Fltmgr memory usage

NTFSD
1

I have been monitoring my minifilter and fltmgr to check for memory leaks
using Driver Verifier. I fixed a couple in my filter and it is now showing
CurrentPagedPoolAllocations: 0 and CurrentNonPagedPoolAllocations: 0 as it’s
normal state.

Fltmgr, however, seems to be continually growing its memory usage.

Is it just caching filenames or is it something to be concerned about?

Are there limits that it will grow until and then start recycling memory?

Using the Windbg extension !verifier shows many pool entries of the form:

834baec8 0x00000134 FMfn bb5aad0d

I have been through all of my Fltxxx routine calls and released any
resources returned by the filter manager when I have finished with them.

I am running on WXP SP2 checked build.

These are the outputs from the driver verifier before and after some filter
activity.

C:\Documents and Settings\Administrator>verifier /query
23/08/2005, 10:21:25
Level: 000000BB
RaiseIrqls: 3609
AcquireSpinLocks: 0
SynchronizeExecutions: 0
AllocationsAttempted: 1717
AllocationsSucceeded: 1717
AllocationsSucceededSpecialPool: 1717
AllocationsWithNoTag: 0
AllocationsFailed: 0
AllocationsFailedDeliberately: 0
Trims: 0
UnTrackedPool: 0

Verified drivers:

Name: fltmgr.sys, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 169
CurrentNonPagedPoolAllocations: 30
PeakPagedPoolAllocations: 169
PeakNonPagedPoolAllocations: 33
PagedPoolUsageInBytes: 51256
NonPagedPoolUsageInBytes: 27168
PeakPagedPoolUsageInBytes: 51256
PeakNonPagedPoolUsageInBytes: 27932

Name: filefilterdriver.sys, loads: 2, unloads: 1
CurrentPagedPoolAllocations: 0
CurrentNonPagedPoolAllocations: 0
PeakPagedPoolAllocations: 4
PeakNonPagedPoolAllocations: 6
PagedPoolUsageInBytes: 0
NonPagedPoolUsageInBytes: 0
PeakPagedPoolUsageInBytes: 1440
PeakNonPagedPoolUsageInBytes: 24836

C:\Documents and Settings\Administrator>
23/08/2005, 10:23:22
Level: 000000BB
RaiseIrqls: 3672
AcquireSpinLocks: 0
SynchronizeExecutions: 0
AllocationsAttempted: 1725
AllocationsSucceeded: 1725
AllocationsSucceededSpecialPool: 1725
AllocationsWithNoTag: 0
AllocationsFailed: 0
AllocationsFailedDeliberately: 0
Trims: 0
UnTrackedPool: 0

Verified drivers:

Name: fltmgr.sys, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 173
CurrentNonPagedPoolAllocations: 29
PeakPagedPoolAllocations: 173
PeakNonPagedPoolAllocations: 33
PagedPoolUsageInBytes: 52488
NonPagedPoolUsageInBytes: 26916
PeakPagedPoolUsageInBytes: 52488
PeakNonPagedPoolUsageInBytes: 27932

Name: filefilterdriver.sys, loads: 2, unloads: 1
CurrentPagedPoolAllocations: 0
CurrentNonPagedPoolAllocations: 0
PeakPagedPoolAllocations: 4
PeakNonPagedPoolAllocations: 6
PagedPoolUsageInBytes: 0
NonPagedPoolUsageInBytes: 0
PeakPagedPoolUsageInBytes: 1440
PeakNonPagedPoolUsageInBytes: 24836

C:\Documents and Settings\Administrator>

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

2

The filter manager does cache file names, so you would
expect to see some semi-persistant memory allocations
related to this. I would think that it is very
unlikely that this is anything that you would need to
worry about, but it is always good to understand
exactly what is happening :slight_smile:

Hopefully someone from the filter team can give us
some details on their caching mechanism and what tags
relate to these memory allocations.

