EFWMGR causes locking up??

I've been having some issues with XPe for some time now. I started using a
CF unit
and it would always fails as the TIF would fill up the CF after what seemed
to be corruption
of the TIF. I contacted Microsoft and they told me we should be using EWF
so that writes
are not created on the device and that there has been issues where the TIF
gets corrupted.

Our product is basically an device with XPe as the OS written to a ewf
protected CF. All
that is required for the device to do it go out and hit a website and make
selections.

We still keep the TIF set to about 7 megs and have some event logs tracking.
With EWF enabled these units lock up at screens and sometimes drop to the
desktop while in IE. When we disable the EWF the units appear to run fine
without issues, although we are doomed at some point as we fear the units
will run out of space or even wear out the CF chip.

Has anyone else dealt with this type of issues and any assistance is greatly
appreciated.

I currently too tired to think clearly.

I don't know what TIF is, but if your system or application tries to write
to protected partition you will run out of memory since EWF memory
requirement will grow. You can use efwmgr to see how much of memory is
consumed.
There is no other solution but to make your app and OS use minimum writes to
protected partition.

Regards,
Slobodan

"BeeFarmer" <OhioBeeFarmer@Hotmail.com> wrote in message
news:bmre6q$q7u9a$1@ID-66812.news.uni-berlin.de...
> I've been having some issues with XPe for some time now. I started using
a
> CF unit
> and it would always fails as the TIF would fill up the CF after what
seemed
> to be corruption
> of the TIF. I contacted Microsoft and they told me we should be using
EWF
> so that writes
> are not created on the device and that there has been issues where the TIF
> gets corrupted.
>
> Our product is basically an device with XPe as the OS written to a ewf
> protected CF. All
> that is required for the device to do it go out and hit a website and make
> selections.
>
> We still keep the TIF set to about 7 megs and have some event logs
tracking.
> With EWF enabled these units lock up at screens and sometimes drop to the
> desktop while in IE. When we disable the EWF the units appear to run
fine
> without issues, although we are doomed at some point as we fear the units
> will run out of space or even wear out the CF chip.
>
> Has anyone else dealt with this type of issues and any assistance is
greatly
> appreciated.
>
>
>
>

Hi Slobodan,

>I don't know what TIF is, but if your system or application tries to
>write to protected partition you will run out of memory since EWF
>memory requirement will grow. You can use efwmgr to see how much of
>memory is consumed.

I 'd like to know, what exactly happens, if the ewf overlay-volume runs
out of memory... Are the changes lost, or written to the protected
volume? I use a ram-overlay!


Steffen

for private reply use sp_bw(AT)gmx.de

Steffen,

General idea behind RAM EWF is to protect any write to disk, unless told
otherwise.
It means that if you don't call commit explicitly and don't reboot after,
all your changes will be lost.

commit tell EWF driver to write all changes when Windows shutdown, not
sooner than that.

If you run out of space, Well I have never had pleasure to see this, but I
guess what EWF driver must do. It should bug check because otherwise it
would compromise data integrity, and it could probably lead to random
application crashes.

Also I have read from some MS document that it is using kernel non-paged
memory pool. This memory has limitation of max 256MB so if you have
unlimited memory this would be max limit to use.
Also other drivers use this memory, and if they don't get needed memory when
they request it, they will probably bug check.

I don't know why MS chose to use non-paged memory (this is probably because
of allocation speed) they could probably allocate physical memory instead,
like video driver allocates if for AGP usage.

They probably thought that you don't have so much memory to waste, and that
you should minimize your writes to protected partition.

All this are only speculation, MS could give you better answer.

Best regards,
Slobodan

"Steffen Poppe" <SP_BWnospam@gmx.de> wrote in message
news:8wBFVNpEmeB@poppe-1234.user.cis.dfn.de...
>
> Hi Slobodan,
>
> >I don't know what TIF is, but if your system or application tries to
> >write to protected partition you will run out of memory since EWF
> >memory requirement will grow. You can use efwmgr to see how much of
> >memory is consumed.
>
> I 'd like to know, what exactly happens, if the ewf overlay-volume runs
> out of memory... Are the changes lost, or written to the protected
> volume? I use a ram-overlay!
>
>
> Steffen
>
> for private reply use sp_bw(AT)gmx.de

TIF is Temporary Internet Files. Sorry I should of said that first.


