Figuring out why non-paged pool is growing

On my target machine, I’m running my FS filter. While the filter is stable
and the applications accessing the file system are not growing paged or
non-paged pools, the Task Manager shows the Paged pool (as viewed from the
Performance tab) consistently increasing when the filter is exercised.

The filter code does not explicitly allocate any paged pool - I suspect it
may be the result of something that the filter code is doing.

How can I use windbg to verify that my filter is somehow neglecting to free
paged pool?

Brad


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You should be taking any memory that you allocate and you can use POOLTAG
(www.osr.com) to figure out what memory is leaking.

–Mark

Mark J. Cariddi
Consulting Associate
Open Systems Resources, Inc.
http:\www.osr.com
-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Tuesday, January 23, 2001 2:42 PM
To: File Systems Developers
Subject: [ntfsd] Figuring out why non-paged pool is growing

On my target machine, I’m running my FS filter. While the filter is stable
and the applications accessing the file system are not growing paged or
non-paged pools, the Task Manager shows the Paged pool (as viewed from the
Performance tab) consistently increasing when the filter is exercised.

The filter code does not explicitly allocate any paged pool - I suspect it
may be the result of something that the filter code is doing.

How can I use windbg to verify that my filter is somehow neglecting to free
paged pool?

Brad


You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

When I had this problem, I made sure I tagged all pool allocations and then
used OSR’s pool tag facility. This tool will tell you that, for example,
buffer with tag ‘foo’ has been allocated 100 times but only freed 30.

  • jb

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Brad Sahr
Sent: Tuesday, January 23, 2001 1:42 PM
To: File Systems Developers
Subject: [ntfsd] Figuring out why non-paged pool is growing

On my target machine, I’m running my FS filter. While the filter is stable
and the applications accessing the file system are not growing paged or
non-paged pools, the Task Manager shows the Paged pool (as viewed from the
Performance tab) consistently increasing when the filter is exercised.

The filter code does not explicitly allocate any paged pool - I suspect it
may be the result of something that the filter code is doing.

How can I use windbg to verify that my filter is somehow neglecting to free
paged pool?

Brad


You are currently subscribed to ntfsd as: xxxxx@earthlink.net
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You may use Poolmon.exe to identify which pool is growing.

-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Tuesday, January 23, 2001 2:42 PM
To: File Systems Developers
Subject: [ntfsd] Figuring out why non-paged pool is growing

On my target machine, I’m running my FS filter. While the filter is stable
and the applications accessing the file system are not growing paged or
non-paged pools, the Task Manager shows the Paged pool (as viewed from the
Performance tab) consistently increasing when the filter is exercised.

The filter code does not explicitly allocate any paged pool - I suspect it
may be the result of something that the filter code is doing.

How can I use windbg to verify that my filter is somehow neglecting to free
paged pool?

Brad


You are currently subscribed to ntfsd as: xxxxx@otg.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Hi Brad,

You can use ExAllocatePoolWithtag and put a tag on the allocated memory so
that you can use tools such as pooltag(you can download from ww.osr.com) to
monitor if you forgot to free memories.

I don’t think there is a way for WinDbg or softice to tell you memory leak.

Tom

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Brad Sahr
Sent: Tuesday, January 23, 2001 2:42 PM
To: File Systems Developers
Subject: [ntfsd] Figuring out why non-paged pool is growing

On my target machine, I’m running my FS filter. While the
filter is stable
and the applications accessing the file system are not
growing paged or
non-paged pools, the Task Manager shows the Paged pool (as
viewed from the
Performance tab) consistently increasing when the filter is exercised.

The filter code does not explicitly allocate any paged pool -
I suspect it
may be the result of something that the filter code is doing.

How can I use windbg to verify that my filter is somehow
neglecting to free
paged pool?

Brad


You are currently subscribed to ntfsd as:
xxxxx@datacoresoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Since you say you allocate no pool explicity, you probably have some sort of
resource leak. Double check and be sure you are dereferncing every object
you reference, close every handle you open, free every irp you allocate,
etc. If you are openening objects by handle, a good handle viewer, like
osr’s handleex, may help you track down the problem.

-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Tuesday, January 23, 2001 2:42 PM
To: File Systems Developers
Subject: [ntfsd] Figuring out why non-paged pool is growing

On my target machine, I’m running my FS filter. While the filter is stable
and the applications accessing the file system are not growing paged or
non-paged pools, the Task Manager shows the Paged pool (as viewed from the
Performance tab) consistently increasing when the filter is exercised.

The filter code does not explicitly allocate any paged pool - I suspect it
may be the result of something that the filter code is doing.

How can I use windbg to verify that my filter is somehow neglecting to free
paged pool?

Brad


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

In Windbg/kd, !poolused and !handle. See the released documentation.

-----Original Message-----
From: Tom Chen [mailto:xxxxx@datacoresoftware.com]
Sent: Tuesday, January 23, 2001 12:15 PM
To: File Systems Developers
Subject: [ntfsd] RE: Figuring out why non-paged pool is growing

Hi Brad,

You can use ExAllocatePoolWithtag and put a tag on the allocated memory
so
that you can use tools such as pooltag(you can download from ww.osr.com)
to
monitor if you forgot to free memories.

I don’t think there is a way for WinDbg or softice to tell you memory
leak.

Tom


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Also note PoolTag does not work if you are also running the Driver Verifier.
I imagine if a certain verifier option is turned off it might then work but
I don’t know which one.
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Mark Cariddi
Sent: Tuesday, January 23, 2001 1:57 PM
To: File Systems Developers
Subject: [ntfsd] RE: Figuring out why non-paged pool is growing

You should be taking any memory that you allocate and you can use POOLTAG
(www.osr.com) to figure out what memory is leaking.

–Mark

Mark J. Cariddi
Consulting Associate
Open Systems Resources, Inc.
http:\www.osr.com
-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Tuesday, January 23, 2001 2:42 PM
To: File Systems Developers
Subject: [ntfsd] Figuring out why non-paged pool is growing

On my target machine, I’m running my FS filter. While the filter is stable
and the applications accessing the file system are not growing paged or
non-paged pools, the Task Manager shows the Paged pool (as viewed from the
Performance tab) consistently increasing when the filter is exercised.

The filter code does not explicitly allocate any paged pool - I suspect it
may be the result of something that the filter code is doing.

How can I use windbg to verify that my filter is somehow neglecting to free
paged pool?

Brad


You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

I am running the driver verifier. The strange thing is that pooltag
displayed -some- of my non-paged pool allocations (not currently doing any
paged allocations), but not all.

Thank you everyone for the great information about using pooltag, pooltag’s
interactions with the driver verifier, and how to get !poolused and !handle
from within windbg (haven’t tried this one yet, though).

Brad

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Ken Galipeau
Sent: Tuesday, January 23, 2001 4:46 PM
To: File Systems Developers
Subject: [ntfsd] RE: Figuring out why non-paged pool is growing

Also note PoolTag does not work if you are also running the
Driver Verifier.
I imagine if a certain verifier option is turned off it might
then work but
I don’t know which one.
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Mark Cariddi
Sent: Tuesday, January 23, 2001 1:57 PM
To: File Systems Developers
Subject: [ntfsd] RE: Figuring out why non-paged pool is growing

You should be taking any memory that you allocate and you can use POOLTAG
(www.osr.com) to figure out what memory is leaking.

–Mark

Mark J. Cariddi
Consulting Associate
Open Systems Resources, Inc.
http:\www.osr.com>
-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Tuesday, January 23, 2001 2:42 PM
To: File Systems Developers
Subject: [ntfsd] Figuring out why non-paged pool is growing

On my target machine, I’m running my FS filter. While the filter is stable
and the applications accessing the file system are not growing paged or
non-paged pools, the Task Manager shows the Paged pool (as viewed from the
Performance tab) consistently increasing when the filter is exercised.

The filter code does not explicitly allocate any paged pool - I suspect it
may be the result of something that the filter code is doing.

How can I use windbg to verify that my filter is somehow
neglecting to free
paged pool?

Brad


You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@macromedia.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

> How can I use windbg to verify that my filter is somehow neglecting to
free

paged pool?

!poolused

Do the tracking of what kind of allocations are leaking.

Max


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

After running my filter driver overnight with stress tests, Pooltag reports
an interesting entry:

Pool Tag: Se
Memory: PAGed
#Allocs: 2,629,902
#Frees: 22,587
Delta Alloc-Free: 2,607,315
Bytes Used: 166,868,160

Anyone know what Module is using the pool tag of Se ('Se’curity)? Is there a
general way to determine which modules are using which pool tags (i.e. CM =
Cache Manager)? I suspect that finding out what this module is will help me
to determine what my filter is doing to cause this.

Brad

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Brad Sahr
Sent: Wednesday, January 24, 2001 8:11 AM
To: File Systems Developers
Subject: [ntfsd] RE: Figuring out why non-paged pool is growing

I am running the driver verifier. The strange thing is that pooltag
displayed -some- of my non-paged pool allocations (not currently doing any
paged allocations), but not all.

