Hi,
I have observed a strange behavior when doing copy-paste on a file in
Windows Explorer.
Say, I copy-paste a file called a.txt and get a new file called ‘copy of
a.txt’.
Now, if the file was empty, I get the
create->set_attributes->write->cleanup->close sequence for the new file.
However, if it’s not empty, the final close isn’t seen! I double-checked it
using ProcMon.
Thanks in advance,
Greg.
“Greg” wrote in message news:xxxxx@ntfsd…
>However, if it’s not empty, the final close isn’t seen! I double-checked it
>using ProcMon.
Closes can be delayed for a looooong time. For example, for a cached file
the Cache Manager can keep the file object backing the cache map referenced
until memory pressure causes the file to be evicted from the cache. Try
increasing memory pressure in the system and see if the close arrives then
(I usually just download one of those “RAM optimizer” applications, which
essentially just consume all of the memory in the system to “optimize” it).
-scott
–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com
Hi Scott,
Thanks for the answer.
However I’m still not sure that this is indeed the case.
When I kill explorer.exe, I still don’t get the close.
Isn’t that supposed to happen then?
Thanks,
Greg.
On Thu, Mar 3, 2011 at 5:09 PM, Scott Noone wrote:
> “Greg” wrote in message news:xxxxx@ntfsd…
>
> However, if it’s not empty, the final close isn’t seen! I double-checked
>> it using ProcMon.
>>
>
> Closes can be delayed for a looooong time. For example, for a cached file
> the Cache Manager can keep the file object backing the cache map referenced
> until memory pressure causes the file to be evicted from the cache. Try
> increasing memory pressure in the system and see if the close arrives then
> (I usually just download one of those “RAM optimizer” applications, which
> essentially just consume all of the memory in the system to “optimize” it).
>
> -scott
>
> –
> Scott Noone
> Consulting Associate and Chief System Problem Analyst
> OSR Open Systems Resources, Inc.
> http://www.osronline.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
*Some* file object is going to back the section and that file object is
going to be prevented from being closed until Cc/Mm decides it’s time to go.
Have you tried the RAM optimizer to see if that makes the close happen?
-scott
–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com
“Greg” wrote in message news:xxxxx@ntfsd…
Hi Scott,
Thanks for the answer.
However I’m still not sure that this is indeed the case.
When I kill explorer.exe, I still don’t get the close.
Isn’t that supposed to happen then?
Thanks,
Greg.
On Thu, Mar 3, 2011 at 5:09 PM, Scott Noone wrote:
“Greg” wrote in message news:xxxxx@ntfsd…
However, if it’s not empty, the final close isn’t seen! I double-checked it
using ProcMon.
Closes can be delayed for a looooong time. For example, for a cached file
the Cache Manager can keep the file object backing the cache map referenced
until memory pressure causes the file to be evicted from the cache. Try
increasing memory pressure in the system and see if the close arrives then
(I usually just download one of those “RAM optimizer” applications, which
essentially just consume all of the memory in the system to “optimize” it).
-scott
–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
I will certainly try to run it, thanks.
Greg.
On Mar 3, 2011, at 20:05, “Scott Noone” wrote:
> Some file object is going to back the section and that file object is going to be prevented from being closed until Cc/Mm decides it’s time to go. Have you tried the RAM optimizer to see if that makes the close happen?
>
> -scott
>
> –
> Scott Noone
> Consulting Associate and Chief System Problem Analyst
> OSR Open Systems Resources, Inc.
> http://www.osronline.com
>
> “Greg” wrote in message news:xxxxx@ntfsd…
> Hi Scott,
>
> Thanks for the answer.
> However I’m still not sure that this is indeed the case.
> When I kill explorer.exe, I still don’t get the close.
> Isn’t that supposed to happen then?
>
> Thanks,
> Greg.
>
>
> On Thu, Mar 3, 2011 at 5:09 PM, Scott Noone wrote:
> “Greg” wrote in message news:xxxxx@ntfsd…
>
> However, if it’s not empty, the final close isn’t seen! I double-checked it using ProcMon.
>
> Closes can be delayed for a looooong time. For example, for a cached file the Cache Manager can keep the file object backing the cache map referenced until memory pressure causes the file to be evicted from the cache. Try increasing memory pressure in the system and see if the close arrives then (I usually just download one of those “RAM optimizer” applications, which essentially just consume all of the memory in the system to “optimize” it).
>
> -scott
>
> –
> Scott Noone
> Consulting Associate and Chief System Problem Analyst
> OSR Open Systems Resources, Inc.
> http://www.osronline.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit: http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit: http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
The cache manager can hold that final close for hours/days. Detecting Copy/Paste accurately in a filter is near impossible.
If you search the archives you’ll find near a decade of explanations regarding this particular subject…
From: Greg
Sent: Thursday, March 03, 2011 8:40 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Missing IRP_MJ_CLOSE
Hi,
I have observed a strange behavior when doing copy-paste on a file in Windows Explorer.
Say, I copy-paste a file called a.txt and get a new file called ‘copy of a.txt’.
Now, if the file was empty, I get the create->set_attributes->write->cleanup->close sequence for the new file.
However, if it’s not empty, the final close isn’t seen! I double-checked it using ProcMon.
Thanks in advance,
Greg.
— NTFSD is sponsored by OSR For our schedule of debugging and file system seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer