[OSR-DETECTED-SPAM] RE: Slow SYS/PDB lookup

WINDBG
1

0: kd> .sympath

Symbol search path is:
srv*c:\windows\symbols*http://msdl.microsoft.com/download/symbols;\\sym.int.
avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\sym
bols

Expanded Symbol search path is:
srv*c:\windows\symbols*http://msdl.microsoft.com/download/symbols;\\sym.int.
avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\sym
bols

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 4:46 PM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup

What is .sympath output?

Sent from my Windows Phone

From: Skywing
Sent: Tuesday, April 12, 2011 7:33 AM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup

I’ve seen this happen if the symbol engine believes that the symbol path
you’ve given it isn’t laid out correctly for an indexed symbol store.
Rather than investigate further, I just fixed the directory layout to be
correct.

Are there any directories under your symbol server which don’t conform to
the standard naming convention for an indexed symbol store (i.e.
\filename\indexingparams\filename) ?

  • S

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 4:21 AM
To: Kernel Debugging Interest List
Subject: [windbg] Slow SYS/PDB lookup

Hi,

this bug annoys me for quite a very time… We use symbol server for our
SYS/DLL/PDB files and sometimes when I open minidump or I’m breaked into the
debugger from live debugging, then windbg looks up an associated PDB file
with my driver. It seems, windbg enumerates SYS file with all possible
timestamps values and it’s quite slow (several minutes), even my grandma can
find it faster with a little heuristic method:

procmon log:

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F1EE79a000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20A93d500\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20AE36000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20B49a000\aswSP.sys
<file:>

…

why can’t windbg use lmvm command to see timestamp prefix and enumerate only
several folders?

Timestamp: Tue Apr 12 03:33:46 2011 (4DA3ABFA)

usually I have to close windbg, rerun without symbolic path, insert symbolic
path in windbg and reload (then windbg finds exact match).

Thanks,

Petr Kurtin

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer</file:></file:></file:></file:>

2

Change to "srv*c:\windows\symbols*http://msdl.microsoft.com/download/symbols;srv\*\\sym.int.avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\symbols
" (prefix \sym.int.avast.com<file:> with srv*) and give it a try.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 07:50 AM
To: Kernel Debugging Interest List
Subject: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup
Importance: Low

0: kd> .sympath
Symbol search path is: srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;\\sym.int.avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\symbols

Expanded Symbol search path is: srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;\\sym.int.avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\symbols

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 4:46 PM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup

What is .sympath output?

Sent from my Windows Phone
________________________________
From: Skywing
Sent: Tuesday, April 12, 2011 7:33 AM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup
I’ve seen this happen if the symbol engine believes that the symbol path you’ve given it isn’t laid out correctly for an indexed symbol store. Rather than investigate further, I just fixed the directory layout to be correct.

Are there any directories under your symbol server which don’t conform to the standard naming convention for an indexed symbol store (i.e. \filename\indexingparams\filename) ?

- S

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 4:21 AM
To: Kernel Debugging Interest List
Subject: [windbg] Slow SYS/PDB lookup

Hi,

this bug annoys me for quite a very time… We use symbol server for our SYS/DLL/PDB files and sometimes when I open minidump or I’m breaked into the debugger from live debugging, then windbg looks up an associated PDB file with my driver. It seems, windbg enumerates SYS file with all possible timestamps values and it’s quite slow (several minutes), even my grandma can find it faster with a little heuristic method:

procmon log:
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F1EE79a000\aswSP.sys<file:>
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F20A93d500\aswSP.sys<file:>
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F20AE36000\aswSP.sys<file:>
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F20B49a000\aswSP.sys<file:>
…

why can’t windbg use lmvm command to see timestamp prefix and enumerate only several folders?
Timestamp: Tue Apr 12 03:33:46 2011 (4DA3ABFA)

usually I have to close windbg, rerun without symbolic path, insert symbolic path in windbg and reload (then windbg finds exact match).

