Event ID 45

NTDEV
1

My customer is reporting an event ID 45 event log entry. He is insistent that the log entry is from my driver because it is for a custom PCI device and so the driver doesn’t come from uSoft out-of-the-box. He is probably right about this…

He says that his application “disappears”, and then he can go to the event log and, more often than not, see this event.

The log entry text:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 45
Date: 13/03/2006
Time: 14:12:17
User: N/A
Computer: DEXAE17243
Description:
A device driver is leaking locked I/O pages causing system degradation. The system has automatically enabled tracking code in order to try and catch the culprit.

My driver streams data to circular buffers provided by the application at startup, so I probe and lock those buffers in the “set buffer” IOCTL. I unlock the buffers on the "clear buffers IOCTL, and also when the device is closed.

I suspect that his application is throwing an exception and then dying in a most hideous manner. But I have seen, and expect, that Windows automatically sends me a CLOSE IRP. I have run against DriverVerifier and not seen this behavior.

Can anyone explain the event log entry and give me a clue what to try?

Thanks.

john.

John Reilly
Northrop Grumman / Sperry Marine

Sent via the WebMail system at mail.nexet.net

2

So a debugger either on a live system or on a system dump might help
resolve this issue. Better yet - runtime tracing that captures your
driver’s behavior with respect to your customer’s application would be
most helpful in determining the cause of the problem. If you haven’t
instrumented your driver for event tracing (ETW - see the ddk docs)
perhaps now would be the time to do so. That said, I also have to insert
the warning that implementing and using ETW is a major PITA. On the
other hand, once implemented and once the process for using it is
established, it works and it can produce a fairly low cost runtime
trace.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of John Reilly
Sent: Monday, April 03, 2006 8:59 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Event ID 45

My customer is reporting an event ID 45 event log entry. He is
insistent that the log entry is from my driver because it is for a
custom PCI device and so the driver doesn’t come from uSoft
out-of-the-box. He is probably right about this…

He says that his application “disappears”, and then he can go to the
event log and, more often than not, see this event.

The log entry text:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 45
Date: 13/03/2006
Time: 14:12:17
User: N/A
Computer: DEXAE17243
Description:
A device driver is leaking locked I/O pages causing system degradation.
The system has automatically enabled tracking code in order to try and
catch the culprit.

My driver streams data to circular buffers provided by the application
at startup, so I probe and lock those buffers in the “set buffer” IOCTL.
I unlock the buffers on the "clear buffers IOCTL, and also when the
device is closed.

I suspect that his application is throwing an exception and then dying
in a most hideous manner. But I have seen, and expect, that Windows
automatically sends me a CLOSE IRP. I have run against DriverVerifier
and not seen this behavior.

Can anyone explain the event log entry and give me a clue what to try?

Thanks.

john.

John Reilly
Northrop Grumman / Sperry Marine

Sent via the WebMail system at mail.nexet.net

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

I think you need to unlock the buffers when you handle the cleanup IRP,
not the close IRP.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of John Reilly
Sent: Monday, April 03, 2006 5:59 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Event ID 45

My customer is reporting an event ID 45 event log entry. He is
insistent that the log entry is from my driver because it is for a
custom PCI device and so the driver doesn’t come from uSoft
out-of-the-box. He is probably right about this…

He says that his application “disappears”, and then he can go to the
event log and, more often than not, see this event.

The log entry text:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 45
Date: 13/03/2006
Time: 14:12:17
User: N/A
Computer: DEXAE17243
Description:
A device driver is leaking locked I/O pages causing system degradation.
The system has automatically enabled tracking code in order to try and
catch the culprit.

My driver streams data to circular buffers provided by the application
at startup, so I probe and lock those buffers in the “set buffer” IOCTL.
I unlock the buffers on the "clear buffers IOCTL, and also when the
device is closed.

I suspect that his application is throwing an exception and then dying
in a most hideous manner. But I have seen, and expect, that Windows
automatically sends me a CLOSE IRP. I have run against DriverVerifier
and not seen this behavior.

Can anyone explain the event log entry and give me a clue what to try?

Thanks.

john.

John Reilly
Northrop Grumman / Sperry Marine

Sent via the WebMail system at mail.nexet.net

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer