problem with minifilter driver , failover environment, IRP_MJ_SET_INFORMATION, share access with smb

Hallo,

i use a minifilter driver to collect file activities (like the minispy
example). Now i have a problem in a special environment use case.

Testenvironment: 3 node failover cluster (MS 2012 R2), role “file
server”, set share access with high availability feature (Default)
(smb3 transparent failover);

The test is a simple rename of a file. In case of check
IRP_MJ_SET_INFORMATION in pre and post callback the client side
initiator application explorer freeze or if i use powershell or
command console the action is not allowed. If i disable the driver the
test run. Shares without this HA-Feature and running minifilter
driver also runs.

Any idea what is wrong.

Thanks

Does this happen with a stock version of minispy?

Have you looked at Process Monitor and/or WireShark traces from the working
and non-working cases?

-scott
OSR
@OSRDrivers

“Jörg Wittig” wrote in message news:xxxxx@ntfsd…

Hallo,

i use a minifilter driver to collect file activities (like the minispy
example). Now i have a problem in a special environment use case.

Testenvironment: 3 node failover cluster (MS 2012 R2), role “file
server”, set share access with high availability feature (Default)
(smb3 transparent failover);

The test is a simple rename of a file. In case of check
IRP_MJ_SET_INFORMATION in pre and post callback the client side
initiator application explorer freeze or if i use powershell or
command console the action is not allowed. If i disable the driver the
test run. Shares without this HA-Feature and running minifilter
driver also runs.

Any idea what is wrong.

Thanks

Am 06.01.17 um 16:20 schrieb Scott Noone:

Does this happen with a stock version of minispy?

Have you looked at Process Monitor and/or WireShark traces from the
working and non-working cases?

-scott
OSR
@OSRDrivers

“Jörg Wittig” wrote in message news:xxxxx@ntfsd…

Hallo,

i use a minifilter driver to collect file activities (like the minispy
example). Now i have a problem in a special environment use case.

Testenvironment: 3 node failover cluster (MS 2012 R2), role “file
server”, set share access with high availability feature (Default)
(smb3 transparent failover);

The test is a simple rename of a file. In case of check
IRP_MJ_SET_INFORMATION in pre and post callback the client side
initiator application explorer freeze or if i use powershell or
command console the action is not allowed. If i disable the driver the
test run. Shares without this HA-Feature and running minifilter
driver also runs.

Any idea what is wrong.

Thanks

hallo scott,

after additional tests (different stock versions) i did not found
another causes. Only with the smb3 feature high availability did i have
trouble. All other situations works fine. If i have interaction with
filter manager wait for callback and leave the callback the initial
function is not executed. I had forgot to say the filter runs on server
side.

Best regards
Jörg

I’m not sure you answered my question…Does this some failure happen if you
use the minispy sample and HA? Or just with your filter and HA?

-scott
OSR
@OSRDrivers

“Jörg Wittig” wrote in message news:xxxxx@ntfsd…

Am 06.01.17 um 16:20 schrieb Scott Noone:

Does this happen with a stock version of minispy?

Have you looked at Process Monitor and/or WireShark traces from the
working and non-working cases?

-scott
OSR
@OSRDrivers

“Jörg Wittig” wrote in message news:xxxxx@ntfsd…

Hallo,

i use a minifilter driver to collect file activities (like the minispy
example). Now i have a problem in a special environment use case.

Testenvironment: 3 node failover cluster (MS 2012 R2), role “file
server”, set share access with high availability feature (Default)
(smb3 transparent failover);

The test is a simple rename of a file. In case of check
IRP_MJ_SET_INFORMATION in pre and post callback the client side
initiator application explorer freeze or if i use powershell or
command console the action is not allowed. If i disable the driver the
test run. Shares without this HA-Feature and running minifilter
driver also runs.

Any idea what is wrong.

Thanks

hallo scott,

after additional tests (different stock versions) i did not found
another causes. Only with the smb3 feature high availability did i have
trouble. All other situations works fine. If i have interaction with
filter manager wait for callback and leave the callback the initial
function is not executed. I had forgot to say the filter runs on server
side.

Best regards
Jörg

Hi Scoot ,

the problem occurs with my filter and HA. The minispy sample
implementation served as a base model (concept).

my filter on -> share with HA -> problem if rename triggered, other
file actions are not affected
my filter off -> share with HA -> no problem
my filter on -> same share HA off -> no problem

greetings and thanks for the support
jörg

Am 17.01.2017 um 20:59 schrieb Scott Noone:

I’m not sure you answered my question…Does this some failure happen if
you use the minispy sample and HA? Or just with your filter and HA?

