我们正在使用Microsoft的
Distributed File System进行复制.
在我们的场景中,我们有一个编写器,可以创建/覆盖/删除文件和几个分布式阅读器.
该作者正在运行Windows Server 2008 R2 Enterprise x64 SP 1,
读者正在运行Windows Server 2003 R2标准版x86 SP 2.
一些读者使用版本5.2.3790.4656运行DFSR,而其他一些读者使用修补版本5.2.3790.4799运行.
在我们的场景中,我们有一个编写器,可以创建/覆盖/删除文件和几个分布式阅读器.
该作者正在运行Windows Server 2008 R2 Enterprise x64 SP 1,
读者正在运行Windows Server 2003 R2标准版x86 SP 2.
一些读者使用版本5.2.3790.4656运行DFSR,而其他一些读者使用修补版本5.2.3790.4799运行.
使用System.IO.File.WriteAllText
编写文件,并且可以在同一个文件上快速连续写入.
大多数情况下复制工作正常,但有时文件最终会在复制后完全填充空字节.
我们在所有涉及的机器上检查了DFSR日志,并在读者身上找到了以下类型的usn日志条目报告:
20150302 11:05:00.498 2512 USNC 2202 UsnConsumer::UpdateIdRecord ID record updated from USN_RECORD: + USN_RECORD: + RecordLength: 80 + MajorVersion: 2 + MinorVersion: 0 + FileRefNumber: 0x800000000f7c8 + ParentFileRefNumber: 0x31000000152806 + USN: 0x872e876720 + TimeStamp: 20150302 11:05:00.498 CET + Reason: Basic Info Change Close Rename New Name + SourceInfo: 0x4 + SecurityId: 0xebe + FileAttributes: 0x2220 + FileNameLength: 18 + FileNameOffset: 60 + FileName: xyz.txt
让我们感到疑惑的是,根本没有日记帐分录报告
(读者应该阅读但不要修改任何东西)
以及设置稀疏属性的事实.
找出是否有某些进程执行意外写入或执行可疑操作
我们使用Process Monitor监视文件系统活动.
阅读器上的下一个空字节文件的出现给我们带来了以下内容:
10:59:55,2311121 Dfsr.exe 1584 760 IRP_MJ_CREATE path\to\xyz.txt-{GUID}-vVERSION SUCCESS Desired Access: Generic Read/Write/Execute,Write DAC,Write Owner,Access System Security,Disposition: Create,Options: Sequential Access,Synchronous IO Non-Alert,Complete If Oplocked,Open For Backup,Open No Recall,Attributes: N,ShareMode: Read,Write,Delete,AllocationSize: 0,OpenResult: Created 10:59:55,2312485 Dfsr.exe 1584 760 IRP_MJ_CLEANUP path\to\xyz.txt-{GUID}-vVERSION SUCCESS 10:59:55,2313007 Dfsr.exe 1584 760 IRP_MJ_CLOSE path\to\xyz.txt-{GUID}-vVERSION SUCCESS 10:59:55,2314394 Dfsr.exe 1584 760 IRP_MJ_CREATE path\to\xyz.txt-{GUID}-vVERSION SUCCESS Desired Access: Read Attributes,Write Attributes,Synchronize,Disposition: Open,Open Reparse Point,AllocationSize: n/a,OpenResult: Opened 10:59:55,2314626 Dfsr.exe 1584 760 IRP_MJ_FILE_SYSTEM_CONTROL path\to\xyz.txt-{GUID}-vVERSION SUCCESS Control: FSCTL_MARK_HANDLE 10:59:55,2314780 Dfsr.exe 1584 760 IRP_MJ_QUERY_INFORMATION path\to\xyz.txt-{GUID}-vVERSION SUCCESS Type: QueryNameInformationFile,Name: path\to\xyz.txt-{GUID}-vVERSION 10:59:55,2314996 Dfsr.exe 1584 760 FASTIO_QUERY_INFORMATION path\to\xyz.txt-{GUID}-vVERSION SUCCESS Type: QueryBasicInformationFile,CreationTime: 10.03.2015 10:59:55,LastAccessTime: 10.03.2015 10:59:55,LastWriteTime: 10.03.2015 10:59:55,ChangeTime: 10.03.2015 10:59:55,FileAttributes: ANCI 10:59:55,2315081 Dfsr.exe 1584 760 IRP_MJ_QUERY_INFORMATION path\to\xyz.txt-{GUID}-vVERSION SUCCESS Type: QueryAttributeTagFile,Attributes: ANCI,ReparseTag: 0x0 10:59:55,2315194 Dfsr.exe 1584 760 IRP_MJ_QUERY_INFORMATION path\to\xyz.txt-{GUID}-vVERSION SUCCESS Type: