Hi All,
I have developed a mini-filter driver for activity monitoring.
For improving performance I chose to selectively attach the filter to only the volumes which I am interested in.
I use FltAttachVolume for this purpose.
I have some cleanup activity to be done in case of shutdown, therefore I have added a hook on the pre callback of IRP_MJ_SHUTDOWN where I do the cleanup.
Now I have decided to support mapped network drives, therefore I use
FltAttachVolume on \device\MUP which serves my purpose.
When I chose to attach a local volume and the network volume I still get the pre callback for IRP_MJ_SHUTDOWN during shutdown.
The problem:
When I selectively attach to ONLY THE network volume I do not get the pre callback for IRP_MJ_SHUTDOWN during shutdown.
On shutdown I do not get the callbacks for INSTANCE_TEARDOWN too when attached to only network volume.
My questions are:
Is this how the filter manager behaves? Cause I could not find any document regarding this.
Is there a method to get the precallback for IRP_MJ_SHUTDOWN event during shutdown by only attaching to the network volume?
Is FltAttachVolume to \device\MUP the reason for not getting the pre call back for the shutdown event.
You do not need cleanup on shutdown - the machine is going off anyway, even with memory leaks
wrote in message news:xxxxx@ntfsd… > > Hi All, > I have developed a mini-filter driver for activity monitoring. > For improving performance I chose to selectively attach the filter to only the volumes which I am interested in. > I use FltAttachVolume for this purpose. > I have some cleanup activity to be done in case of shutdown
You should always cleanup. Every bit of memory explicitly allocated by your
code should be freed in your code before your driver unloads.
On Tue, Sep 2, 2014 at 10:31 PM, Maxim S. Shatskih wrote:
> You do not need cleanup on shutdown - the machine is going off anyway, > even with memory leaks > > wrote in message news:xxxxx@ntfsd… > > > > Hi All, > > I have developed a mini-filter driver for activity monitoring. > > For improving performance I chose to selectively attach the filter to > only the volumes which I am interested in. > > I use FltAttachVolume for this purpose. > > I have some cleanup activity to be done in case of shutdown > > > — > NTFSD is sponsored by OSR > > OSR is hiring!! Info at http://www.osr.com/careers > > For our schedule of debugging and file system seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer >
This isn’t a Filter Manager issue. It’s because only the things that call IoRegisterFileSystem will be placed in the relevant buckets for shutdown notifications. So Filter Manager doesn’t control this, the I/O Manager does - and it sends shutdown to disk, tape and CD-ROM file systems. Nothing else.
If you need a shutdown callback, you can register explicitly for one: IoRegisterShutdownNotification, IoRegisterLastChanceShutdownNotification. IoRegisterFileSystem registers (implicitly) for shutdown notifications as well (and it’s notifications are between the two I/O Manager lists).
>This isn’t a Filter Manager issue. It’s because only the things that call
>IoRegisterFileSystem will be placed in the relevant buckets for shutdown
>notifications. So Filter Manager doesn’t control this, the I/O Manager does -
>and it sends shutdown to disk, tape and CD-ROM file systems. Nothing else.
The above lines clarify my doubt.
I was assuming there was something wrong in my implementation due to which I was not getting the shutdown event.
>If you need a shutdown callback, you can register explicitly for one:
>IoRegisterShutdownNotification, IoRegisterLastChanceShutdownNotification.
>IoRegisterFileSystem registers (implicitly) for shutdown notifications as well
>(and it’s notifications are between the two I/O Manager lists).
I will start implementing the above.
This saves my time. I appreciate your help.
Driver is not unloaded on shutdown
“rohan kumbhar” wrote in message news:xxxxx@ntfsd… I donot agree with above suggestion.
You should always cleanup. Every bit of memory explicitly allocated by your code should be freed in your code before your driver unloads.
On Tue, Sep 2, 2014 at 10:31 PM, Maxim S. Shatskih wrote:
You do not need cleanup on shutdown - the machine is going off anyway, even with memory leaks
wrote in message news:xxxxx@ntfsd… > > Hi All, > I have developed a mini-filter driver for activity monitoring. > For improving performance I chose to selectively attach the filter to only the volumes which I am interested in. > I use FltAttachVolume for this purpose. > I have some cleanup activity to be done in case of shutdown
I am facing same problem when I attach to only CSV volume.
I don’t receive shutdown notification for csv volume. In instance setup we get volumedevicetype as 0x8 i.e. DISK_FILE_SYSTEM.
This is tested on windows server 2012R2.
I tried setting IoRegisterShutdownNotification on device object at the time of instance setup but shutdown dispatch routine is never called.
Is there anything else we need to do in order to get shutdown notification in case of csv?
Have you verified that CSV is getting a shutdown in the first place? It would only get one if it registered as a file system (IoRegisterFileSystem) and it will only get an IRP_MJ_SHUTDOWN on the control device - not on individual volumes (basically, the device object passed to IoRegisterFileSystem).
Further, the I/O Manager only calls for disk, tape and cd-rom file systems.
