE would
arrive sometime.

What I don’t understand is the WRITE and SET_INFORMATION after the CLEANUP.
I thought CLEANUP would come roughly when CloseHandle was called. Since the
CLOSE hasn’t gone by, the memory manager and cache manager could still have
a reference on the FileObject. Am I basically seeing some sort of cached
write happening here?

Thanks

Doug

2

>What I don’t understand is the WRITE and SET_INFORMATION after the CLEANUP.

Cache flush by the lazy writer.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

3

Thanks, that’s kind of what I was thinking.

Does that mean if my app wrote 16KB of data for example, that the initial
IRP_MJ_WRITE might have had some of it, and the second (lazy write) might
have had some? In other words, if I miss the lazy write/cache flush, I’ve
missed some of the file going to disk.

So I really need to wait for the CLOSE and not just the CLEANUP. I’ve read
that the CLOSE can come ‘sometime’ after the CLEANUP. Does anyone have a
sense for how long that might be? On a totally relaxed machine, no memory
pressure or anything, are we talking a minute or two? Could it ever stretch
to hours? (I’d hope not – hopefully the system flushes to disk as soon as
convenient to protect against power failure).

(Naturally the above assumes in this case the file isn’t memory mapped, etc
– just simple file I/O).

Thanks
Doug

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-364061-
xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Friday, April 24, 2009 2:25 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Sequence of create, write, cleanup, write?

>What I don’t understand is the WRITE and SET_INFORMATION after the
CLEANUP.

Cache flush by the lazy writer.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

> pressure or anything, are we talking a minute or two? Could it ever stretch

to hours?

Yes it could. WRITE will come soon, but not CLOSE which can be delayed indefinitely.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

5

Is there any other way to know that a file operation is ‘done’?

> pressure or anything, are we talking a minute or two? Could it ever
stretch
> to hours?

Yes it could. WRITE will come soon, but not CLOSE which can be delayed
indefinitely.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

6

Doug wrote:

Is there any other way to know that a file operation is ‘done’?

The simple answer is, “no, the indication that a file is done is close.”
This is delayed because there is typically no reason not to delay it -
the system is keeping structures around to improve performance of a
second open to the same file. If the system is under memory pressure,
it will start issuing closes more aggressively.

Why does it bother you that closes may take such a long time to occur on
a lightly loaded system?

  • M

–
This posting is provided “AS IS” with no warranties, and confers no rights.