— “Abraham, Richard W”
wrote:

>
> I have been monitoring my minifilter and fltmgr to
> check for memory leaks
> using Driver Verifier. I fixed a couple in my
> filter and it is now showing
> CurrentPagedPoolAllocations: 0 and
> CurrentNonPagedPoolAllocations: 0 as it’s
> normal state.
>
> Fltmgr, however, seems to be continually growing its
> memory usage.
>
> Is it just caching filenames or is it something to
> be concerned about?
>
> Are there limits that it will grow until and then
> start recycling memory?
>
> Using the Windbg extension !verifier shows many pool
> entries of the form:
>
> 834baec8 0x00000134 FMfn bb5aad0d
>
> I have been through all of my Fltxxx routine calls
> and released any
> resources returned by the filter manager when I have
> finished with them.
>
> I am running on WXP SP2 checked build.
>
> These are the outputs from the driver verifier
> before and after some filter
> activity.
>
> C:\Documents and Settings\Administrator>verifier
> /query
> 23/08/2005, 10:21:25
> Level: 000000BB
> RaiseIrqls: 3609
> AcquireSpinLocks: 0
> SynchronizeExecutions: 0
> AllocationsAttempted: 1717
> AllocationsSucceeded: 1717
> AllocationsSucceededSpecialPool: 1717
> AllocationsWithNoTag: 0
> AllocationsFailed: 0
> AllocationsFailedDeliberately: 0
> Trims: 0
> UnTrackedPool: 0
>
> Verified drivers:
>
> Name: fltmgr.sys, loads: 1, unloads: 0
> CurrentPagedPoolAllocations: 169
> CurrentNonPagedPoolAllocations: 30
> PeakPagedPoolAllocations: 169
> PeakNonPagedPoolAllocations: 33
> PagedPoolUsageInBytes: 51256
> NonPagedPoolUsageInBytes: 27168
> PeakPagedPoolUsageInBytes: 51256
> PeakNonPagedPoolUsageInBytes: 27932
>
> Name: filefilterdriver.sys, loads: 2, unloads: 1
> CurrentPagedPoolAllocations: 0
> CurrentNonPagedPoolAllocations: 0
> PeakPagedPoolAllocations: 4
> PeakNonPagedPoolAllocations: 6
> PagedPoolUsageInBytes: 0
> NonPagedPoolUsageInBytes: 0
> PeakPagedPoolUsageInBytes: 1440
> PeakNonPagedPoolUsageInBytes: 24836
>
> C:\Documents and Settings\Administrator>
> 23/08/2005, 10:23:22
> Level: 000000BB
> RaiseIrqls: 3672
> AcquireSpinLocks: 0
> SynchronizeExecutions: 0
> AllocationsAttempted: 1725
> AllocationsSucceeded: 1725
> AllocationsSucceededSpecialPool: 1725
> AllocationsWithNoTag: 0
> AllocationsFailed: 0
> AllocationsFailedDeliberately: 0
> Trims: 0
> UnTrackedPool: 0
>
> Verified drivers:
>
> Name: fltmgr.sys, loads: 1, unloads: 0
> CurrentPagedPoolAllocations: 173
> CurrentNonPagedPoolAllocations: 29
> PeakPagedPoolAllocations: 173
> PeakNonPagedPoolAllocations: 33
> PagedPoolUsageInBytes: 52488
> NonPagedPoolUsageInBytes: 26916
> PeakPagedPoolUsageInBytes: 52488
> PeakNonPagedPoolUsageInBytes: 27932
>
> Name: filefilterdriver.sys, loads: 2, unloads: 1
> CurrentPagedPoolAllocations: 0
> CurrentNonPagedPoolAllocations: 0
> PeakPagedPoolAllocations: 4
> PeakNonPagedPoolAllocations: 6
> PagedPoolUsageInBytes: 0
> NonPagedPoolUsageInBytes: 0
> PeakPagedPoolUsageInBytes: 1440
> PeakNonPagedPoolUsageInBytes: 24836
>
> C:\Documents and Settings\Administrator>
>
>

> This email and any attachments are confidential to
> the intended
> recipient and may also be privileged. If you are not
> the intended
> recipient please delete it from your system and
> notify the sender.
> You should not copy it or use it for any purpose nor
> disclose or
> distribute its contents to any other person.
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

3

FMfn is the pool tag for filter managers name cache nodes. Each of these
is reference counted; we put one reference for when it is created and an
additional one each time it is returned to a thread. We remove a
reference when a thread calls FltReleaseFilenameInformation and once
when the stream that this node describes is freed.

So, you really shouldn’t have any allocs with FMfn as the tag unless:

A) the stream is still open (which is the normal case)
B) a filter is querying for a filename and forgetting to release the
structure

Note that the numbers pasted in below look very reasonable, so I
wouldn’t worry about it. Most of the time it’s just that the file is
still open. If you notice the usage of these structures begin to spiral
upwards, I’d start digging a little deeper…

Thanks
Apurva

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Randy Cook
Sent: Tuesday, August 23, 2005 7:57 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Fltmgr memory usage

The filter manager does cache file names, so you would
expect to see some semi-persistant memory allocations
related to this. I would think that it is very
unlikely that this is anything that you would need to
worry about, but it is always good to understand
exactly what is happening :slight_smile:

Hopefully someone from the filter team can give us
some details on their caching mechanism and what tags
relate to these memory allocations.

— “Abraham, Richard W”
wrote:

>
> I have been monitoring my minifilter and fltmgr to
> check for memory leaks
> using Driver Verifier. I fixed a couple in my
> filter and it is now showing
> CurrentPagedPoolAllocations: 0 and
> CurrentNonPagedPoolAllocations: 0 as it’s
> normal state.
>
> Fltmgr, however, seems to be continually growing its
> memory usage.
>
> Is it just caching filenames or is it something to
> be concerned about?
>
> Are there limits that it will grow until and then
> start recycling memory?
>
> Using the Windbg extension !verifier shows many pool
> entries of the form:
>
> 834baec8 0x00000134 FMfn bb5aad0d
>
> I have been through all of my Fltxxx routine calls
> and released any
> resources returned by the filter manager when I have
> finished with them.
>
> I am running on WXP SP2 checked build.
>
> These are the outputs from the driver verifier
> before and after some filter
> activity.
>
> C:\Documents and Settings\Administrator>verifier
> /query
> 23/08/2005, 10:21:25
> Level: 000000BB
> RaiseIrqls: 3609
> AcquireSpinLocks: 0
> SynchronizeExecutions: 0
> AllocationsAttempted: 1717
> AllocationsSucceeded: 1717
> AllocationsSucceededSpecialPool: 1717
> AllocationsWithNoTag: 0
> AllocationsFailed: 0
> AllocationsFailedDeliberately: 0
> Trims: 0
> UnTrackedPool: 0
>
> Verified drivers:
>
> Name: fltmgr.sys, loads: 1, unloads: 0
> CurrentPagedPoolAllocations: 169
> CurrentNonPagedPoolAllocations: 30
> PeakPagedPoolAllocations: 169
> PeakNonPagedPoolAllocations: 33
> PagedPoolUsageInBytes: 51256
> NonPagedPoolUsageInBytes: 27168
> PeakPagedPoolUsageInBytes: 51256
> PeakNonPagedPoolUsageInBytes: 27932
>
> Name: filefilterdriver.sys, loads: 2, unloads: 1
> CurrentPagedPoolAllocations: 0
> CurrentNonPagedPoolAllocations: 0
> PeakPagedPoolAllocations: 4
> PeakNonPagedPoolAllocations: 6
> PagedPoolUsageInBytes: 0
> NonPagedPoolUsageInBytes: 0
> PeakPagedPoolUsageInBytes: 1440
> PeakNonPagedPoolUsageInBytes: 24836
>
> C:\Documents and Settings\Administrator>
> 23/08/2005, 10:23:22
> Level: 000000BB
> RaiseIrqls: 3672
> AcquireSpinLocks: 0
> SynchronizeExecutions: 0
> AllocationsAttempted: 1725
> AllocationsSucceeded: 1725
> AllocationsSucceededSpecialPool: 1725
> AllocationsWithNoTag: 0
> AllocationsFailed: 0
> AllocationsFailedDeliberately: 0
> Trims: 0
> UnTrackedPool: 0
>
> Verified drivers:
>
> Name: fltmgr.sys, loads: 1, unloads: 0
> CurrentPagedPoolAllocations: 173
> CurrentNonPagedPoolAllocations: 29
> PeakPagedPoolAllocations: 173
> PeakNonPagedPoolAllocations: 33
> PagedPoolUsageInBytes: 52488
> NonPagedPoolUsageInBytes: 26916
> PeakPagedPoolUsageInBytes: 52488
> PeakNonPagedPoolUsageInBytes: 27932
>
> Name: filefilterdriver.sys, loads: 2, unloads: 1
> CurrentPagedPoolAllocations: 0
> CurrentNonPagedPoolAllocations: 0
> PeakPagedPoolAllocations: 4
> PeakNonPagedPoolAllocations: 6
> PagedPoolUsageInBytes: 0
> NonPagedPoolUsageInBytes: 0
> PeakPagedPoolUsageInBytes: 1440
> PeakNonPagedPoolUsageInBytes: 24836
>
> C:\Documents and Settings\Administrator>
>
>

