I am developing a file system minifilter driver for performing incremental backups of HyperV VMs [this is pre-Server 2016]. The changed blocks are not planned to be persisted on storage media for every write operation.
For simplicity, assume a 2 node cluster deployment on CSV or SMB on Server 2012 R2 running a single VM. The driver is supposed to be loaded on both the HyperV hosts. When the first backup is initiated for a VM, a user mode component will notify to the driver about files related to the VM that need to be tracked (mostly [A]VHD files related to the VM).
-
Can the driver detect that the VM was powered off ? [I would like to continue incremental tracking of related files when VM is powered on again]
a) If the driver was notified to start tracking the files after the VM was powered on, then I cannot do a counter based mechanism to match open and close calls to the file.
b) I cannot rely on context cleanup callback for stream contexts due to filesystem caching.
Is there any other way to detect this in the driver ? -
Can the driver detect that the VM failover + failback happened ? [in which case, the next backup for the VM will be a full backup] and distinguish it from power-off / power-on case ?
The driver on each host is not interacting with each other.
As per the following link, it seems to be possible to track the aforesaid VM state transitions in user mode by using WMI event callback notification (__InstanceModificationEvent) :
https://msdn.microsoft.com/en-us/library/cc136822(v=vs.85).aspx
I want to understand if the detection mechanism can be implemented in the driver.