"Slobodan Brcin" <sbrcin@ptt.yu> wrote in message
news:eVf2mJjlDHA.1948@TK2MSFTNGP12.phx.gbl...
> Steffen,
>
> General idea behind RAM EWF is to protect any write to disk, unless told
> otherwise.
> It means that if you don't call commit explicitly and don't reboot after,
> all your changes will be lost.
>
> commit tell EWF driver to write all changes when Windows shutdown, not
> sooner than that.
>
> If you run out of space, Well I have never had pleasure to see this, but I
> guess what EWF driver must do. It should bug check because otherwise it
> would compromise data integrity, and it could probably lead to random
> application crashes.
>
> Also I have read from some MS document that it is using kernel non-paged
> memory pool. This memory has limitation of max 256MB so if you have
> unlimited memory this would be max limit to use.
> Also other drivers use this memory, and if they don't get needed memory
when
> they request it, they will probably bug check.
>
> I don't know why MS chose to use non-paged memory (this is probably
because
> of allocation speed) they could probably allocate physical memory instead,
> like video driver allocates if for AGP usage.
>
> They probably thought that you don't have so much memory to waste, and
that
> you should minimize your writes to protected partition.
>
> All this are only speculation, MS could give you better answer.
>
> Best regards,
> Slobodan
>
> "Steffen Poppe" <SP_BWnospam@gmx.de> wrote in message
> news:8wBFVNpEmeB@poppe-1234.user.cis.dfn.de...
> >
> > Hi Slobodan,
> >
> > >I don't know what TIF is, but if your system or application tries to
> > >write to protected partition you will run out of memory since EWF
> > >memory requirement will grow. You can use efwmgr to see how much of
> > >memory is consumed.
> >
> > I 'd like to know, what exactly happens, if the ewf overlay-volume runs
> > out of memory... Are the changes lost, or written to the protected
> > volume? I use a ram-overlay!
> >
> >
> > Steffen
> >
> > for private reply use sp_bw(AT)gmx.de
>
>

What are you calling a ram overlay? I know we tested with a ram disk\drive
for awhile
and left that idea for ewf. I wonder if a ram drive\disk and ewf would work
together.

Probably a dumb idea for us to try.


"Steffen Poppe" <SP_BWnospam@gmx.de> wrote in message
news:8wBFVNpEmeB@poppe-1234.user.cis.dfn.de...
>
> Hi Slobodan,
>
> >I don't know what TIF is, but if your system or application tries to
> >write to protected partition you will run out of memory since EWF
> >memory requirement will grow. You can use efwmgr to see how much of
> >memory is consumed.
>
> I 'd like to know, what exactly happens, if the ewf overlay-volume runs
> out of memory... Are the changes lost, or written to the protected
> volume? I use a ram-overlay!
>
>
> Steffen
>
> for private reply use sp_bw(AT)gmx.de

You should ask new question "how to disable internet temporary files?" I
don't know how, but someone might.

> What are you calling a ram overlay?
Ram based EWF.

Is this third-party ram disk?
You should be able to use them together but use EWF to protect CF only.

I have conducted some test today on RAM EWF, Soon I'll post valid results.

Regads,
Slobodan

"BeeFarmer" <OhioBeeFarmer@Hotmail.com> wrote in message
news:bmtvr2$qi8l9$1@ID-66812.news.uni-berlin.de...
> What are you calling a ram overlay? I know we tested with a ram
disk\drive
> for awhile
> and left that idea for ewf. I wonder if a ram drive\disk and ewf would
work
> together.
>
> Probably a dumb idea for us to try.
>
>
> "Steffen Poppe" <SP_BWnospam@gmx.de> wrote in message
> news:8wBFVNpEmeB@poppe-1234.user.cis.dfn.de...
> >
> > Hi Slobodan,
> >
> > >I don't know what TIF is, but if your system or application tries to
> > >write to protected partition you will run out of memory since EWF
> > >memory requirement will grow. You can use efwmgr to see how much of
> > >memory is consumed.
> >
> > I 'd like to know, what exactly happens, if the ewf overlay-volume runs
> > out of memory... Are the changes lost, or written to the protected
> > volume? I use a ram-overlay!
> >
> >
> > Steffen
> >
> > for private reply use sp_bw(AT)gmx.de
>
>

> I 'd like to know, what exactly happens, if the ewf overlay-volume runs
> out of memory... Are the changes lost, or written to the protected
> volume? I use a ram-overlay!

