Brad Rutkowski's Blog : Disk Subsytem

Performance update for Vista RTM released today

Brad Rutkowski — Thu, 13 Dec 2007 02:20:03 GMT

Saw this on the Windows Vista team blog today.

http://support.microsoft.com/?kbid=943899

This update improves performance, responsiveness, and reliability of Windows Vista in various scenarios. This update resolves the following issues on a Windows Vista-based computer:

•You receive a "Stop 0x000000A0" error when you try to switch the computer to the hibernate state.

•You receive a "Stop 0x0000009f" error when you switch the computer to the hibernate state or to the standby state. Or, you receive this Stop error when you resume the computer from the hibernate state or from the standby state. This problem occurs on a computer that has a wireless network connection.

•The disk does not spin down after a specified time of inactivity.

Additionally, this update can help improve performance when you perform operations that are related to large disk I/O. After you apply this update, you may notice up to a 15 percent performance improvement in some copying operations and when moving some large files.

Not getting kernel memory dumps in Windows Vista or Windows 2008?

Brad Rutkowski — Tue, 16 Oct 2007 19:36:11 GMT

Backstory:

With the advent of Windows Vista there are changes made in how the operating system determines if it can take a kernel memory dump or not. Starting in Vista the amount of memory allocated for kernel mode could vary dynamically. If the pagefile is not big enough, switching to minidump at dump time can’t be done easily. So the dump stack initialization is happening at the time of boot where this check for the pagefile size is done.

What does this mean? It means if you don't have a pagefile as large as physical memory at boot, and your system is configured for a kernel dump, you'll end up getting a minidump. If you permit me to opine, this makes sense in the client space where a valid dump is more critical than a corrupted kernel dump, as the results usually would get uploaded to Microsoft via WERCON or another mechanism. If further triage is needed MSFT could contact you with the ability to setup a kernel capture.

In the Server world though, it's different. We have thousands of x64 systems with 16GBs of RAM and there is no way we could have a 16GB page file as the system either does not have the space (on C), or it does not make fiscal sense with regards to disk space. We have all our systems configured to take kernel dumps in case we crash the server via debugger/keyboard. We dogfood our beta operating systems, and a hung server is a normal site to see, and sometimes we can't break in via the debugger and a crash dump is our last and only resort. Crashing a box and ending up with a minidump does not suffice in our role.

The change in Vista SP1 RC0/Windows 2008 RC0 on:

Starting with the release of RC0, there is a new registry key that can be set which will tell the OS to ignore the page file check on boot up and you'll take your chances getting a valid kernel dump. We've tested this internally and all works as expected. So if you need kernel dumps on your large memory systems, this might be something to remember for your bag of tricks.

Key: HKLM\System\CurrentControlSet\Control\CrashControl

Value: IgnorePagefileSize

Type: DWORD

Data: 1

Technorati tags: Windows 2008, Vista, Debugging

Discrepancy in volume size when you extend a volume with DISKPART

Brad Rutkowski — Wed, 15 Aug 2007 23:51:59 GMT

Had an issue come in today where the customer requested that one of their drives on SAN storage be expanded. They carved out the necessary disk space and expanded the LUN which was verified showing 430GB total on the array. Rescanned in Disk Management and showed the Unallocated Space. They then used diskpart to expand the D$ drive, disk management then shoed 430GBs. However, properties still showed only 359GB. Diskpart list disk showed 430GB.

So why the discrepancy? Well when you extend a volume with DISKPART it doesn't automatically extend the file system with it, so you need to do the following:

C:\Debuggers>diskpart

Microsoft DiskPart version 6.0.6001

On computer: ServerX

DISKPART> sel vol d

Volume 1 is the selected volume.

DISKPART> EXTEND FILESYSTEM

DiskPart successfully extended the file system on the volume.

When that is completed, then you'll see all the space in the properties. If you extend the volume via the MMC then this happens automatically for you behind the scenes.

Technorati tags: vista, windows 2008

The case of Windows Defender not starting.

Brad Rutkowski — Wed, 15 Aug 2007 05:03:00 GMT

Had a client whose machine would not load Windows Defender, each time it was opened it would eventually die on initialization:

Log Name:      Application
Source:        Application Error
Date:          8/13/2007 4:03:10 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server1

Description:
Faulting application MSASCui.exe, version 1.1.1505.0, time stamp 0x45ad8d6e, faulting module ntdll.dll, version 6.0.6000.16386, time stamp 0x4549d372, exception code 0xc0000005, fault offset 0x000000000002aa74, process id 0x1268, application start time 0x01c7dde39a6e9100.

Since it was a problem was with initialization, the first thing I did was enable loader snaps and then put the executable under an IFEO. I didn't see anything jump out from the loader snaps, but when the system was g'd I did see these errors:
0:000> g
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)
(1008.11b8): In-page I/O error c000009c - code c0000006 (first chance)

This translates to STATUS_DEVICE_DATA_ERROR which means that the OS couldn't page in the memory due to a disk error (maps to Win32 error: ERROR_CRC). This is most likely a hardware failure.

I ran chkdsk /r on the c: drive and it was unable to recover the sectors. I ended up having to go to the HDD maker's site and downloading there utility to scan the hard drive and recover the sectors. Once done Defender was happy again. Your probably asking yourself (all three of you that read this blog) Why didn't you see the below event in the eventvwr? I I would have looked in the System log and saw this but unfortunately that wasn't opening before I fixed the disk errors.

Log Name:      System
Source:        disk
Date:          8/13/2007 5:31:43 PM
Event ID:      7
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server1
Description:
The device, \Device\Harddisk0\DR0, has a bad block.

If you don't have disk errors on the system another thing you can do is use SFC (/VERIFYFILE ) to check the integrity of the files in question if there are problems they will be dumped to the CBS.log file under c:\windows\logs\cbs.

SFC [/SCANNOW] [/VERIFYONLY] [/SCANFILE=<file>] [/VERIFYFILE=<file>]
[/OFFWINDIR=<offline windows directory> /OFFBOOTDIR=<offline boot directory>]

/SCANNOW        Scans integrity of all protected system files and repairs files with
                problems when possible.
/VERIFYONLY     Scans integrity of all protected system files. No repair operation is
                performed.
/SCANFILE       Scans integrity of the referenced file, repairs file if problems are
                identified. Specify full path <file>
/VERIFYFILE     Verifies the integrity of the file with full path <file>. No repair
                operation is performed.
/OFFBOOTDIR     For offline repair specify the location of the offline boot directory
/OFFWINDIR      For offline repair specify the location of the offline windows directory

Technorati tags: debugging.vista, windows 2008

Storport update rolls a lot of changes into one package for Win2k3

Brad Rutkowski — Fri, 13 Apr 2007 05:34:24 GMT

KB 932755 was released recently and contains many changes to the Storport driver for better reliability and performance. If you've been seeing issues with Storport it might not be a bad idea to check out this article and see if your symptoms match up and if they do download the package. This is a post-SP2 package so if you are running PS2 these changes are not on your system.

http://support.microsoft.com/kb/932755

If you're not testing SP2 right now either, shame on you.

http://technet.microsoft.com/en-us/windowsserver/bb229701.aspx

Technorati tags: windows, 2003, windows 2003