Hi All,
I’m in the process of developing a filter driver to monitor file system
activity and my driver works fine on W2K. On XP, however, Windows Explorer
will often hang for 10 mins at a time when expanding a directory or will
not appear for 10 mins when I try to start it. Does anyone have any
suggestions as to what I should look at to fix this?
My driver loads on boot and calls IoRegisterFsRegistrationChange() to get
notified of file system drivers loading. It hooks the file system DOs and
registers a completion routine for
IRP_MJ_FILE_SYSTEM_CONTROL/IRP_MN_MOUNT_VOLUME IRPs, creating a filter
device for each successfully mounted volume. This seems to be the standard
way to do things.
In addition to the file systems, IoRegisterFsRegistrationChange() tells me
about the LanmanRedirector (SMB) and WebDavRedirector, over which I
install filter devices to monitor network file activity. The dispatch
routines for my filter devices do not do anything at the moment other than
print the filename on the debugger for IRP_MJ_CREATE IRPs and calls the
driver below using the normal
IoCopyCurrentIrpStackLocationToNext()/IoCallDriver() mechanism. It
implements all FastI/O dispatch points in a similar way to the
Sysinternals Filemon driver. However, it seems that the problem does not
occur if I don’t map any network drives.
Also, I sometimes see an “LPC(:) connection refused from :” message on the
debugger in XP Checked when Explorer starts responding again. Does this
mean anything significant to anyone? I have read that some of the network
drivers use LPCs to communicate with user mode services but I’m not sure
what to make of the message.
Do any of you have a suggestion you can offer me please?
Many thanks,
Richard Cartwright
Spherical Technology Pty Ltd