> This email and any attachments are confidential to
> the intended
> recipient and may also be privileged. If you are not
> the intended
> recipient please delete it from your system and
> notify the sender.
> You should not copy it or use it for any purpose nor
> disclose or
> distribute its contents to any other person.
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

To answer my own question. Just hadn’t checked all the paths and in certain
circumstances I wasn’t releasing the FileNameInformation references.

-----Original Message-----
From: Abraham, Richard W
Sent: 23 August 2005 11:18
To: Windows File Systems Devs Interest List (E-mail)
Subject: Fltmgr memory usage

I have been monitoring my minifilter and fltmgr to check for memory leaks
using Driver Verifier. I fixed a couple in my filter and it is now showing
CurrentPagedPoolAllocations: 0 and CurrentNonPagedPoolAllocations: 0 as it’s
normal state.

Fltmgr, however, seems to be continually growing its memory usage.

Is it just caching filenames or is it something to be concerned about?

Are there limits that it will grow until and then start recycling memory?

Using the Windbg extension !verifier shows many pool entries of the form:

834baec8 0x00000134 FMfn bb5aad0d

I have been through all of my Fltxxx routine calls and released any
resources returned by the filter manager when I have finished with them.

I am running on WXP SP2 checked build.

These are the outputs from the driver verifier before and after some filter
activity.

C:\Documents and Settings\Administrator>verifier /query
23/08/2005, 10:21:25
Level: 000000BB
RaiseIrqls: 3609
AcquireSpinLocks: 0
SynchronizeExecutions: 0
AllocationsAttempted: 1717
AllocationsSucceeded: 1717
AllocationsSucceededSpecialPool: 1717
AllocationsWithNoTag: 0
AllocationsFailed: 0
AllocationsFailedDeliberately: 0
Trims: 0
UnTrackedPool: 0

Verified drivers:

Name: fltmgr.sys, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 169
CurrentNonPagedPoolAllocations: 30
PeakPagedPoolAllocations: 169
PeakNonPagedPoolAllocations: 33
PagedPoolUsageInBytes: 51256
NonPagedPoolUsageInBytes: 27168
PeakPagedPoolUsageInBytes: 51256
PeakNonPagedPoolUsageInBytes: 27932

Name: filefilterdriver.sys, loads: 2, unloads: 1
CurrentPagedPoolAllocations: 0
CurrentNonPagedPoolAllocations: 0
PeakPagedPoolAllocations: 4
PeakNonPagedPoolAllocations: 6
PagedPoolUsageInBytes: 0
NonPagedPoolUsageInBytes: 0
PeakPagedPoolUsageInBytes: 1440
PeakNonPagedPoolUsageInBytes: 24836

C:\Documents and Settings\Administrator>
23/08/2005, 10:23:22
Level: 000000BB
RaiseIrqls: 3672
AcquireSpinLocks: 0
SynchronizeExecutions: 0
AllocationsAttempted: 1725
AllocationsSucceeded: 1725
AllocationsSucceededSpecialPool: 1725
AllocationsWithNoTag: 0
AllocationsFailed: 0
AllocationsFailedDeliberately: 0
Trims: 0
UnTrackedPool: 0

Verified drivers:

Name: fltmgr.sys, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 173
CurrentNonPagedPoolAllocations: 29
PeakPagedPoolAllocations: 173
PeakNonPagedPoolAllocations: 33
PagedPoolUsageInBytes: 52488
NonPagedPoolUsageInBytes: 26916
PeakPagedPoolUsageInBytes: 52488
PeakNonPagedPoolUsageInBytes: 27932

Name: filefilterdriver.sys, loads: 2, unloads: 1
CurrentPagedPoolAllocations: 0
CurrentNonPagedPoolAllocations: 0
PeakPagedPoolAllocations: 4
PeakNonPagedPoolAllocations: 6
PagedPoolUsageInBytes: 0
NonPagedPoolUsageInBytes: 0
PeakPagedPoolUsageInBytes: 1440
PeakNonPagedPoolUsageInBytes: 24836

C:\Documents and Settings\Administrator>

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

5

And thanks to Randy and Apurva for replying. Unfortunately I subscribe via
email and our company system seems to have lost the replies (and probably
other interesting messages as well). I’ll know to check on osronline in
future.

