Missing volume notification from fltmgr

NTFSD
1

When my driver starts I am not getting notification for an existing
dynamic volume from the flrmgr, but I do for all others:

\Device\HarddiskDmVolumes\NyliDg0\Volume1

This volume has a drive letter and guid assigned to it which I can get
if I query the mount manager using the “E:” symbolic name.

This lack of notification happens if I start the driver manually from
the command OR it starts during the boot cycle during when set to
Automatic

I do get notification of all other existing volumes such as:

\Device\CdRom0

\Device\HarddiskVolume3

\Device\HarddiskVolume2

\Device\LanmanRedirector

\Device\RdpDr

\Device\HarddiskVolume1

\Device\Harddisk2\DP(1)0-0+7

Later I get these notifications when the Disk Manager is started:

\Device\Harddisk0\DR0

\Device\Harddisk1\DR1

\Device\Harddisk2\DR6

This does not normally happen on machine with Dynamic Volumes, but is
happening on a customer machine.

Anyone know what is going on and how to fix it?

Thanks,

Ken

2

Is a file system mounted on the volume?
What does the device stack - file system and storage - look like for this dynamic volume?

Sarosh
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights

3

How do I determine those two things? Keep in mind I have to webex into a
customer machine that I can’t debug.

I believe the volume has a file system loaded and is accessible, but
I’ll check.

Thanks,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@microsoft.com
Sent: Thursday, December 04, 2008 9:39 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Missing volume notification from fltmgr

Is a file system mounted on the volume?
What does the device stack - file system and storage - look like for
this dynamic volume?

Sarosh
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no
Rights

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Yes, the file system mounted is NTFS?

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@microsoft.com
Sent: Thursday, December 04, 2008 9:39 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Missing volume notification from fltmgr

Is a file system mounted on the volume?
What does the device stack - file system and storage - look like for
this dynamic volume?

Sarosh
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no
Rights

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

>From your original post I see that the volume is
\Device\HarddiskDmVolumes\NyliDg0\Volume1
This has to be a dynamic volume created by veritas (symantec!) volume
manager. Note that this is big brother of LDM.
LDM allows only one disk group but this path points to a volume inside
“NyliDg0” disk group.

It might be possible (my assumption!) that this veritas volume manager
is not playing fully according to the rules.

-----Original Message-----
From: xxxxx@emc.com [mailto:xxxxx@emc.com]
Sent: Friday, December 05, 2008 1:09 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Missing volume notification from fltmgr

Yes, the file system mounted is NTFS?

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@microsoft.com
Sent: Thursday, December 04, 2008 9:39 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Missing volume notification from fltmgr

Is a file system mounted on the volume?
What does the device stack - file system and storage - look like for
this dynamic volume?

Sarosh
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no
Rights

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@legato.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Ken,

I was hoping that you would have debug access to the box. !devstack was what I had in mind for both file system and storage stacks.

Harish made a good point about whether the dynamic volume manager is playing well in the eco-system.

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights

7

On a related topic, am I going mad or has it just become impossible to
explicitly attach to DOS devices which mapped to DFS share.

For example:

net use z: \test\DFSSHARE
net use y: \test\NonDFSshare

if you “fltmc attach” to z: nothing happens. If you “fltmc attach” to y:,
you attach to RDR (this is XP), but you still don’t see anything for z:

*BUT* if you specify auto attach (the magic flag set to zero in the
registry), everything works hunky dory.

Not a big issue, but I thought I’d ask…

Rod

8

Unfortunately, this is not something I am aware of. Do you know if this behavior always existed on XP. How does it behave on Win 2003 Server?

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights

9

Ken,

I saw this problem a years or so ago once on a customer’s site running on a
Windows Storage Server 2002 config. It had an old copy of Trend Micro AV (don’t
recall the version, but it was a legacy filter). After all other filters were
disabled, the customer finally consented to disabling the AV and upon reboot our
Mini-filter finally saw the volume. I believe they may have finally upgraded
their AV, or tossed our product :slight_smile:

regards, /ted

----- Original Message -----
From:
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, December 09, 2008 5:24 PM
Subject: RE:[ntfsd] Missing volume notification from fltmgr

Unfortunately, this is not something I am aware of. Do you know if this behavior
always existed on XP. How does it behave on Win 2003 Server?

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@kitschensync.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

10

Deja vu (Manual attach didn’t work either):
http://www.osronline.com/showThread.cfm?link=107103

/ted

----- Original Message -----
From:
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, December 09, 2008 5:24 PM
Subject: RE:[ntfsd] Missing volume notification from fltmgr

Unfortunately, this is not something I am aware of. Do you know if this behavior
always existed on XP. How does it behave on Win 2003 Server?

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@kitschensync.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

11

Hi Ted,
Thanks for the info, seems like something I’d think the filter manager
would want to address. If a legacy filter can cause notification to get
by passed that seems like a big problem.

Sarosh,
Any suggestions on how to proceed to resolve this issue?

Thanks,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ted Hess
Sent: Wednesday, December 10, 2008 2:15 PM
To: Windows File Systems Devs Interest List
Subject: Re: RE:[ntfsd] Missing volume notification from fltmgr

Ken,

I saw this problem a years or so ago once on a customer’s site running
on a
Windows Storage Server 2002 config. It had an old copy of Trend Micro AV
(don’t
recall the version, but it was a legacy filter). After all other filters
were
disabled, the customer finally consented to disabling the AV and upon
reboot our
Mini-filter finally saw the volume. I believe they may have finally
upgraded
their AV, or tossed our product :slight_smile:

regards, /ted

----- Original Message -----
From:
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, December 09, 2008 5:24 PM
Subject: RE:[ntfsd] Missing volume notification from fltmgr

Unfortunately, this is not something I am aware of. Do you know if this
behavior
always existed on XP. How does it behave on Win 2003 Server?

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no
Rights

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@kitschensync.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

12

Ted,

If you have the details, I would be very interested in what Trend Micro was doing to cause this.

Ken,

A legacy filter, just like any other kernel driver, would have the ability to disrupt normal operation of the system if it does not play by the rules of the system.

It may also be worth looking into Harish’s hunch that the dynamic volume manager may not be playing by the rules of the system in this case. There is no way to confirm this except through some kernel debugging.

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights

13

Well it may come to that. Support has opened up a case with MS.

They have removed a couple third party applications but we are still not
getting notified. We had the customer uninstall the following apps and
reboot,

  1. Trend Micro
  2. EMC VisualSRM

Unfortunately, this did not resolve the issue.

Ted mentioned Trend Micro so I was disappointed that it did not solve
the problem.
If they do a fltmc volumes the volume that we do not get a notification
for is listed.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@microsoft.com
Sent: Wednesday, December 17, 2008 11:39 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Missing volume notification from fltmgr

Ted,

If you have the details, I would be very interested in what Trend Micro
was doing to cause this.

Ken,

A legacy filter, just like any other kernel driver, would have the
ability to disrupt normal operation of the system if it does not play by
the rules of the system.

It may also be worth looking into Harish’s hunch that the dynamic volume
manager may not be playing by the rules of the system in this case.
There is no way to confirm this except through some kernel debugging.

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no
Rights

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

14

Ok. Look forward to debugging and getting to the bottom of this.
What OSes have you been able to reproduce this on?

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights