EFWMGR causes locking up??

[BeeFarmer]

I've been having some issues with XPe for some time now. I started using a
CF unit
and it would always fails as the TIF would fill up the CF after what seemed
to be corruption
of the TIF. I contacted Microsoft and they told me we should be using EWF
so that writes
are not created on the device and that there has been issues where the TIF
gets corrupted.

Our product is basically an device with XPe as the OS written to a ewf
protected CF. All
that is required for the device to do it go out and hit a website and make
selections.

We still keep the TIF set to about 7 megs and have some event logs tracking.
With EWF enabled these units lock up at screens and sometimes drop to the
desktop while in IE. When we disable the EWF the units appear to run fine
without issues, although we are doomed at some point as we fear the units
will run out of space or even wear out the CF chip.

Has anyone else dealt with this type of issues and any assistance is greatly
appreciated.

 

[Slobodan Brcin]

I currently too tired to think clearly.

I don't know what TIF is, but if your system or application tries to write
to protected partition you will run out of memory since EWF memory
requirement will grow. You can use efwmgr to see how much of memory is
consumed.
There is no other solution but to make your app and OS use minimum writes to
protected partition.

Regards,
Slobodan

 

[Steffen Poppe]

Hi Slobodan,

I don't know what TIF is, but if your system or application tries to
write to protected partition you will run out of memory since EWF
memory requirement will grow. You can use efwmgr to see how much of
memory is consumed.

I 'd like to know, what exactly happens, if the ewf overlay-volume runs
out of memory... Are the changes lost, or written to the protected
volume? I use a ram-overlay!


Steffen

for private reply use sp_bw(AT)gmx.de

 

[Slobodan Brcin]

Steffen,

General idea behind RAM EWF is to protect any write to disk, unless told
otherwise.
It means that if you don't call commit explicitly and don't reboot after,
all your changes will be lost.

commit tell EWF driver to write all changes when Windows shutdown, not
sooner than that.

If you run out of space, Well I have never had pleasure to see this, but I
guess what EWF driver must do. It should bug check because otherwise it
would compromise data integrity, and it could probably lead to random
application crashes.

Also I have read from some MS document that it is using kernel non-paged
memory pool. This memory has limitation of max 256MB so if you have
unlimited memory this would be max limit to use.
Also other drivers use this memory, and if they don't get needed memory when
they request it, they will probably bug check.

I don't know why MS chose to use non-paged memory (this is probably because
of allocation speed) they could probably allocate physical memory instead,
like video driver allocates if for AGP usage.

They probably thought that you don't have so much memory to waste, and that
you should minimize your writes to protected partition.

All this are only speculation, MS could give you better answer.

Best regards,
Slobodan

 

[BeeFarmer]

TIF is Temporary Internet Files. Sorry I should of said that first.

 

[BeeFarmer]

What are you calling a ram overlay? I know we tested with a ram disk\drive
for awhile
and left that idea for ewf. I wonder if a ram drive\disk and ewf would work
together.

Probably a dumb idea for us to try.

 

[Slobodan Brcin]

You should ask new question "how to disable internet temporary files?" I
don't know how, but someone might.

What are you calling a ram overlay?

Ram based EWF.

Is this third-party ram disk?
You should be able to use them together but use EWF to protect CF only.

I have conducted some test today on RAM EWF, Soon I'll post valid results.

Regads,
Slobodan

 

[Slobodan Brcin]

I 'd like to know, what exactly happens, if the ewf overlay-volume runs

out of memory... Are the changes lost, or written to the protected
volume? I use a ram-overlay!

I have tried to manually overload RAM EWF and I got following results.

1. EWF does not use non-paged memory (at least not for data) contrary to
what is said in Target Designer Guide section Enhanced Write Filter.
2. When you use almost all available physical memory Windows start popping
message boxes from few services that start complaining that they have write
errors. Also ewfmgr c: start responding etc.
In other word total collapse (unpredictable behavior), but not BSOD.
3. I was able to go far beyond 256MB, last check from ewfmgr c: stated that
above 340 MB was consumed by EWF. I have 512MB RAM in my system.
4. Of course changes are lost when you reboot, this is good, otherwise it
would be error in EWF driver.



Best regards,
Slobodan

 

[Steffen Poppe]

Hi Slobodan,

I have tried to manually overload RAM EWF and I got following results.
Filter. 2. When you use almost all available physical memory Windows
start popping message boxes from few services that start complaining
that they have write errors. Also ewfmgr c: start responding etc.
In other word total collapse (unpredictable behavior), but not BSOD.

Ok. So I have to secure, that ewf doesn't run out of memory.

