Odd file caching issue?

NTDEV
1

I have a log file which is written by my driver using a system worker
routine. Every once in a while (maybe 10 times in the last few years), I’ll
notice that Windows Explorer will say that the file is 0 KB, but yet, I’ll
then open it up, and it will be large (a few KB, but I think once it was 20
KB or so). I’ll then look back at Windows Explorer and it will list the
proper size. I looked at my code, and it’s doing a ZwWriteFile every line
(100 bytes or so), so I’m not buffering the data. Furthermore, the
information in the file will sometimes be days old, so the system has
certainly had a chance to flush the cache out to disk at some point.

Another person reported that they also saw the wrong file size in Windows
Explorer, but goes further in that they first opened this file, saw a line
that gets written at midnight (and that’s all), and then closed it and
reopened it, and then saw all of the data.

The odd thing is that this only happens rarely – it works correctly the
vast majority of time.

I don’t see how this could be my driver doing it, but maybe some setting
when I open the file or write it or something like that? Below is how I
create it and write to it.

Thanks in advance for any suggestions!

InitializeObjectAttributes ( &ObjectAttributes,

&FullFileName,

OBJ_CASE_INSENSITIVE,
NULL,
NULL );

CreateOptions = FILE_SYNCHRONOUS_IO_NONALERT;
ntStatus = ZwCreateFile( &NtFileHandle,
SYNCHRONIZE |
FILE_READ_DATA | FILE_WRITE_DATA,
&ObjectAttributes,
&IoStatus,
NULL,
// alloc size = none

FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF,
CreateOptions,
NULL, // eabuffer
0 ); // ealength

Status = ZwWriteFile( deviceExtension->ErrorTextFileHandle,
NULL,
NULL,
NULL,
&IoStatus,

ConsumerDataBuffer,
ConsumerDataSize,
0,
NULL );

2

Does Explorer still say 0 KB after hitting F5 refresh? After re-opening
the window? Explorer is flaky, you may have to hit it over the head a
few times to report accurate information. Rest assured that the
filesystem is consistent (rest even more assured if it’s NTFS and not
FAT), unless you can prove otherwise by making your own API calls.

Taed Wynnell wrote:

I have a log file which is written by my driver using a system worker
routine. Every once in a while (maybe 10 times in the last few years), I’ll
notice that Windows Explorer will say that the file is 0 KB, but yet, I’ll
then open it up, and it will be large (a few KB, but I think once it was 20
KB or so). I’ll then look back at Windows Explorer and it will list the
proper size. I looked at my code, and it’s doing a ZwWriteFile every line
(100 bytes or so), so I’m not buffering the data. Furthermore, the
information in the file will sometimes be days old, so the system has
certainly had a chance to flush the cache out to disk at some point.

Another person reported that they also saw the wrong file size in Windows
Explorer, but goes further in that they first opened this file, saw a line
that gets written at midnight (and that’s all), and then closed it and
reopened it, and then saw all of the data.

The odd thing is that this only happens rarely – it works correctly the
vast majority of time.

I don’t see how this could be my driver doing it, but maybe some setting
when I open the file or write it or something like that? Below is how I
create it and write to it.

Thanks in advance for any suggestions!

InitializeObjectAttributes ( &ObjectAttributes,

&FullFileName,

OBJ_CASE_INSENSITIVE,
NULL,
NULL );

CreateOptions = FILE_SYNCHRONOUS_IO_NONALERT;
ntStatus = ZwCreateFile( &NtFileHandle,
SYNCHRONIZE |
FILE_READ_DATA | FILE_WRITE_DATA,
&ObjectAttributes,
&IoStatus,
NULL,
// alloc size = none

FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF,
CreateOptions,
NULL, // eabuffer
0 ); // ealength

Status = ZwWriteFile( deviceExtension->ErrorTextFileHandle,
NULL,
NULL,
NULL,
&IoStatus,

ConsumerDataBuffer,
ConsumerDataSize,
0,
NULL );

–
Nick Ryan (MVP for DDK)

3

> Does Explorer still say 0 KB after hitting F5 refresh?

I don’t know (since it occurs so infrequently, we never intend to bump into
it, and thus don’t experiment), but in every case, note that the file was
written to sometimes days previously, and we had just logged on to the
system. Thus, the information should be “current”. That also wouldn’t
explain the case when they opened the file, found no new information, and
then closed and reopened it, and found all of the information for the past
day.

I am running NTFS, though, for all that matters.

It’s weird, but since we’ve only seen this with the files written to by one
of the drivers, I suspect it’s something different about that driver or how
it is writing to files.

4

Life sucks

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Taed Wynnell
Sent: Monday, September 15, 2003 9:21 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Re: Odd file caching issue?

Does Explorer still say 0 KB after hitting F5 refresh?

I don’t know (since it occurs so infrequently, we never intend to bump
into
it, and thus don’t experiment), but in every case, note that the file
was
written to sometimes days previously, and we had just logged on to the
system. Thus, the information should be “current”. That also wouldn’t
explain the case when they opened the file, found no new information,
and
then closed and reopened it, and found all of the information for the
past
day.

I am running NTFS, though, for all that matters.

It’s weird, but since we’ve only seen this with the files written to by
one
of the drivers, I suspect it’s something different about that driver or
how
it is writing to files.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com