Thanks,
Petr Kurtin

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</file:></file:></file:></file:></file:>

3

I’ve also seen issues like this if you’ve set up a symbol server on a remote
case sensitive drive with duplicates (ignoring case sensitivity), or one
that has weird security issues, for lack of a better term.

I would delete the whole tree and start over, not that it will tell you what
the real problem is, of course.

Not that this is likely your problem, but I’d put the internal server before
the msft one, just so that it’s searched first.

Those values below are curious, I think:

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F1EE79a000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20A93d500\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20AE36000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20B49a000\aswSP.sys
<file:>

They’re certainly not of the UUID + Age (RSDS) indexing variety, yet they
also don’t appear to be of the Signature + Age (NB10) variety either. Not
really sure what they are, but most likely, they’re just a format that I
don’t know about.

Good luck,

mm

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 11:22 AM
To: Kernel Debugging Interest List
Subject: RE: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup

Change to
“srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;srv*\\sym
.int.avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\window
s\symbols

” (prefix \sym.int.avast.com <file:> with srv*) and
give it a try.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 07:50 AM
To: Kernel Debugging Interest List
Subject: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup
Importance: Low

0: kd> .sympath

Symbol search path is:
srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;\\sym.int.
avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\sym
bols

Expanded Symbol search path is:
srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;\\sym.int.
avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\sym
bols

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 4:46 PM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup

What is .sympath output?

Sent from my Windows Phone

_____

From: Skywing
Sent: Tuesday, April 12, 2011 7:33 AM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup

I’ve seen this happen if the symbol engine believes that the symbol path
you’ve given it isn’t laid out correctly for an indexed symbol store.
Rather than investigate further, I just fixed the directory layout to be
correct.

Are there any directories under your symbol server which don’t conform to
the standard naming convention for an indexed symbol store (i.e.
\filename\indexingparams\filename) ?

- S

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 4:21 AM
To: Kernel Debugging Interest List
Subject: [windbg] Slow SYS/PDB lookup

Hi,

this bug annoys me for quite a very time… We use symbol server for our
SYS/DLL/PDB files and sometimes when I open minidump or I’m breaked into the
debugger from live debugging, then windbg looks up an associated PDB file
with my driver. It seems, windbg enumerates SYS file with all possible
timestamps values and it’s quite slow (several minutes), even my grandma can
find it faster with a little heuristic method:

procmon log:

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F1EE79a000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20A93d500\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20AE36000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20B49a000\aswSP.sys
<file:>

…

why can’t windbg use lmvm command to see timestamp prefix and enumerate only
several folders?

Timestamp: Tue Apr 12 03:33:46 2011 (4DA3ABFA)

usually I have to close windbg, rerun without symbolic path, insert symbolic
path in windbg and reload (then windbg finds exact match).

Thanks,

Petr Kurtin

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer</file:></file:></file:></file:></file:></file:></file:></file:></file:>

4

For modules (exe/dll/sys, not PDB), the signature hash includes TimeStamp and ImageSize values. Check “lmvm ” output.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Martin O’Brien
Sent: Tuesday, April 12, 2011 12:59 PM
To: Kernel Debugging Interest List
Subject: RE: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup
Importance: Low

I’ve also seen issues like this if you’ve set up a symbol server on a remote case sensitive drive with duplicates (ignoring case sensitivity), or one that has weird security issues, for lack of a better term.

I would delete the whole tree and start over, not that it will tell you what the real problem is, of course.

Not that this is likely your problem, but I’d put the internal server before the msft one, just so that it’s searched first.

Those values below are curious, I think:

windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F1EE79a000\aswSP.sys<file:>
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F20A93d500\aswSP.sys<file:>
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F20AE36000\aswSP.sys<file:>
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F20B49a000\aswSP.sys<file:>

They’re certainly not of the UUID + Age (RSDS) indexing variety, yet they also don’t appear to be of the Signature + Age (NB10) variety either. Not really sure what they are, but most likely, they’re just a format that I don’t know about.

Good luck,

mm

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 11:22 AM
To: Kernel Debugging Interest List
Subject: RE: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup

Change to “srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;srv*\\sym.int.avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\symbols
” (prefix \sym.int.avast.com<file:> with srv*) and give it a try.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 07:50 AM
To: Kernel Debugging Interest List
Subject: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup
Importance: Low

0: kd> .sympath
Symbol search path is: srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;\\sym.int.avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\symbols

Expanded Symbol search path is: srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;\\sym.int.avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\symbols

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 4:46 PM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup

What is .sympath output?

Sent from my Windows Phone
________________________________
From: Skywing
Sent: Tuesday, April 12, 2011 7:33 AM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup
I’ve seen this happen if the symbol engine believes that the symbol path you’ve given it isn’t laid out correctly for an indexed symbol store. Rather than investigate further, I just fixed the directory layout to be correct.

Are there any directories under your symbol server which don’t conform to the standard naming convention for an indexed symbol store (i.e. \filename\indexingparams\filename) ?

- S

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 4:21 AM
To: Kernel Debugging Interest List
Subject: [windbg] Slow SYS/PDB lookup

Hi,

this bug annoys me for quite a very time… We use symbol server for our SYS/DLL/PDB files and sometimes when I open minidump or I’m breaked into the debugger from live debugging, then windbg looks up an associated PDB file with my driver. It seems, windbg enumerates SYS file with all possible timestamps values and it’s quite slow (several minutes), even my grandma can find it faster with a little heuristic method:

procmon log:
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F1EE79a000\aswSP.sys<file:>
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F20A93d500\aswSP.sys<file:>
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F20AE36000\aswSP.sys<file:>
windbg.exe CreateFile \sym.int.avast.com\sym\aswSP.sys\4C1F20B49a000\aswSP.sys<file:>
…

why can’t windbg use lmvm command to see timestamp prefix and enumerate only several folders?
Timestamp: Tue Apr 12 03:33:46 2011 (4DA3ABFA)

usually I have to close windbg, rerun without symbolic path, insert symbolic path in windbg and reload (then windbg finds exact match).

Thanks,
Petr Kurtin

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</file:></file:></file:></file:></file:></file:></file:></file:></file:>

5

Did not know that.

Thanks,

mm

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 4:11 PM
To: Kernel Debugging Interest List
Subject: RE: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup

For modules (exe/dll/sys, not PDB), the signature hash includes TimeStamp
and ImageSize values. Check “lmvm ” output.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Martin O’Brien
Sent: Tuesday, April 12, 2011 12:59 PM
To: Kernel Debugging Interest List
Subject: RE: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup
Importance: Low

I’ve also seen issues like this if you’ve set up a symbol server on a remote
case sensitive drive with duplicates (ignoring case sensitivity), or one
that has weird security issues, for lack of a better term.

I would delete the whole tree and start over, not that it will tell you what
the real problem is, of course.

Not that this is likely your problem, but I’d put the internal server before
the msft one, just so that it’s searched first.

Those values below are curious, I think:

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F1EE79a000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20A93d500\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20AE36000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20B49a000\aswSP.sys
<file:>

They’re certainly not of the UUID + Age (RSDS) indexing variety, yet they
also don’t appear to be of the Signature + Age (NB10) variety either. Not
really sure what they are, but most likely, they’re just a format that I
don’t know about.

Good luck,

mm

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 11:22 AM
To: Kernel Debugging Interest List
Subject: RE: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup

Change to
“srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;srv*\\sym
.int.avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\window
s\symbols

” (prefix \sym.int.avast.com <file:> with srv*) and
give it a try.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 07:50 AM
To: Kernel Debugging Interest List
Subject: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup
Importance: Low

0: kd> .sympath

Symbol search path is:
srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;\\sym.int.
avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\sym
bols

Expanded Symbol search path is:
srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;\\sym.int.
avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\sym
bols

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 4:46 PM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup

What is .sympath output?

