I wrote a file system minifilter that has been run as a service on 10-15 machines for the past several weeks. The machines run constant, long automated regression tests, which install our software (including installing and starting the minifilter), run a regression test, then stop/uninstall the minifilter, then do it all over again for the next test.
On a few occasions, this error has been seen: “StartService failed with 1058: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.” The offending machine had to be rebooted before it would successfully run the regression tests again. When this error occurred, the machine was in the middle of some regression tests (i.e. it ran test1 - test19 successfully and was starting test20 out of 30).
I have searched extensively online and cannot find any info on when Windows sets the start type of a service to disabled (only info on manually setting services to disabled).
Would this happen if the minifilter driver service crashed? There were no records of any errors or problems in the Event Log. If a device driver fails for some reason, shouldn’t there be a record in the Event Log? If not, is there anywhere to look for such info? There was no crash dump file.
Alternatively, does Windows set the start type to disabled when the service is “marked for deletion” (but not actually deleted)? If so, I am also unclear on how the service could have been marked for deletion, since there should have only been a single handle to it (no services.msc open and only one test running at a time).
Could there be some kind of timing issue with many install/start <-> stop/uninstall service cycles? These cycles happen hundreds of times a day, every day, for weeks on many machines, and this error has only been seen a handful of times.
Any insight into how a running service could become disabled would be appreciated.
Yes, I think you’re running into marked for deletion. That results in the service being considered disabled like that the last that I recall.
S
-----Original Message-----
From: xxxxx@grammatech.com Sent: Friday, September 11, 2009 14:49 To: Windows File Systems Devs Interest List Subject: [ntfsd] Occasional StartService failed with 1058
I wrote a file system minifilter that has been run as a service on 10-15 machines for the past several weeks. The machines run constant, long automated regression tests, which install our software (including installing and starting the minifilter), run a regression test, then stop/uninstall the minifilter, then do it all over again for the next test.
On a few occasions, this error has been seen: “StartService failed with 1058: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.” The offending machine had to be rebooted before it would successfully run the regression tests again. When this error occurred, the machine was in the middle of some regression tests (i.e. it ran test1 - test19 successfully and was starting test20 out of 30).
I have searched extensively online and cannot find any info on when Windows sets the start type of a service to disabled (only info on manually setting services to disabled).
Would this happen if the minifilter driver service crashed? There were no records of any errors or problems in the Event Log. If a device driver fails for some reason, shouldn’t there be a record in the Event Log? If not, is there anywhere to look for such info? There was no crash dump file.
Alternatively, does Windows set the start type to disabled when the service is “marked for deletion” (but not actually deleted)? If so, I am also unclear on how the service could have been marked for deletion, since there should have only been a single handle to it (no services.msc open and only one test running at a time).
Could there be some kind of timing issue with many install/start <-> stop/uninstall service cycles? These cycles happen hundreds of times a day, every day, for weeks on many machines, and this error has only been seen a handful of times.
Any insight into how a running service could become disabled would be appreciated.
Thanks,
–Tim
— NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars (including our new fs mini-filter seminar) visit: http://www.osr.com/seminars
I’m getting error 1058 if I call IoCreateDevice in DriverEntry and forget to
call IoDeleteDevice in the unload routine. Maybe you are keeping a reference
on a device object somewhere which causes your driver to be marked as
‘delete pending’.
//Daniel
wrote in message news:xxxxx@ntfsd… > I wrote a file system minifilter that has been run as a service on 10-15 > machines for the past several weeks. The machines run constant, long > automated regression tests, which install our software (including > installing and starting the minifilter), run a regression test, then > stop/uninstall the minifilter, then do it all over again for the next > test. > > On a few occasions, this error has been seen: “StartService failed with > 1058: The service cannot be started, either because it is disabled or > because it has no enabled devices associated with it.” The offending > machine had to be rebooted before it would successfully run the regression > tests again. When this error occurred, the machine was in the middle of > some regression tests (i.e. it ran test1 - test19 successfully and was > starting test20 out of 30). > > I have searched extensively online and cannot find any info on when > Windows sets the start type of a service to disabled (only info on > manually setting services to disabled). > > Would this happen if the minifilter driver service crashed? There were no > records of any errors or problems in the Event Log. If a device driver > fails for some reason, shouldn’t there be a record in the Event Log? If > not, is there anywhere to look for such info? There was no crash dump > file. > > Alternatively, does Windows set the start type to disabled when the > service is “marked for deletion” (but not actually deleted)? If so, I am > also unclear on how the service could have been marked for deletion, since > there should have only been a single handle to it (no services.msc open > and only one test running at a time). > > Could there be some kind of timing issue with many install/start <-> > stop/uninstall service cycles? These cycles happen hundreds of times a > day, every day, for weeks on many machines, and this error has only been > seen a handful of times. > > Any insight into how a running service could become disabled would be > appreciated. > > Thanks, > > --Tim > >
Thanks for your replies. Yes, the service in question is the driver.
My guess is that you are right - the process is being marked for deletion (and therefore the start type is set to disabled). I don’t do any IoCreate calls, but I suspect that somehow there was another handle to the driver, and therefore instead of being deleted, it got ‘marked for deletion’.