MS cluster support with minifilter

NTFSD
1

Hello,

first: I checked the FAQ here (especially Q47) and searched the articles here.

My question is, is there a description/document how a mini filter (file system filter driver) need to handle (attaching/detaching) the volumes being moved from one cluster node to another?
Does it needs to react on InstanceSetup and InstanceTeardownStart callback sequences, or also on IRP_MJ_FILE_SYSTEM_CONTROL?

My current minifilter runs on a non cluster system without a problem.
It’s also able to handle “fltmc attach” and “flt detach” sequences.
It does this via the InstanceSetup and InstanceTeardownStart callback.

But I have problems to find a “rule” how to detect and handle that a volume was moved between 2 cluster nodes.

E.g. currently:

  • if the volume group gets moved to “my” node, the InstanceSetup gets called.
  • if I remove it, the InstanceTeardownStart gets called.
  • if I move it back again, InstanceSetup gets called.
  • if I remove it again, … nothing was called?

If I do this a view time,
also “fltmc volumes” showes then the volume listed n times.
If I also unload the mini filter, “fltmc volumes” still shows those volumes.

But before I go here more into detail, maybe I do something general wrong.
So it would be great if I could get a hint how the attaching/detaching should work from a minifilter with MS cluster.

Thanks
Norbert

2

I improved the filter a bit, during FSCTL_DISMOUNT_VOLUME I invoke now FltDetachVolume.
This helps that the filter gets detached and then attached again with every group move from MSCS.
But at the end it seems not to be the correct solution, as “fltmc volumes” displays all those moved volumes, and without my filter it does not behave this way.

So is there nobody here who developed a minifilter in a MSCS environment who could help me here?