Hi folks
I am wondering if anyone can give me a clue what this all means in the
output log from IFSTEST in HCT 11.2; here there was a custom filter driver
and the file system was ntfs. For example what is UpdateOnCloseDirTest
supposed to do? What appears to have gone wrong?
6C0.7C0 : +TEST+SEV2 : Test :UpdateOnCloseDirTest
Group :CloseCleanupDelete
Status :C000001C (IFSTEST_TEST_FILE_TIME_ERROR)
WSystemText :\uponcd\uponcd2
TestVariant :00000002
Last64GeneralValue :01C3FB9771DAEDF4
Expected64GeneralValue :01A8E79FE1D58000
Description :{Msg# CloseDel!uponcd!18} The file times should have
changed. This dirents should NOT have been updated
since the handles to the directories were NOT closed.
Lookup Query :
http://www.microsoft.com/ContentRedirect.asp?prd=IFSKit&id=CloseDel!uponcd!18&pver=2195
Thanks in advance
Lyndon
Hi Folks
So I now know that this SEV2 is introduced by the classic piece of code to
figure out the proper (long) name of a file given something that might be a
Dos 8.3 (short) name. Its the usual traverse the path opening parent
directories and querying the FileBothDirectoryInformation for the child kind
of code as we’ve discussed here a few times now. I still dont really know
that this SEV2 is all about or why it arises, but given the code that seems
to spring it, I would guess that someone has been here before and someone
will be here again …
Cheers
Lyndon
“Lyndon J Clarke” wrote in message
news:xxxxx@ntfsd…
> Hi folks
>
> I am wondering if anyone can give me a clue what this all means in the
> output log from IFSTEST in HCT 11.2; here there was a custom filter driver
> and the file system was ntfs. For example what is UpdateOnCloseDirTest
> supposed to do? What appears to have gone wrong?
>
> 6C0.7C0 : +TEST+SEV2 : Test :UpdateOnCloseDirTest
> Group :CloseCleanupDelete
> Status :C000001C (IFSTEST_TEST_FILE_TIME_ERROR)
> WSystemText :\uponcd\uponcd2
> TestVariant :00000002
> Last64GeneralValue :01C3FB9771DAEDF4
> Expected64GeneralValue :01A8E79FE1D58000
> Description :{Msg# CloseDel!uponcd!18} The file times should have
> changed. This dirents should NOT have been updated
> since the handles to the directories were NOT closed.
>
> Lookup Query :
>
http://www.microsoft.com/ContentRedirect.asp?prd=IFSKit&id=CloseDel!uponcd!18&pver=2195
>
> Thanks in advance
> Lyndon
>
>
>
On a related note:
Don’t you just love that none of these links work so we can actually get more
information:-)
Lookup Query :
http://www.microsoft.com/ContentRedirect.asp?prd=IFSKit&id=CloseDel!uponcd!18&pver=2195
–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.
Not really.
You got me there anyway, I paniced(sp?), and stuffed the url through ie …
got the “we’re sorry …” page of course. Ha ha, nice one, Dejan 
So, any idea what this UpdateOnCloseDirTest is all about then?
Cheers
Lyndon
“Dejan Maksimovic” wrote in message news:xxxxx@ntfsd…
>
> On a related note:
>
> Don’t you just love that none of these links work so we can
actually get more
> information:-)
>
> > Lookup Query :
> >
http://www.microsoft.com/ContentRedirect.asp?prd=IFSKit&id=CloseDel!uponcd!18&pver=2195
>
> –
> Kind regards, Dejan M. MVP for DDK
> http://www.alfasp.com E-mail: xxxxx@alfasp.com
> Alfa Transparent File Encryptor - Transparent file encryption services.
> Alfa File Protector - File protection and hiding library for Win32
developers.
> Alfa File Monitor - File monitoring library for Win32 developers.
>
>
>
No, but I’ve a solution. Run ifstest.exe manually. Just like in the ifstest.cmd just
remove -g Virus parameter, and instead tell to run only the test you’re interested in.
Run FileMon and see what happens.
So, any idea what this UpdateOnCloseDirTest is all about then?
–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.
I have seen this message while testing FS driver.
If I recall correctly it complains that
IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY returns time stamps for the
file that are different from time stamps that the file had before is was
opened although the handle was not closed yet. Time stamps should be updated
in IRP_MJ_CLEANUP dispatch routine.
Is it possible that filter driver opened and then closed the file thus
updating Last Access Time?
