Is there any software available for watching scsi traffic? I guess that
would be something that installs a filter and sends all the SCSI related
IRP’s to a userspace channel where they can be decoded and logged.
My scsi driver isn’t showing any errors anywhere and yet backup software
is getting ERROR_IO_DEVICE every so often when writing to a tape drive.
Retrying the write almost always works on the 2nd or 3rd try, so I’m
worried that something else is injecting scsi commands or something.
I tried running procmon hoping that that would show who’s ‘touching’ the
Tape0 device or the scsi channel but it doesn’t seem to show me that
under 2008 x64.
What is the connectivity between your host and tape device. I mean, is it
iSCSI, FC (FCP-SCSI) or something else. If it is iSCSI, you can use
WireShark (and filter SCSI commands). If it is FC, you may need FC analyzer
like CAT-C/Finisar.
Regards,
T.V.Gokul.
On Mon, Jun 29, 2009 at 2:31 PM, James Harper > wrote:
> Is there any software available for watching scsi traffic? I guess that > would be something that installs a filter and sends all the SCSI related > IRP’s to a userspace channel where they can be decoded and logged. > > My scsi driver isn’t showing any errors anywhere and yet backup software > is getting ERROR_IO_DEVICE every so often when writing to a tape drive. > Retrying the write almost always works on the 2nd or 3rd try, so I’m > worried that something else is injecting scsi commands or something. > > I tried running procmon hoping that that would show who’s ‘touching’ the > Tape0 device or the scsi channel but it doesn’t seem to show me that > under 2008 x64. > > Thanks > > James > > — > NTDEV is sponsored by OSR > > For our schedule of WDF, WDM, debugging and other seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer >
What is the connectivity between your host and tape device. I mean, is
it
iSCSI, FC (FCP-SCSI) or something else. If it is iSCSI, you can use
WireShark
(and filter SCSI commands). If it is FC, you may need FC analyzer like
CAT-
C/Finisar.
I actually want to sniff the srb’s (and responses) in the IRP’s.
Another option is to download Bus Hound which captures all the SCSI traffic as well as the SRB’s and also shows the driver that is submitting each request.
Take a look at HtsScsiView from http://www.hollistech.com/. Mark Roddy
produced this very useful tool quite a while ago, I am surprised with all
the answers no one mentioned it.
“James Harper” wrote in message news:xxxxx@ntdev… Is there any software available for watching scsi traffic? I guess that would be something that installs a filter and sends all the SCSI related IRP’s to a userspace channel where they can be decoded and logged.
My scsi driver isn’t showing any errors anywhere and yet backup software is getting ERROR_IO_DEVICE every so often when writing to a tape drive. Retrying the write almost always works on the 2nd or 3rd try, so I’m worried that something else is injecting scsi commands or something.
I tried running procmon hoping that that would show who’s ‘touching’ the Tape0 device or the scsi channel but it doesn’t seem to show me that under 2008 x64.
Thanks
James
Information from ESET NOD32 Antivirus, version of virus signature database 4195 (20090629)
I remember actually having spare time to work on tools.
Mark Roddy
On Mon, Jun 29, 2009 at 7:49 AM, Don Burn wrote: > Take a look at HtsScsiView from http://www.hollistech.com/. ? Mark Roddy > produced this very useful tool quite a while ago, I am surprised with all > the answers no one mentioned it. > > > – > Don Burn (MVP, Windows DDK) > Windows Filesystem and Driver Consulting > Website: http://www.windrvr.com > Blog: http://msmvps.com/blogs/WinDrvr > > > “James Harper” wrote in message > news:xxxxx@ntdev… > Is there any software available for watching scsi traffic? I guess that > would be something that installs a filter and sends all the SCSI related > IRP’s to a userspace channel where they can be decoded and logged. > > My scsi driver isn’t showing any errors anywhere and yet backup software > is getting ERROR_IO_DEVICE every so often when writing to a tape drive. > Retrying the write almost always works on the 2nd or 3rd try, so I’m > worried that something else is injecting scsi commands or something. > > I tried running procmon hoping that that would show who’s ‘touching’ the > Tape0 device or the scsi channel but it doesn’t seem to show me that > under 2008 x64. > > Thanks > > James > > > Information from ESET NOD32 Antivirus, version of virus signature > database 4195 (20090629) > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com > > > > > > Information from ESET NOD32 Antivirus, version of virus signature database 4195 (20090629) > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com > > > > > > — > NTDEV is sponsored by OSR > > For our schedule of WDF, WDM, debugging and other seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer >
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of James Harper
Sent: Monday, June 29, 2009 5:02 AM
To: ntdev redirect
Subject: [ntdev] scsi sniffer
Is there any software available for watching scsi traffic? I guess that
would be something that installs a filter and sends all the SCSI related
IRP’s to a userspace channel where they can be decoded and logged.
My scsi driver isn’t showing any errors anywhere and yet backup software
is getting ERROR_IO_DEVICE every so often when writing to a tape drive.
Retrying the write almost always works on the 2nd or 3rd try, so I’m
worried that something else is injecting scsi commands or something.
I tried running procmon hoping that that would show who’s ‘touching’ the
Tape0 device or the scsi channel but it doesn’t seem to show me that
under 2008 x64.
“James Harper” wrote in message news:xxxxx@ntdev… Is there any software available for watching scsi traffic? I guess that would be something that installs a filter and sends all the SCSI related IRP’s to a userspace channel where they can be decoded and logged.
My scsi driver isn’t showing any errors anywhere and yet backup software is getting ERROR_IO_DEVICE every so often when writing to a tape drive. Retrying the write almost always works on the 2nd or 3rd try, so I’m worried that something else is injecting scsi commands or something.
I tried running procmon hoping that that would show who’s ‘touching’ the Tape0 device or the scsi channel but it doesn’t seem to show me that under 2008 x64.
I am an old tape guy. As far as I can tell the only tool mentioned thus far that will work for this is Bus Hound because it is 64-bit and logs SRB’s. The caveat is the free version probably won’t be sufficient in this case. Tape drives are constantly polled for media changes using TUR. This could be picking up a deferred error from a write command. The error can be efficiently identified by telling Bus Hound to trigger on a media error. It is not a good idea to retry write commands to a sequential tape device. In case of an error, a fatal error should be reported and any data written to the tape in the session treated as suspect.
I am an old tape guy. As far as I can tell the only tool mentioned
thus far
that will work for this is Bus Hound because it is 64-bit and logs
SRB’s. The
caveat is the free version probably won’t be sufficient in this case.
Tape
drives are constantly polled for media changes using TUR. This could
be
picking up a deferred error from a write command. The error can be
efficiently
identified by telling Bus Hound to trigger on a media error. It is not
a good
idea to retry write commands to a sequential tape device. In case of
an error,
a fatal error should be reported and any data written to the tape in
the
session treated as suspect.
The problem I’m having is that the backup software suddenly gets
ERROR_IO_DEVICE, but two or three (or up to 5) retries later it
succeeds. Also if I do a GetTapeStatus it fails with ERROR_IO_DEVICE
sometimes but then succeeds on the next try. I’m thinking more and more
that it’s a problem with the backup software doing something wrong, and
nothing to do with the driver at all…
Thanks for the tip though, I’ll look into Bus Hound.