-----Original Message-----
From: Abraham, Richard W
Sent: 25 August 2005 08:14
To: ‘Windows File Systems Devs Interest List (E-mail)’
Subject: RE: Fltmgr memory usage

To answer my own question. Just hadn’t checked all the paths and in certain
circumstances I wasn’t releasing the FileNameInformation references.

-----Original Message-----
From: Abraham, Richard W
Sent: 23 August 2005 11:18
To: Windows File Systems Devs Interest List (E-mail)
Subject: Fltmgr memory usage

I have been monitoring my minifilter and fltmgr to check for memory leaks
using Driver Verifier. I fixed a couple in my filter and it is now showing
CurrentPagedPoolAllocations: 0 and CurrentNonPagedPoolAllocations: 0 as it’s
normal state.

Fltmgr, however, seems to be continually growing its memory usage.

Is it just caching filenames or is it something to be concerned about?

Are there limits that it will grow until and then start recycling memory?

Using the Windbg extension !verifier shows many pool entries of the form:

834baec8 0x00000134 FMfn bb5aad0d

I have been through all of my Fltxxx routine calls and released any
resources returned by the filter manager when I have finished with them.

I am running on WXP SP2 checked build.

These are the outputs from the driver verifier before and after some filter
activity.

C:\Documents and Settings\Administrator>verifier /query
23/08/2005, 10:21:25
Level: 000000BB
RaiseIrqls: 3609
AcquireSpinLocks: 0
SynchronizeExecutions: 0
AllocationsAttempted: 1717
AllocationsSucceeded: 1717
AllocationsSucceededSpecialPool: 1717
AllocationsWithNoTag: 0
AllocationsFailed: 0
AllocationsFailedDeliberately: 0
Trims: 0
UnTrackedPool: 0

Verified drivers:

Name: fltmgr.sys, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 169
CurrentNonPagedPoolAllocations: 30
PeakPagedPoolAllocations: 169
PeakNonPagedPoolAllocations: 33
PagedPoolUsageInBytes: 51256
NonPagedPoolUsageInBytes: 27168
PeakPagedPoolUsageInBytes: 51256
PeakNonPagedPoolUsageInBytes: 27932

Name: filefilterdriver.sys, loads: 2, unloads: 1
CurrentPagedPoolAllocations: 0
CurrentNonPagedPoolAllocations: 0
PeakPagedPoolAllocations: 4
PeakNonPagedPoolAllocations: 6
PagedPoolUsageInBytes: 0
NonPagedPoolUsageInBytes: 0
PeakPagedPoolUsageInBytes: 1440
PeakNonPagedPoolUsageInBytes: 24836

C:\Documents and Settings\Administrator>
23/08/2005, 10:23:22
Level: 000000BB
RaiseIrqls: 3672
AcquireSpinLocks: 0
SynchronizeExecutions: 0
AllocationsAttempted: 1725
AllocationsSucceeded: 1725
AllocationsSucceededSpecialPool: 1725
AllocationsWithNoTag: 0
AllocationsFailed: 0
AllocationsFailedDeliberately: 0
Trims: 0
UnTrackedPool: 0

Verified drivers:

Name: fltmgr.sys, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 173
CurrentNonPagedPoolAllocations: 29
PeakPagedPoolAllocations: 173
PeakNonPagedPoolAllocations: 33
PagedPoolUsageInBytes: 52488
NonPagedPoolUsageInBytes: 26916
PeakPagedPoolUsageInBytes: 52488
PeakNonPagedPoolUsageInBytes: 27932

Name: filefilterdriver.sys, loads: 2, unloads: 1
CurrentPagedPoolAllocations: 0
CurrentNonPagedPoolAllocations: 0
PeakPagedPoolAllocations: 4
PeakNonPagedPoolAllocations: 6
PagedPoolUsageInBytes: 0
NonPagedPoolUsageInBytes: 0
PeakPagedPoolUsageInBytes: 1440
PeakNonPagedPoolUsageInBytes: 24836

C:\Documents and Settings\Administrator>

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************