XPE EWF RAM Memory usage

[Godzilla]

Dear all,

I have an embedded system with a CF drive partitioned into three
partitions, C:\ (protected), D:\ (unprotected) and a EWF partition. All
OS files and my custom software is installed and run from the protected
volume, C:\. Log data and other less important files go to the
unprotected volume D:\. I have been using EWF RAM mode for about a
month right now and am monitoring the memory usage via the task manager
closely. Also have IIS running and have a website running and a page
set to auto refresh every 10 seconds.

My question is, even though I have redirected the event log files and
internet temporary files to D:\, stop the OS updating the timestamp of
each file being acccessed, the RAM usage is still incrementing about 1
~ 2 Mb per day... Is it due to the refreshing of my custom website? I
am not sure why the OS still writes to RAM even though I have
redirected all the writes to D:\ from my custom apps.

Please advise. Thanks!

 

[Sean Liming \(eMVP\)]

The OS is contstantly reading and writing from the boot disk. It might be
possible to use something like FileMon from Systernals to track down which
files are increasing in size. Is this a 24/7 system?

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit

 

[Godzilla]

Hi Sean,

Thanks for your reply and I thoroughly enjoyed your talk when you were
in Melbourne back in May! It will be a 24/7 system and we hope the RAM
usage wont increase too much because we dont want to restart each and
every one just to regain the RAM.

The interesting thing is that when we stop the web page from
refreshing, the RAM usage stays where it is... I had previously stated
that we redirected the internet temporary files to the unprotected
volume, D:\, and unless the IIS is doing something else in the
background, we can't really tell what caused the RAM usage increase. I
will get FileMon to do some monitoring... thanks for your suggestion.

Also, if we do wanna flush the overlay without committing and
restarting the PCs, is there a method to do that? In addition, how much
does the OS takes to write to the boot disk? I.e. 10Kb/s, 100Kb/s?

Thanks and have a good day!

 

[mike.zelina]

Also, if we do wanna flush the overlay without committing and
restarting the PCs, is there a method to do that? In addition, how much
does the OS takes to write to the boot disk? I.e. 10Kb/s, 100Kb/s?

Try the following command:

ewfmgr c: -setlevel=0

or

ewfmgr c: -setlevel=1

Of course you'll need to include the ewfmgr component!

 

[Sean Liming \(eMVP\)]

Interesting, I thought setlevel was only for disk overlays.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit

 

[Sean Liming \(eMVP\)]

I was glad to survive the trip down there. Pressurizing cabins are a good
thing.

I think Filemon might be your best bet at tracking down what is growing in
the image.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit

 

[Godzilla]

Hi all,

I ran the filemon program and found out that the HTTP and FTP servers
are caching logging info into C:\Windows\System32... After redirecting
those log files to D:\, and run the same setup again over the weekend,
the amount of RAM usage increased about the same rate as before...

After digging more info from the filemon program, it shows that the OS
is doing a lot of reading to the virtual directory, and also to D:\,
where majority of the log files are kept. I just wondering whether read
and open directory operations at all can contribute to the RAM usage
increase? I see no write operation to C:\ according to filemon. I
thought EWF overlay only filters out writes operation... remember that
I turned off the timestamping update for each file whenever the file is
being accessed by the OS.

 

[Godzilla]

Hi all,

Just to confirm that the RAM usage has actually stopped increasing
after a period. The trick was to redirect the IIS's HTTP & FTP log
files away from the protected drive.