Thank you everyone for the great information about using pooltag,
pooltag’s
interactions with the driver verifier, and how to get !poolused
and !handle
from within windbg (haven’t tried this one yet, though).

Brad

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Ken Galipeau
> Sent: Tuesday, January 23, 2001 4:46 PM
> To: File Systems Developers
> Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
>
>
> Also note PoolTag does not work if you are also running the
> Driver Verifier.
> I imagine if a certain verifier option is turned off it might
> then work but
> I don’t know which one.
> Ken
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Mark Cariddi
> Sent: Tuesday, January 23, 2001 1:57 PM
> To: File Systems Developers
> Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
>
>
> You should be taking any memory that you allocate and you can
use POOLTAG
> (www.osr.com) to figure out what memory is leaking.
>
> --Mark
>
> Mark J. Cariddi
> Consulting Associate
> Open Systems Resources, Inc.
> http:\www.osr.com\
>
> -----Original Message-----
> From: Brad Sahr [mailto:xxxxx@macromedia.com]
> Sent: Tuesday, January 23, 2001 2:42 PM
> To: File Systems Developers
> Subject: [ntfsd] Figuring out why non-paged pool is growing
>
>
> On my target machine, I’m running my FS filter. While the
filter is stable
> and the applications accessing the file system are not growing paged or
> non-paged pools, the Task Manager shows the Paged pool (as
viewed from the
> Performance tab) consistently increasing when the filter is exercised.
>
> The filter code does not explicitly allocate any paged pool - I
suspect it
> may be the result of something that the filter code is doing.
>
> How can I use windbg to verify that my filter is somehow
> neglecting to free
> paged pool?
>
> Brad
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@legato.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@macromedia.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>


You are currently subscribed to ntfsd as: xxxxx@macromedia.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

I’ve determined that the pooltag “CM” is for “Configuration Manager.” The
amount of pool bytes allocated with this tag varies directly with the size
of the file “C:\winnt\system32\config\software,” which stores the “Software”
hive of your registry. This is why W2K installations with large registries
exhibit large amounts of paged pool consumption, such as 50 MB or more.

Security is a pretty good guess for “Se,” since the names of all the
security routines start with that prefix, and there are other tags that use
this same pattern. Also, notice that some tags use the beginning of their
driver names. A knowledge base article documenting the meaning of common
pooltags would be very useful.

-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Thursday, January 25, 2001 9:56 AM
To: File Systems Developers
Subject: [ntfsd] RE: Figuring out why non-paged pool is growing

After running my filter driver overnight with stress tests,
Pooltag reports
an interesting entry:

Pool Tag: Se
Memory: PAGed
#Allocs: 2,629,902
#Frees: 22,587
Delta Alloc-Free: 2,607,315
Bytes Used: 166,868,160

Anyone know what Module is using the pool tag of Se
('Se’curity)? Is there a
general way to determine which modules are using which pool
tags (i.e. CM =
Cache Manager)? I suspect that finding out what this module
is will help me
to determine what my filter is doing to cause this.

Brad

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Brad Sahr
> Sent: Wednesday, January 24, 2001 8:11 AM
> To: File Systems Developers
> Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
>
>
> I am running the driver verifier. The strange thing is that pooltag
> displayed -some- of my non-paged pool allocations (not
currently doing any
> paged allocations), but not all.
>
> Thank you everyone for the great information about using pooltag,
> pooltag’s
> interactions with the driver verifier, and how to get !poolused
> and !handle
> from within windbg (haven’t tried this one yet, though).
>
> Brad
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Ken Galipeau
> > Sent: Tuesday, January 23, 2001 4:46 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
> >
> >
> > Also note PoolTag does not work if you are also running the
> > Driver Verifier.
> > I imagine if a certain verifier option is turned off it might
> > then work but
> > I don’t know which one.
> > Ken
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Mark Cariddi
> > Sent: Tuesday, January 23, 2001 1:57 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
> >
> >
> > You should be taking any memory that you allocate and you can
> use POOLTAG
> > (www.osr.com) to figure out what memory is leaking.
> >
> > --Mark
> >
> > Mark J. Cariddi
> > Consulting Associate
> > Open Systems Resources, Inc.
> > http:\www.osr.com\
> >
> > -----Original Message-----
> > From: Brad Sahr [mailto:xxxxx@macromedia.com]
> > Sent: Tuesday, January 23, 2001 2:42 PM
> > To: File Systems Developers
> > Subject: [ntfsd] Figuring out why non-paged pool is growing
> >
> >
> > On my target machine, I’m running my FS filter. While the
> filter is stable
> > and the applications accessing the file system are not
growing paged or
> > non-paged pools, the Task Manager shows the Paged pool (as
> viewed from the
> > Performance tab) consistently increasing when the filter
is exercised.
> >
> > The filter code does not explicitly allocate any paged pool - I
> suspect it
> > may be the result of something that the filter code is doing.
> >
> > How can I use windbg to verify that my filter is somehow
> > neglecting to free
> > paged pool?
> >
> > Brad
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@osr.com
> > To unsubscribe send a blank email to
leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@legato.com
> > To unsubscribe send a blank email to
leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@macromedia.com
> > To unsubscribe send a blank email to
leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@macromedia.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>


You are currently subscribed to ntfsd as: xxxxx@nsisw.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

I figured out why the pool tag is growing - SeQueryInformationToken returns
a pointer to a buffer, and the caller must free the buffer. DDK doco doesn’t
really say this, but the function does return a pointer to a buffer so I
should assume that memory was allocated.

I’d still like to know if there is a general way to determine which
components are using which pool tags.

Brad

-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Thursday, January 25, 2001 8:56 AM
To: File Systems Developers
Subject: RE: [ntfsd] RE: Figuring out why non-paged pool is growing

After running my filter driver overnight with stress tests,
Pooltag reports an interesting entry:

Pool Tag: Se
Memory: PAGed
#Allocs: 2,629,902
#Frees: 22,587
Delta Alloc-Free: 2,607,315
Bytes Used: 166,868,160

Anyone know what Module is using the pool tag of Se ('Se’curity)?
Is there a general way to determine which modules are using which
pool tags (i.e. CM = Cache Manager)? I suspect that finding out
what this module is will help me to determine what my filter is
doing to cause this.

Brad

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Brad Sahr
> Sent: Wednesday, January 24, 2001 8:11 AM
> To: File Systems Developers
> Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
>
>
> I am running the driver verifier. The strange thing is that pooltag
> displayed -some- of my non-paged pool allocations (not
currently doing any
> paged allocations), but not all.
>
> Thank you everyone for the great information about using pooltag,
> pooltag’s
> interactions with the driver verifier, and how to get !poolused
> and !handle
> from within windbg (haven’t tried this one yet, though).
>
> Brad
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Ken Galipeau
> > Sent: Tuesday, January 23, 2001 4:46 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
> >
> >
> > Also note PoolTag does not work if you are also running the
> > Driver Verifier.
> > I imagine if a certain verifier option is turned off it might
> > then work but
> > I don’t know which one.
> > Ken
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Mark Cariddi
> > Sent: Tuesday, January 23, 2001 1:57 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
> >
> >
> > You should be taking any memory that you allocate and you can
> use POOLTAG
> > (www.osr.com) to figure out what memory is leaking.
> >
> > --Mark
> >
> > Mark J. Cariddi
> > Consulting Associate
> > Open Systems Resources, Inc.
> > http:\www.osr.com\
> >
> > -----Original Message-----
> > From: Brad Sahr [mailto:xxxxx@macromedia.com]
> > Sent: Tuesday, January 23, 2001 2:42 PM
> > To: File Systems Developers
> > Subject: [ntfsd] Figuring out why non-paged pool is growing
> >
> >
> > On my target machine, I’m running my FS filter. While the
> filter is stable
> > and the applications accessing the file system are not
growing paged or
> > non-paged pools, the Task Manager shows the Paged pool (as
> viewed from the
> > Performance tab) consistently increasing when the filter is exercised.
> >
> > The filter code does not explicitly allocate any paged pool - I
> suspect it
> > may be the result of something that the filter code is doing.
> >
> > How can I use windbg to verify that my filter is somehow
> > neglecting to free
> > paged pool?
> >
> > Brad


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

I once tried setting a breakpoint in the disassembly of
ExAllocatePoolWithTag. You can see the pooltag sitting on the stack. The
idea was to look for the tag in question and look at the callstack for a
good indication of where the allocation is coming from. The problem was I
couldn’t figure out how to configure a ‘conditional’ break point such that
the breakpoint would be triggered if some the value at some memory addresses
(offset from [esp]) were a certain value (i.e the value of the pooltag).
Maybe this can’t be done?

-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Thursday, January 25, 2001 10:54 AM
To: File Systems Developers
Subject: [ntfsd] RE: Figuring out why non-paged pool is growing

I figured out why the pool tag is growing - SeQueryInformationToken returns
a pointer to a buffer, and the caller must free the buffer. DDK doco doesn’t
really say this, but the function does return a pointer to a buffer so I
should assume that memory was allocated.

I’d still like to know if there is a general way to determine which
components are using which pool tags.

Brad

-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Thursday, January 25, 2001 8:56 AM
To: File Systems Developers
Subject: RE: [ntfsd] RE: Figuring out why non-paged pool is growing

After running my filter driver overnight with stress tests,
Pooltag reports an interesting entry:

Pool Tag: Se
Memory: PAGed
#Allocs: 2,629,902
#Frees: 22,587
Delta Alloc-Free: 2,607,315
Bytes Used: 166,868,160

Anyone know what Module is using the pool tag of Se ('Se’curity)?
Is there a general way to determine which modules are using which
pool tags (i.e. CM = Cache Manager)? I suspect that finding out
what this module is will help me to determine what my filter is
doing to cause this.

Brad

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Brad Sahr
> Sent: Wednesday, January 24, 2001 8:11 AM
> To: File Systems Developers
> Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
>
>
> I am running the driver verifier. The strange thing is that pooltag
> displayed -some- of my non-paged pool allocations (not
currently doing any
> paged allocations), but not all.
>
> Thank you everyone for the great information about using pooltag,
> pooltag’s
> interactions with the driver verifier, and how to get !poolused
> and !handle
> from within windbg (haven’t tried this one yet, though).
>
> Brad
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Ken Galipeau
> > Sent: Tuesday, January 23, 2001 4:46 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
> >
> >
> > Also note PoolTag does not work if you are also running the
> > Driver Verifier.
> > I imagine if a certain verifier option is turned off it might
> > then work but
> > I don’t know which one.
> > Ken
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Mark Cariddi
> > Sent: Tuesday, January 23, 2001 1:57 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
> >
> >
> > You should be taking any memory that you allocate and you can
> use POOLTAG
> > (www.osr.com) to figure out what memory is leaking.
> >
> > --Mark
> >
> > Mark J. Cariddi
> > Consulting Associate
> > Open Systems Resources, Inc.
> > http:\www.osr.com\
> >
> > -----Original Message-----
> > From: Brad Sahr [mailto:xxxxx@macromedia.com]
> > Sent: Tuesday, January 23, 2001 2:42 PM
> > To: File Systems Developers
> > Subject: [ntfsd] Figuring out why non-paged pool is growing
> >
> >
> > On my target machine, I’m running my FS filter. While the
> filter is stable
> > and the applications accessing the file system are not
growing paged or
> > non-paged pools, the Task Manager shows the Paged pool (as
> viewed from the
> > Performance tab) consistently increasing when the filter is exercised.
> >
> > The filter code does not explicitly allocate any paged pool - I
> suspect it
> > may be the result of something that the filter code is doing.
> >
> > How can I use windbg to verify that my filter is somehow
> > neglecting to free
> > paged pool?
> >
> > Brad


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

> Anyone know what Module is using the pool tag of Se ('Se’curity)? Is there
a

general way to determine which modules are using which pool tags (i.e. CM
=

Yes, Se is security. Check your access states, token objects and security
descriptors.

Max


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Look at the documentation for the “j” command in the kernel debugger. It
gives you conditional-anything.

-----Original Message-----
From: Smith, Joel [mailto:xxxxx@ntpsoftware.com]
Sent: Thursday, January 25, 2001 8:34 AM
To: File Systems Developers
Subject: [ntfsd] RE: Figuring out why non-paged pool is growing

I once tried setting a breakpoint in the disassembly of
ExAllocatePoolWithTag. You can see the pooltag sitting on the stack.
The idea was to look for the tag in question and look at the callstack
for a good indication of where the allocation is coming from. The
problem was I couldn’t figure out how to configure a ‘conditional’ break
point such that the breakpoint would be triggered if some the value at
some memory addresses (offset from [esp]) were a certain value (i.e the
value of the pooltag). Maybe this can’t be done?

-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Thursday, January 25, 2001 10:54 AM
To: File Systems Developers
Subject: [ntfsd] RE: Figuring out why non-paged pool is growing

I figured out why the pool tag is growing - SeQueryInformationToken
returns
a pointer to a buffer, and the caller must free the buffer. DDK doco
doesn’t
really say this, but the function does return a pointer to a buffer so I

should assume that memory was allocated.

I’d still like to know if there is a general way to determine which
components are using which pool tags.

Brad

-----Original Message-----
From: Brad Sahr [mailto:xxxxx@macromedia.com]
Sent: Thursday, January 25, 2001 8:56 AM
To: File Systems Developers
Subject: RE: [ntfsd] RE: Figuring out why non-paged pool is growing

After running my filter driver overnight with stress tests,
Pooltag reports an interesting entry:

Pool Tag: Se
Memory: PAGed
#Allocs: 2,629,902
#Frees: 22,587
Delta Alloc-Free: 2,607,315
Bytes Used: 166,868,160

Anyone know what Module is using the pool tag of Se ('Se’curity)?
Is there a general way to determine which modules are using which
pool tags (i.e. CM = Cache Manager)? I suspect that finding out
what this module is will help me to determine what my filter is
doing to cause this.

Brad

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Brad Sahr
> Sent: Wednesday, January 24, 2001 8:11 AM
> To: File Systems Developers
> Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
>
>
> I am running the driver verifier. The strange thing is that pooltag
> displayed -some- of my non-paged pool allocations (not
currently doing any
> paged allocations), but not all.
>
> Thank you everyone for the great information about using pooltag,
> pooltag’s
> interactions with the driver verifier, and how to get !poolused
> and !handle
> from within windbg (haven’t tried this one yet, though).
>
> Brad
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Ken Galipeau

> > Sent: Tuesday, January 23, 2001 4:46 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
> >
> >
> > Also note PoolTag does not work if you are also running the
> > Driver Verifier.
> > I imagine if a certain verifier option is turned off it might
> > then work but
> > I don’t know which one.
> > Ken
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Mark Cariddi

> > Sent: Tuesday, January 23, 2001 1:57 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
> >
> >
> > You should be taking any memory that you allocate and you can
> use POOLTAG
> > (www.osr.com) to figure out what memory is leaking.
> >
> > --Mark
> >
> > Mark J. Cariddi
> > Consulting Associate
> > Open Systems Resources, Inc.
> > http:\www.osr.com\
> >
> > -----Original Message-----
> > From: Brad Sahr [mailto:xxxxx@macromedia.com]
> > Sent: Tuesday, January 23, 2001 2:42 PM
> > To: File Systems Developers
> > Subject: [ntfsd] Figuring out why non-paged pool is growing
> >
> >
> > On my target machine, I’m running my FS filter. While the
> filter is stable
> > and the applications accessing the file system are not
growing paged or
> > non-paged pools, the Task Manager shows the Paged pool (as
> viewed from the
> > Performance tab) consistently increasing when the filter is
exercised.
> >
> > The filter code does not explicitly allocate any paged pool - I
> suspect it
> > may be the result of something that the filter code is doing.
> >
> > How can I use windbg to verify that my filter is somehow
> > neglecting to free
> > paged pool?
> >
> > Brad


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@exchange.microsoft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Hello,

we are using softice as our favourite debugger.

To find the module for the Pooltag <0x53466553> set the following

breakpoint:

BPX ntoskrnl!ExAllocatePoolWithTag if (esp->c == 0x53466553) do
“Process”

or

BPX ntoskrnl!ExAllocatePoolWithTag if (esp->c == ‘SeFS’) do “Process”

and you will see the Process which allocates this Pool.

Hope this helps

Ecki

>
>
> I once tried setting a breakpoint in the disassembly of
> ExAllocatePoolWithTag. You can see the pooltag sitting on the stack.
> The idea was to look for the tag in question and look at the callstack
> for a good indication of where the allocation is coming from. The
> problem was I couldn’t figure out how to configure a ‘conditional’
> break point such that the breakpoint would be triggered if some the
> value at some memory addresses (offset from [esp]) were a certain
> value (i.e the value of the pooltag). Maybe this can’t be done?
>
> -----Original Message-----
> From: Brad Sahr [mailto:xxxxx@macromedia.com]
> Sent: Thursday, January 25, 2001 10:54 AM
> To: File Systems Developers
> Subject: [ntfsd] RE: Figuring out why non-paged pool is growing
>
> I figured out why the pool tag is growing - SeQueryInformationToken
> returns
> a pointer to a buffer, and the caller must free the buffer. DDK doco
> doesn’t
> really say this, but the function does return a pointer to a buffer so
> I
> should assume that memory was allocated.
>
> I’d still like to know if there is a general way to determine which
> components are using which pool tags.
>
> Brad


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com