SQL Server, Procmon and a minfilter

NTFSD
1

Hi,

Sorry for the strange title, but I’m experiencing an error condition
which seems to involve the 3 mentioned components. Whenever I start the
SQL Server service (e.g. mssql$sqlexpress) while the Procmon.exe is
running I get an error like this in the application event log:

FCB::RemoveAlternateStreams: Operating system error (null) occurred
while creating or opening file ‘c:\Program Files (x86)\Microsoft SQL
Server\MSSQL.1\MSSQL\DATA\master.mdf’. Diagnose and correct the
operating system error, and retry the operation.

This error is flagged for all the SQL database files (.mdf). If I
restart the service without Procmon running, everything goes cleanly, no
errors. This happens consistently on both Windows 2003 and 2008. On a
Windows 2003 box, I tried to run with the old good Filemon instead, and
the error did not occur. IIRC, the Filemon uses the legacy fs filter and
the Procmon does the same thing with a minifilter. It seems the sqlservr
process stumbles on a BackupSeek() call, which returns an error with the
monitoring minifilter (PROCMON20) and works cleanly without it.

I’m running into the same problem with my own minifilter as well. I’m
wondering if someone experienced similar behavior or can comment on
that.

Thanks,

  • Vitaly
2

> I?m running into the same problem with my own minifilter as well.

I?m wondering if someone experienced similar behavior or can comment on that.

Could you try that while running FileSpy using Minifilter ?
(Options/Choose Driver/Minispy)

L.

3

Hi Ladislav,

I downloaded your FileSpy (a nice tool!) and ran it in the MSpy mode as
you had suggested. The same issue occurred.

So, I’ve tried now 3 different minifilter drivers all causing the same
effect on the sqlservr process’ behavior.
Running with legacy filters cause no problems.

At this point I begin to wonder if the Microsoft filter manager team has
any thoughts on that.

Thanks,

  • Vitaly

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ladislav Zezula
Sent: Thursday, March 12, 2009 2:21 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] SQL Server, Procmon and a minfilter

I’m running into the same problem with my own minifilter as well.
I’m wondering if someone experienced similar behavior or can comment
on that.

Could you try that while running FileSpy using Minifilter ?
(Options/Choose Driver/Minispy)

L.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Vitaly,

Can you send me the output of ‘fltmc’ indicating what filters are
attached to the volume when the error occurs?

Also can you trace into the file system calls issued by BackupSeek() and
tell me which one failed and with what status?

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights

Vitaly Vatnikov wrote:

Hi,

Sorry for the strange title, but I’m experiencing an error condition
which seems to involve the 3 mentioned components. Whenever I start the
SQL Server service (e.g. mssql$sqlexpress) while the Procmon.exe is
running I get an error like this in the application event log:

FCB::RemoveAlternateStreams: Operating system error (null) occurred
while creating or opening file ‘c:\Program Files (x86)\Microsoft SQL
Server\MSSQL.1\MSSQL\DATA\master.mdf’. Diagnose and correct the
operating system error, and retry the operation.

This error is flagged for all the SQL database files (.mdf). If I
restart the service without Procmon running, everything goes cleanly, no
errors. This happens consistently on both Windows 2003 and 2008. On a
Windows 2003 box, I tried to run with the old good Filemon instead, and
the error did not occur. IIRC, the Filemon uses the legacy fs filter and
the Procmon does the same thing with a minifilter. It seems the sqlservr
process stumbles on a BackupSeek() call, which returns an error with the
monitoring minifilter (PROCMON20) and works cleanly without it.

I’m running into the same problem with my own minifilter as well. I’m
wondering if someone experienced similar behavior or can comment on that.

Thanks,

  • Vitaly