-scott
OSR
@OSRDrivers

“Jörg Wittig” wrote in message news:xxxxx@ntfsd…

Am 06.01.17 um 16:20 schrieb Scott Noone:
> Does this happen with a stock version of minispy?
>
> Have you looked at Process Monitor and/or WireShark traces from the
> working and non-working cases?
>
> -scott
> OSR
> @OSRDrivers
>
> “Jörg Wittig” wrote in message news:xxxxx@ntfsd…
>
> Hallo,
>
> i use a minifilter driver to collect file activities (like the minispy
> example). Now i have a problem in a special environment use case.
>
> Testenvironment: 3 node failover cluster (MS 2012 R2), role “file
> server”, set share access with high availability feature (Default)
> (smb3 transparent failover);
>
> The test is a simple rename of a file. In case of check
> IRP_MJ_SET_INFORMATION in pre and post callback the client side
> initiator application explorer freeze or if i use powershell or
> command console the action is not allowed. If i disable the driver the
> test run. Shares without this HA-Feature and running minifilter
> driver also runs.
>
> Any idea what is wrong.
>
> Thanks
>
>
hallo scott,

after additional tests (different stock versions) i did not found
another causes. Only with the smb3 feature high availability did i have
trouble. All other situations works fine. If i have interaction with
filter manager wait for callback and leave the callback the initial
function is not executed. I had forgot to say the filter runs on server
side.

Best regards
Jörg

What I’ve been asking is if you take the minispy sample *as is* and install
it on the server, do you get the same behavior? If not, then there is
something in your processing that is different and causing the issue. At
least you would have a working and non-working case to compare.

Other than that, there is not enough detail here to provide any additional
insight.

-scott
OSR
@OSRDrivers

“Jörg Wittig” wrote in message news:xxxxx@ntfsd…

Hi Scoot ,

the problem occurs with my filter and HA. The minispy sample
implementation served as a base model (concept).

my filter on -> share with HA -> problem if rename triggered, other
file actions are not affected
my filter off -> share with HA -> no problem
my filter on -> same share HA off -> no problem

greetings and thanks for the support
jörg

Am 17.01.2017 um 20:59 schrieb Scott Noone:

I’m not sure you answered my question…Does this some failure happen if
you use the minispy sample and HA? Or just with your filter and HA?

-scott
OSR
@OSRDrivers

“Jörg Wittig” wrote in message news:xxxxx@ntfsd…

Am 06.01.17 um 16:20 schrieb Scott Noone:
> Does this happen with a stock version of minispy?
>
> Have you looked at Process Monitor and/or WireShark traces from the
> working and non-working cases?
>
> -scott
> OSR
> @OSRDrivers
>
> “Jörg Wittig” wrote in message news:xxxxx@ntfsd…
>
> Hallo,
>
> i use a minifilter driver to collect file activities (like the minispy
> example). Now i have a problem in a special environment use case.
>
> Testenvironment: 3 node failover cluster (MS 2012 R2), role “file
> server”, set share access with high availability feature (Default)
> (smb3 transparent failover);
>
> The test is a simple rename of a file. In case of check
> IRP_MJ_SET_INFORMATION in pre and post callback the client side
> initiator application explorer freeze or if i use powershell or
> command console the action is not allowed. If i disable the driver the
> test run. Shares without this HA-Feature and running minifilter
> driver also runs.
>
> Any idea what is wrong.
>
> Thanks
>
>
hallo scott,

after additional tests (different stock versions) i did not found
another causes. Only with the smb3 feature high availability did i have
trouble. All other situations works fine. If i have interaction with
filter manager wait for callback and leave the callback the initial
function is not executed. I had forgot to say the filter runs on server
side.

Best regards
Jörg

Hi,

ok, the test with the original is a possibility. i hope to find the time
(certainly on weekend) for the test.

My first thought was: Why run all other situations (copy, ACL change,
create,… ) without trouble and only rename failed.

I’ll get back after the test.

thanks

Am 18.01.2017 um 18:28 schrieb Scott Noone:

What I’ve been asking is if you take the minispy sample *as is* and
install it on the server, do you get the same behavior? If not, then
there is something in your processing that is different and causing the
issue. At least you would have a working and non-working case to compare.

Other than that, there is not enough detail here to provide any
additional insight.

