ewf.sys ... failed ?

[Petr Odlozil]

Hello,

I'm using ewf component on c: compact flash partition, after about two
hours I get STOP ERROR and blue screen caused by EWF.SYS and the
description is PAGE_FAULT_IN_NONPAGED_AREA,
STOP : 0x00000050 (0x816D06DC,0x00000000,0xF95508A,0x00000000)

Do you have any suggestions please ?

Petr

 

[Petr Odlozil]

I've found that when I do "dir" command I'm getting different size of
free space. It may have been caused by my application, which created
temporary log file and deleted it when it reached 64kB.
But the size of directory grew over and over. I disabled this temporary
file and the directory has still the same size, but when I do the dir
command the free space doesn't get lower so fast, but still gets lower.
Especially when I do something in the system, e.g. close and open a
window. ( I mean not the window of my application - I mean the system
window).
Is there anything in the system which may create this lowering of
resources ? Or how can I find it out ?

Petr

 

[KM]

Petr,

I know very little about your application (just from your description below) so cannot comment on it. But I'd recommend you to
minimize the writes on protected volumes. If you are not sure which components make intensive writting to the volume, use Filemon to
analyze the system work. (don't use "dir" as it gives you very little info)

With regards to the EWF BSOD, make sure you are with the latest SP and/or latest QFE for EWF.

KM

 

[Petr Odlozil]

Thanks KM,
I've used filemon and findout that only SQL Server MSDE is writing to
software.log .. Do you know, if there is a way how to disable it ?

Petr

 

[KM]

Petr,

Thanks KM,
I've used filemon and findout that only SQL Server MSDE is writing to
software.log .. Do you know, if there is a way how to disable it?

Are you saying that MSDE writting too much to SOFTWARE registry hive log?
How big is the log becoming after some time jsut before you see the BSOD?

Btw, do you have the database instances of MSDE set up on protected or unprotected volumes? (better be on unprotected volume)


--
Regards,
KM, BSquare Corp.

 

[Petr Odlozil]

Yes the filemon gives me every minute these 5 information :

1. sqlserver : WRITE C: ... offset 4096
2. sqlserver : SET INFORMATION
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG...length 8192
3. sqlserver : WRITE C: ... offset 4096
4. sqlserver : SET INFORMATION
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG...length 8192
5. sqlserver : SET INFORMATION
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG...length 16384

I do have SQLServer installed on the unprotected partition, both the
application and data directory. The only thing I wanted to leave at the
protected partition was my application, which doesn't perform any writes
to the drive.

Petr

 

[KM]

Petr,

The software.log is a transaction log of changes to the keys and value entries in the SOFTWARE hive.
No doubt SQL Server can constantly update some values in the hive, especially if you are using the database engine from your
application. You can find out the values using Regmon.

You don't know yet whether it is the MSDE which is the cause for BSOD.
So you may want to check:
- what size the Software hive is growing up to on your target.
- what size the Software hive log (software.log) is growing up to on the system.
- what is EWF overlay usage is and how it grows. (use ewfmgr c: command)

(you haven't told us what EWF type you use so you will have to see what resource (RAM, DISK) it may be in luck of).

KM

 

[Petr Odlozil]

KM,

Using regmon I've found that SQLserver chnages following keys:
(REG_DWORD)HKLM\SOFTWARE\Microsoft\MicrosoftSQLServer\<Instancename>\FARCOM\MSSQLServer\uptime_pid
(REG_BINARY)HKLM\SOFTWARE\Microsoft\MicrosoftSQLServer\<Instancename>\FARCOM\MSSQLServer\uptime_time_utc

I have CF and EWF RAM REG Mode and then a harddrive with the instance of
DB server. After running this configuration for a while I didn't see any
changes in size of Memory Used for Data connected with the writes to
software registry ... and its about 9,256 MBytes and not any changes in
the size of SOFTWARE hive and not even the size of SOFTWARE.log.

I must admit that the problem seems to be caused by overheating of the
system, because when I've tried overheat the system from the external
source it failed much quicker with the same error
PAGE_FAULT_IN_NON_PAGED_AREA and even when the SQL Server wasn't running.

Petr

 

[Slobodan Brcin \(eMVP\)]

Petr,

EWF is probably not a problem as you already determined. All these writes to registry are in place so EWF overlay memory usage will
not grow. You might have bad memory module beside the overheating problem, please try using second test platform if you have it to
confirm or rule out failure results.

Regards,
Slobodan