My problem is, that I have to update an erlier XPE-Image with the ewf-
function (the old version is on CF and has no EWF installed). But this
system only has 112MB RAM available. I configured the ewf with 16 MB. So
that only 96 MB of RAM are available. I hope that no such problems
occur. But if this happens, I know, what to do... - Add more RAM.

Thank you!

Steffen

for private reply use sp_bw(AT)gmx.de

 

[Slobodan Brcin]

Steffen,

You don't need more ram for EWF.
1. RAM EWF can not be configured how much ram it should use. If you default
MS way for configuring EWF options you see in TD are not used for RAM EWF.
2. RAM EWF will consume memory only to reflect changes that should be
otherwise done on CF. So for example my EWF does not consume more than 100KB
of memory. You should configure all programs and services to stop writing to
protected media. More you are able to remove or disable smaller impact on
EWF will be done.
Only things that you can't stop from writing to protected partition will
force EWF to consume memory.

You should look in old postings in this NG, how to disable, many things,
like:
pagefile support, disk defragmenter, etc.

By the way if you have more memory than the size of protected partition,
then you should be ok

Best regards,
Slobodan

 

[Steffen Poppe]

Hi Slobodan,

You should look in old postings in this NG, how to disable, many
things, like:
pagefile support, disk defragmenter, etc.

as far as i know the pagefile-support isn't enabled by deafult. And the
disk defragmenter is also not included. But I'll take a look at
google...

By the way if you have more memory than the size of protected
partition, then you should be ok

The CF is 256 MB. But the Image is about 130 MB. The future systems will
have more RAM anyway. So that this doesn't become a problem... But there
are about 25 Systems with the old configuration, need to be fixed... And
changing the RAM there is a little bit tricky!


Steffen

for private reply use sp_bw(AT)gmx.de

 

[Doug Hoeffel \(eMVP\)]

The system with blue screen.

Hi Slobodan,


I 'd like to know, what exactly happens, if the ewf overlay-volume runs
out of memory... Are the changes lost, or written to the protected
volume? I use a ram-overlay!


Steffen

for private reply use sp_bw(AT)gmx.de

 

[Slobodan Brcin]

Hi Doug,

No it does not BSOD, I though so myself but I have tried it yesterday.
It start failing writes. What other services and programs will do with this
it depends.

But BSOD would be probably better than this. And in some case it could
probably BSOD, but BSOD is not cased by EWF driver.

Regards,
Slobodan

 

[BeeFarmer]

I've been doing some testing and found that as we continued using the
program we finally get basically
a GPF message in IE. We also notice as we continue to use the system the PF
Usage continues to grow
to the point where it appears to crash the system. Does EWF flush out the
memory at any point or is this
what we should be expecting to happen with usage?

 

[BeeFarmer]

Did some more testing and this is what I found out.

The unit doesn't have any programs running

other than IE. There are about three unique problems that have been
encountered

the first one is that IE drops to the desktop and closes and you are left at
the desktop.

Second, while going from one page to another with IE a white screen will
pop-up

not allowing you to move from it. Thirdly, a page will not display
completely

and hang up.

What we have noted is that in Task manager is that the PF Usage will
continue to

grow and once it reaches about 104mb the unit will start having these
issues. We

also get an application error message in IE "The exception unknown software
exception

(0xc00000fd)occurred in the application location 0x760f1f94. This will shut
down

IE. Sometimes we don't get the error message but IE will just close out.

We are using Our feeling is that the unit is using up all the memory and
not flushing it out. Maybe

the temp files are being deleted the space they occupy is not.

 

[Slobodan Brcin]

I hope that you are not using pagefile on CF? Or worse in protected
partition.

PF Usage does not mean to much.

But you should look to Physical Memory, and Kernel Memory instead.
Three numbers in each set.

Look to physical memory, available, when it go bellow 8 MB chaos will start,
in your case maybe even higher value.

Regarding deleting files. Since EWF does not protect file system, deleting
files won't do any good, since changes made to partition, are still in
effect when you delete files.

You must block creation of temp files, or limit them somehow.


For test purposes you can direct them to second protected partition with
small size let say 16MB or 32MB. So EWF memory usage can't grow beyond this
size.


Regards,
Slobodan

 

[Doug Hoeffel \(eMVP\)]

Sobodan:

Hopefully this post does not appear twice as I responded this morning but it
seems to have gotten lost.

In my experience, I've seen blue screens. During my 24x7 automated testing,
once I forgot to redirect my event logging to a non-EWF protected partition.
Since my application does alot of event logging my machine BSOD during
overnight testing.

I can't say whether or not I saw delayed write messages in the event log
since I didn't look, or maybe I just didn't notice them.

.... Doug