Sometimes Filemon shows IRP_MJ_CLOSE before IRP_MJ_CLEANUP.
when this happens the process corresponding to IRP_MJ_CLOSE is System.
is it a bug.
The fact you see an IRP_MJ_CLOSE prior to an IRP_MJ_CLEANUP does not
indicate a bug. Of course, if the IRP_MJ_CLOSE is on the same
FILE_OBJECT then yes, that would be a bug. However, that level of
detail is not reported by filemon - it only shows you the name of the
file, not the file object being used for the particular call.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com http:</http:>
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mani
Sent: Wednesday, June 22, 2005 3:42 AM
To: ntfsd redirect
Subject: [ntfsd] IRP_MJ_CLOSE before IRP_MJ_CLEANUP
Sometimes Filemon shows IRP_MJ_CLOSE before IRP_MJ_CLEANUP.
when this happens the process corresponding to IRP_MJ_CLOSE is System.
is it a bug.
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
> However, that level of detail is not reported by filemon - it only shows
you the name of the file, not the file object being used for the particular call.
Try to observe the same situation in FileSpy (at osronline) - you
can turn on pointers to file objects and watch which file object
is being IRP_MJ_CLEANUP-ed and which is being
IRP_MJ_CLOSE-d.
L.