Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Occasional StartService failed with 1058
I wrote a file system minifilter that has been run as a service on 10-15 machines for the past several weeks. The machines run constant, long automated regression tests, which install our software (including installing and starting the minifilter), run a regression test, then stop/uninstall the minifilter, then do it all over again for the next test.
On a few occasions, this error has been seen: "StartService failed with 1058: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." The offending machine had to be rebooted before it would successfully run the regression tests again. When this error occurred, the machine was in the middle of some regression tests (i.e. it ran test1 - test19 successfully and was starting test20 out of 30).
I have searched extensively online and cannot find any info on when Windows sets the start type of a service to disabled (only info on manually setting services to disabled).
Would this happen if the minifilter driver service crashed? There were no records of any errors or problems in the Event Log. If a device driver fails for some reason, shouldn't there be a record in the Event Log? If not, is there anywhere to look for such info? There was no crash dump file.
Alternatively, does Windows set the start type to disabled when the service is "marked for deletion" (but not actually deleted)? If so, I am also unclear on how the service could have been marked for deletion, since there should have only been a single handle to it (no services.msc open and only one test running at a time).
Could there be some kind of timing issue with many install/start <-> stop/uninstall service cycles? These cycles happen hundreds of times a day, every day, for weeks on many machines, and this error has only been seen a handful of times.
Any insight into how a running service could become disabled would be appreciated.
Thanks,
--Tim
On a few occasions, this error has been seen: "StartService failed with 1058: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." The offending machine had to be rebooted before it would successfully run the regression tests again. When this error occurred, the machine was in the middle of some regression tests (i.e. it ran test1 - test19 successfully and was starting test20 out of 30).
I have searched extensively online and cannot find any info on when Windows sets the start type of a service to disabled (only info on manually setting services to disabled).
Would this happen if the minifilter driver service crashed? There were no records of any errors or problems in the Event Log. If a device driver fails for some reason, shouldn't there be a record in the Event Log? If not, is there anywhere to look for such info? There was no crash dump file.
Alternatively, does Windows set the start type to disabled when the service is "marked for deletion" (but not actually deleted)? If so, I am also unclear on how the service could have been marked for deletion, since there should have only been a single handle to it (no services.msc open and only one test running at a time).
Could there be some kind of timing issue with many install/start <-> stop/uninstall service cycles? These cycles happen hundreds of times a day, every day, for weeks on many machines, and this error has only been seen a handful of times.
Any insight into how a running service could become disabled would be appreciated.
Thanks,
--Tim
Howdy, Stranger!
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Kernel Debugging | 16-20 October 2023 | Live, Online |
| Developing Minifilters | 13-17 November 2023 | Live, Online |
| Internals & Software Drivers | 4-8 Dec 2023 | Live, Online |
| Writing WDF Drivers | 10-14 July 2023 | Live, Online |
Comments
Also, the 'service' in question is actually your driver, correct?
mm
- S
-----Original Message-----
From: [email protected] <[email protected]>
Sent: Friday, September 11, 2009 14:49
To: Windows File Systems Devs Interest List <[email protected]>
Subject: [ntfsd] Occasional StartService failed with 1058
I wrote a file system minifilter that has been run as a service on 10-15 machines for the past several weeks. The machines run constant, long automated regression tests, which install our software (including installing and starting the minifilter), run a regression test, then stop/uninstall the minifilter, then do it all over again for the next test.
On a few occasions, this error has been seen: "StartService failed with 1058: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." The offending machine had to be rebooted before it would successfully run the regression tests again. When this error occurred, the machine was in the middle of some regression tests (i.e. it ran test1 - test19 successfully and was starting test20 out of 30).
I have searched extensively online and cannot find any info on when Windows sets the start type of a service to disabled (only info on manually setting services to disabled).
Would this happen if the minifilter driver service crashed? There were no records of any errors or problems in the Event Log. If a device driver fails for some reason, shouldn't there be a record in the Event Log? If not, is there anywhere to look for such info? There was no crash dump file.
Alternatively, does Windows set the start type to disabled when the service is "marked for deletion" (but not actually deleted)? If so, I am also unclear on how the service could have been marked for deletion, since there should have only been a single handle to it (no services.msc open and only one test running at a time).
Could there be some kind of timing issue with many install/start <-> stop/uninstall service cycles? These cycles happen hundreds of times a day, every day, for weeks on many machines, and this error has only been seen a handful of times.
Any insight into how a running service could become disabled would be appreciated.
Thanks,
--Tim
---
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
call IoDeleteDevice in the unload routine. Maybe you are keeping a reference
on a device object somewhere which causes your driver to be marked as
'delete pending'.
//Daniel
<[email protected]> wrote in message news:xxxxx@ntfsd...
> I wrote a file system minifilter that has been run as a service on 10-15
> machines for the past several weeks. The machines run constant, long
> automated regression tests, which install our software (including
> installing and starting the minifilter), run a regression test, then
> stop/uninstall the minifilter, then do it all over again for the next
> test.
>
> On a few occasions, this error has been seen: "StartService failed with
> 1058: The service cannot be started, either because it is disabled or
> because it has no enabled devices associated with it." The offending
> machine had to be rebooted before it would successfully run the regression
> tests again. When this error occurred, the machine was in the middle of
> some regression tests (i.e. it ran test1 - test19 successfully and was
> starting test20 out of 30).
>
> I have searched extensively online and cannot find any info on when
> Windows sets the start type of a service to disabled (only info on
> manually setting services to disabled).
>
> Would this happen if the minifilter driver service crashed? There were no
> records of any errors or problems in the Event Log. If a device driver
> fails for some reason, shouldn't there be a record in the Event Log? If
> not, is there anywhere to look for such info? There was no crash dump
> file.
>
> Alternatively, does Windows set the start type to disabled when the
> service is "marked for deletion" (but not actually deleted)? If so, I am
> also unclear on how the service could have been marked for deletion, since
> there should have only been a single handle to it (no services.msc open
> and only one test running at a time).
>
> Could there be some kind of timing issue with many install/start <->
> stop/uninstall service cycles? These cycles happen hundreds of times a
> day, every day, for weeks on many machines, and this error has only been
> seen a handful of times.
>
> Any insight into how a running service could become disabled would be
> appreciated.
>
> Thanks,
>
> --Tim
>
>
My guess is that you are right - the process is being marked for deletion (and therefore the start type is set to disabled). I don't do any IoCreate calls, but I suspect that somehow there was another handle to the driver, and therefore instead of being deleted, it got 'marked for deletion'.
Thanks,
--Tim
I have solved my issue by making sure the startup type is not disabled.