Sent from my Windows Phone

_____

From: Skywing
Sent: Tuesday, April 12, 2011 7:33 AM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup

I’ve seen this happen if the symbol engine believes that the symbol path
you’ve given it isn’t laid out correctly for an indexed symbol store.
Rather than investigate further, I just fixed the directory layout to be
correct.

Are there any directories under your symbol server which don’t conform to
the standard naming convention for an indexed symbol store (i.e.
\filename\indexingparams\filename) ?

- S

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 4:21 AM
To: Kernel Debugging Interest List
Subject: [windbg] Slow SYS/PDB lookup

Hi,

this bug annoys me for quite a very time… We use symbol server for our
SYS/DLL/PDB files and sometimes when I open minidump or I’m breaked into the
debugger from live debugging, then windbg looks up an associated PDB file
with my driver. It seems, windbg enumerates SYS file with all possible
timestamps values and it’s quite slow (several minutes), even my grandma can
find it faster with a little heuristic method:

procmon log:

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F1EE79a000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20A93d500\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20AE36000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20B49a000\aswSP.sys
<file:>

…

why can’t windbg use lmvm command to see timestamp prefix and enumerate only
several folders?

Timestamp: Tue Apr 12 03:33:46 2011 (4DA3ABFA)

usually I have to close windbg, rerun without symbolic path, insert symbolic
path in windbg and reload (then windbg finds exact match).

Thanks,

Petr Kurtin

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer</file:></file:></file:></file:></file:></file:></file:></file:></file:>

6

it seems it helped, thank you!

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 5:22 PM
To: Kernel Debugging Interest List
Subject: RE: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup

Change to
"srv*c:\windows\symbols*http://msdl.microsoft.com/download/symbols;srv\*\\sym
.int.avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\window
s\symbols

" (prefix \sym.int.avast.com <file:> with srv*) and
give it a try.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 07:50 AM
To: Kernel Debugging Interest List
Subject: [OSR-DETECTED-SPAM] RE: [windbg] Slow SYS/PDB lookup
Importance: Low

0: kd> .sympath

Symbol search path is:
srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;\\sym.int.
avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\sym
bols

Expanded Symbol search path is:
srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols;\\sym.int.
avast.com\sym;c:_av\builds\debug\x86;c:_av\builds\debug\x64;c:\windows\sym
bols

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jen-Lung Chiu
Sent: Tuesday, April 12, 2011 4:46 PM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup

What is .sympath output?

Sent from my Windows Phone

_____

From: Skywing
Sent: Tuesday, April 12, 2011 7:33 AM
To: Kernel Debugging Interest List
Subject: RE: [windbg] Slow SYS/PDB lookup

I’ve seen this happen if the symbol engine believes that the symbol path
you’ve given it isn’t laid out correctly for an indexed symbol store.
Rather than investigate further, I just fixed the directory layout to be
correct.

Are there any directories under your symbol server which don’t conform to
the standard naming convention for an indexed symbol store (i.e.
\filename\indexingparams\filename) ?

- S

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, April 12, 2011 4:21 AM
To: Kernel Debugging Interest List
Subject: [windbg] Slow SYS/PDB lookup

Hi,

this bug annoys me for quite a very time… We use symbol server for our
SYS/DLL/PDB files and sometimes when I open minidump or I’m breaked into the
debugger from live debugging, then windbg looks up an associated PDB file
with my driver. It seems, windbg enumerates SYS file with all possible
timestamps values and it’s quite slow (several minutes), even my grandma can
find it faster with a little heuristic method:

procmon log:

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F1EE79a000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20A93d500\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20AE36000\aswSP.sys
<file:>

windbg.exe CreateFile
\sym.int.avast.com\sym\aswSP.sys\4C1F20B49a000\aswSP.sys
<file:>

…

why can’t windbg use lmvm command to see timestamp prefix and enumerate only
several folders?

Timestamp: Tue Apr 12 03:33:46 2011 (4DA3ABFA)

usually I have to close windbg, rerun without symbolic path, insert symbolic
path in windbg and reload (then windbg finds exact match).

Thanks,

Petr Kurtin

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer</file:></file:></file:></file:></file:>