I have tried to manually overload RAM EWF and I got following results.

1. EWF does not use non-paged memory (at least not for data) contrary to
what is said in Target Designer Guide section Enhanced Write Filter.
2. When you use almost all available physical memory Windows start popping
message boxes from few services that start complaining that they have write
errors. Also ewfmgr c: start responding etc.
In other word total collapse (unpredictable behavior), but not BSOD.
3. I was able to go far beyond 256MB, last check from ewfmgr c: stated that
above 340 MB was consumed by EWF. I have 512MB RAM in my system.
4. Of course changes are lost when you reboot, this is good, otherwise it
would be error in EWF driver.



Best regards,
Slobodan

Hi Slobodan,

>> I 'd like to know, what exactly happens, if the ewf overlay-volume
>> runs out of memory... Are the changes lost, or written to the
>> protected volume? I use a ram-overlay!

>I have tried to manually overload RAM EWF and I got following results.
>Filter. 2. When you use almost all available physical memory Windows
>start popping message boxes from few services that start complaining
>that they have write errors. Also ewfmgr c: start responding etc.
>In other word total collapse (unpredictable behavior), but not BSOD.

Ok. So I have to secure, that ewf doesn't run out of memory.

My problem is, that I have to update an erlier XPE-Image with the ewf-
function (the old version is on CF and has no EWF installed). But this
system only has 112MB RAM available. I configured the ewf with 16 MB. So
that only 96 MB of RAM are available. I hope that no such problems
occur. But if this happens, I know, what to do... - Add more RAM.

Thank you!

Steffen

for private reply use sp_bw(AT)gmx.de

Steffen,

You don't need more ram for EWF.
1. RAM EWF can not be configured how much ram it should use. If you default
MS way for configuring EWF options you see in TD are not used for RAM EWF.
2. RAM EWF will consume memory only to reflect changes that should be
otherwise done on CF. So for example my EWF does not consume more than 100KB
of memory. You should configure all programs and services to stop writing to
protected media. More you are able to remove or disable smaller impact on
EWF will be done.
Only things that you can't stop from writing to protected partition will
force EWF to consume memory.

You should look in old postings in this NG, how to disable, many things,
like:
pagefile support, disk defragmenter, etc.

By the way if you have more memory than the size of protected partition,
then you should be ok

Best regards,
Slobodan

"Steffen Poppe" <SP_BWnospam@gmx.de> wrote in message
news:8wBG7MYUmeB@poppe-1234.user.cis.dfn.de...
> Hi Slobodan,
>
> >> I 'd like to know, what exactly happens, if the ewf overlay-volume
> >> runs out of memory... Are the changes lost, or written to the
> >> protected volume? I use a ram-overlay!
>
> >I have tried to manually overload RAM EWF and I got following results.
> >Filter. 2. When you use almost all available physical memory Windows
> >start popping message boxes from few services that start complaining
> >that they have write errors. Also ewfmgr c: start responding etc.
> >In other word total collapse (unpredictable behavior), but not BSOD.
>
> Ok. So I have to secure, that ewf doesn't run out of memory.
>
> My problem is, that I have to update an erlier XPE-Image with the ewf-
> function (the old version is on CF and has no EWF installed). But this
> system only has 112MB RAM available. I configured the ewf with 16 MB. So
> that only 96 MB of RAM are available. I hope that no such problems
> occur. But if this happens, I know, what to do... - Add more RAM.
>
> Thank you!
>
> Steffen
>
> for private reply use sp_bw(AT)gmx.de