Alexei.
“Lyndon J Clarke” wrote in message
news:xxxxx@ntfsd…
> Hi folks
>
> I am wondering if anyone can give me a clue what this all means in the
> output log from IFSTEST in HCT 11.2; here there was a custom filter driver
> and the file system was ntfs. For example what is UpdateOnCloseDirTest
> supposed to do? What appears to have gone wrong?
>
> 6C0.7C0 : +TEST+SEV2 : Test :UpdateOnCloseDirTest
> Group :CloseCleanupDelete
> Status :C000001C (IFSTEST_TEST_FILE_TIME_ERROR)
> WSystemText :\uponcd\uponcd2
> TestVariant :00000002
> Last64GeneralValue :01C3FB9771DAEDF4
> Expected64GeneralValue :01A8E79FE1D58000
> Description :{Msg# CloseDel!uponcd!18} The file times should have
> changed. This dirents should NOT have been updated
> since the handles to the directories were NOT closed.
>
> Lookup Query :
>
http://www.microsoft.com/ContentRedirect.asp?prd=IFSKit&id=CloseDel!uponcd!1
8&pver=2195
>
> Thanks in advance
> Lyndon
>
>
>
Looking at what IRP etc are coming through the filter, and knowing what the
filter does and which parts spring the problem, I guess I understand a bit
more now. Like I said the part which springs the problem is the classic
short name to long name translation code which traverses the path, and where
a component might be short, opens the parent directory then queries
FileBothDirectoryInformation for the component child and then closes thed
directory handle. This causes an IRP_MJ_CLEANUP for the parent directory of
course. If I factor out the IRP generated by the filter, so its just those
from ifstest so to speak, then the IRP_MJ_CLEANUP comes much later when
ifstest closes the handle.
“Alexei Jelvis” wrote in message news:xxxxx@ntfsd…
> I have seen this message while testing FS driver.
> If I recall correctly it complains that
> IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY returns time stamps for
the
> file that are different from time stamps that the file had before is was
> opened although the handle was not closed yet. Time stamps should be
updated
> in IRP_MJ_CLEANUP dispatch routine.
> Is it possible that filter driver opened and then closed the file thus
> updating Last Access Time?
>
> Alexei.
>
> “Lyndon J Clarke” wrote in message
> news:xxxxx@ntfsd…
> > Hi folks
> >
> > I am wondering if anyone can give me a clue what this all means in the
> > output log from IFSTEST in HCT 11.2; here there was a custom filter
driver
> > and the file system was ntfs. For example what is UpdateOnCloseDirTest
> > supposed to do? What appears to have gone wrong?
> >
> > 6C0.7C0 : +TEST+SEV2 : Test :UpdateOnCloseDirTest
> > Group :CloseCleanupDelete
> > Status :C000001C (IFSTEST_TEST_FILE_TIME_ERROR)
> > WSystemText :\uponcd\uponcd2
> > TestVariant :00000002
> > Last64GeneralValue :01C3FB9771DAEDF4
> > Expected64GeneralValue :01A8E79FE1D58000
> > Description :{Msg# CloseDel!uponcd!18} The file times should have
> > changed. This dirents should NOT have been updated
> > since the handles to the directories were NOT closed.
> >
> > Lookup Query :
> >
>
http://www.microsoft.com/ContentRedirect.asp?prd=IFSKit&id=CloseDel!uponcd!1
> 8&pver=2195
> >
> > Thanks in advance
> > Lyndon
> >
> >
> >
>
>
>
Hi Dejan. Thanks for the suggestion. I already got that manual ifstest.exe
t-shirt by the way and, well, I can watch the IRP/FastIo traffic coming
through my filter as an alternative to Filemon. Cheers, Lyndon.
“Dejan Maksimovic” wrote in message news:xxxxx@ntfsd…
>
> No, but I’ve a solution. Run ifstest.exe manually. Just like in the
ifstest.cmd just
> remove -g Virus parameter, and instead tell to run only the test you’re
interested in.
> Run FileMon and see what happens.
>
> > So, any idea what this UpdateOnCloseDirTest is all about then?
>
> –
> Kind regards, Dejan M. MVP for DDK
> http://www.alfasp.com E-mail: xxxxx@alfasp.com
> Alfa Transparent File Encryptor - Transparent file encryption services.
> Alfa File Protector - File protection and hiding library for Win32
developers.
> Alfa File Monitor - File monitoring library for Win32 developers.
>
>
>