-scott
OSR
@OSRDrivers

“Jörg Wittig” wrote in message news:xxxxx@ntfsd…

Hi Scoot ,

the problem occurs with my filter and HA. The minispy sample
implementation served as a base model (concept).

my filter on -> share with HA -> problem if rename triggered, other
file actions are not affected
my filter off -> share with HA -> no problem
my filter on -> same share HA off -> no problem

greetings and thanks for the support
jörg

Am 17.01.2017 um 20:59 schrieb Scott Noone:
> I’m not sure you answered my question…Does this some failure happen if
> you use the minispy sample and HA? Or just with your filter and HA?
>
> -scott
> OSR
> @OSRDrivers
>
> “Jörg Wittig” wrote in message news:xxxxx@ntfsd…
>
> Am 06.01.17 um 16:20 schrieb Scott Noone:
>> Does this happen with a stock version of minispy?
>>
>> Have you looked at Process Monitor and/or WireShark traces from the
>> working and non-working cases?
>>
>> -scott
>> OSR
>> @OSRDrivers
>>
>> “Jörg Wittig” wrote in message news:xxxxx@ntfsd…
>>
>> Hallo,
>>
>> i use a minifilter driver to collect file activities (like the minispy
>> example). Now i have a problem in a special environment use case.
>>
>> Testenvironment: 3 node failover cluster (MS 2012 R2), role “file
>> server”, set share access with high availability feature (Default)
>> (smb3 transparent failover);
>>
>> The test is a simple rename of a file. In case of check
>> IRP_MJ_SET_INFORMATION in pre and post callback the client side
>> initiator application explorer freeze or if i use powershell or
>> command console the action is not allowed. If i disable the driver the
>> test run. Shares without this HA-Feature and running minifilter
>> driver also runs.
>>
>> Any idea what is wrong.
>>
>> Thanks
>>
>>
> hallo scott,
>
> after additional tests (different stock versions) i did not found
> another causes. Only with the smb3 feature high availability did i have
> trouble. All other situations works fine. If i have interaction with
> filter manager wait for callback and leave the callback the initial
> function is not executed. I had forgot to say the filter runs on server
> side.
>
> Best regards
> Jörg
>

No way to tell without data…You need traces and some experiments. As I
mentioned previously, WireShark data from the working and non-working cases
might be useful as well as ProcMon traces (on the server and/or client).

-scott
OSR
@OSRDrivers

“Jörg Wittig” wrote in message news:xxxxx@ntfsd…

Hi,

ok, the test with the original is a possibility. i hope to find the time
(certainly on weekend) for the test.

My first thought was: Why run all other situations (copy, ACL change,
create,… ) without trouble and only rename failed.

I’ll get back after the test.

thanks

Am 18.01.2017 um 18:28 schrieb Scott Noone:

What I’ve been asking is if you take the minispy sample *as is* and
install it on the server, do you get the same behavior? If not, then
there is something in your processing that is different and causing the
issue. At least you would have a working and non-working case to compare.

Other than that, there is not enough detail here to provide any
additional insight.

-scott
OSR
@OSRDrivers

“Jörg Wittig” wrote in message news:xxxxx@ntfsd…

Hi Scoot ,

the problem occurs with my filter and HA. The minispy sample
implementation served as a base model (concept).

my filter on -> share with HA -> problem if rename triggered, other
file actions are not affected
my filter off -> share with HA -> no problem
my filter on -> same share HA off -> no problem

greetings and thanks for the support
jörg

Am 17.01.2017 um 20:59 schrieb Scott Noone:
> I’m not sure you answered my question…Does this some failure happen if
> you use the minispy sample and HA? Or just with your filter and HA?
>
> -scott
> OSR
> @OSRDrivers
>
> “Jörg Wittig” wrote in message news:xxxxx@ntfsd…
>
> Am 06.01.17 um 16:20 schrieb Scott Noone:
>> Does this happen with a stock version of minispy?
>>
>> Have you looked at Process Monitor and/or WireShark traces from the
>> working and non-working cases?
>>
>> -scott
>> OSR
>> @OSRDrivers
>>
>> “Jörg Wittig” wrote in message news:xxxxx@ntfsd…
>>
>> Hallo,
>>
>> i use a minifilter driver to collect file activities (like the minispy
>> example). Now i have a problem in a special environment use case.
>>
>> Testenvironment: 3 node failover cluster (MS 2012 R2), role “file
>> server”, set share access with high availability feature (Default)
>> (smb3 transparent failover);
>>
>> The test is a simple rename of a file. In case of check
>> IRP_MJ_SET_INFORMATION in pre and post callback the client side
>> initiator application explorer freeze or if i use powershell or
>> command console the action is not allowed. If i disable the driver the
>> test run. Shares without this HA-Feature and running minifilter
>> driver also runs.
>>
>> Any idea what is wrong.
>>
>> Thanks
>>
>>
> hallo scott,
>
> after additional tests (different stock versions) i did not found
> another causes. Only with the smb3 feature high availability did i have
> trouble. All other situations works fine. If i have interaction with
> filter manager wait for callback and leave the callback the initial
> function is not executed. I had forgot to say the filter runs on server
> side.
>
> Best regards
> Jörg
>