QueryCompressionInformationFile 10:59:55,2315391 Dfsr.exe 1584 760 IRP_MJ_QUERY_VOLUME_INFORMATION path\to\xyz.txt-{GUID}-vVERSION BUFFER OVERFLOW Type: QueryInformationVolume,VolumeCreationTime: 14.07.2014 14:59:54,VolumeSerialNumber: 88F0-15DC,SupportsObjects: True,VolumeLabel: uvw 10:59:55,2315481 Dfsr.exe 1584 760 IRP_MJ_QUERY_INFORMATION path\to\xyz.txt-{GUID}-vVERSION BUFFER OVERFLOW Type: QueryAllInformationFile,FileAttributes: ANCI,EndOfFile: 0,NumberOfLinks: 1,DeletePending: False,Directory: False,IndexNumber: 0xe00000001589e,EaSize: 0,Access: Read Attributes,Position: 0,Mode: Sequential Access,AlignmentRequirement: Long 10:59:55,2316459 Dfsr.exe 1584 760 IRP_MJ_CREATE path\to\xyz.txt-{GUID}-vVERSION SUCCESS Desired Access: Generic Read/Write/Execute,2316691 Dfsr.exe 1584 760 IRP_MJ_FILE_SYSTEM_CONTROL path\to\xyz.txt-{GUID}-vVERSION SUCCESS Control: FSCTL_MARK_HANDLE 10:59:55,2316796 Dfsr.exe 1584 760 IRP_MJ_CLEANUP path\to\xyz.txt-{GUID}-vVERSION SUCCESS 10:59:55,2316876 Dfsr.exe 1584 760 IRP_MJ_CLOSE path\to\xyz.txt-{GUID}-vVERSION SUCCESS 10:59:55,2317891 Dfsr.exe 1584 760 IRP_MJ_SET_SECURITY path\to\xyz.txt-{GUID}-vVERSION SUCCESS Information: Owner,Group,DACL 10:59:55,2318748 Dfsr.exe 1584 760 IRP_MJ_FILE_SYSTEM_CONTROL path\to\xyz.txt-{GUID}-vVERSION SUCCESS Control: FSCTL_SET_SPARSE 10:59:55,2319307 Dfsr.exe 1584 760 IRP_MJ_WRITE path\to\xyz.txt-{GUID}-vVERSION SUCCESS Offset: 0,Length: 0 10:59:55,2319442 Dfsr.exe 1584 760 IRP_MJ_SET_INFORMATION path\to\xyz.txt-{GUID}-vVERSION SUCCESS Type: SetEndOfFileInformationFile,EndOfFile: 240 10:59:55,2320066 Dfsr.exe 1584 760 IRP_MJ_SET_INFORMATION path\to\xyz.txt-{GUID}-vVERSION SUCCESS Type: SetAllocationInformationFile,AllocationSize: 240 10:59:55,2320382 Dfsr.exe 1584 760 IRP_MJ_WRITE path\to\xyz.txt-{GUID}-vVERSION SUCCESS Offset: 240,2320505 Dfsr.exe 1584 760 IRP_MJ_SET_INFORMATION path\to\xyz.txt-{GUID}-vVERSION SUCCESS Type: SetBasicInformationFile,CreationTime: 16.12.2013 10:57:23,LastAccessTime: 19.02.2015 11:00:25,2320688 Dfsr.exe 1584 760 IRP_MJ_FILE_SYSTEM_CONTROL path\to\xyz.txt-{GUID}-vVERSION SUCCESS Control: FSCTL_WRITE_USN_CLOSE_RECORD 10:59:55,2321256 Dfsr.exe 1584 760 IRP_MJ_CLEANUP path\to\xyz.txt-{GUID}-vVERSION SUCCESS 10:59:55,2321506 Dfsr.exe 1584 760 IRP_MJ_CLOSE path\to\xyz.txt-{GUID}-vVERSION SUCCESS
通过这种观察,看起来DFSR就是产生它们的人.
它为什么这样做?
另外,为什么它将文件标记为稀疏?
除了使用上面概述的技术编写文件之外,作者不会弄乱文件.
请注意,移动EOF标记的偏移量与编写器创建的文件大小相匹配.
到目前为止,我们无法可靠地重现该问题.
有没有人知道造成这种情况的原因,更重要的是,如何解决这个问题?
您的DFS-R暂存区域与DFS-R文件夹位于同一卷上吗?出于性能原因,它应该是.如果没有,则DFS-R必须将文件从分段卷复制到目标卷而不是直接移动.
原文链接:https://www.f2er.com/windows/368321.html这就是猜测的结果.可能是在这个复制操作期间,DFS-R正在创建一个稀疏文件,然后填充块,并在完成时“解除”它.如果有什么东西中断了这个过程(比如防病毒软件,Undelete或扫描DfsrPrivate文件夹的其他文件过滤器驱动程序),那么你最终可能会得到一个没有填充其内容的临时稀疏文件.
您可以通过在正确复制的文件上使用Process Monitor来检测此行为,并查看它们是否在过程中的任何位置标记为/未标记为稀疏.
在谈到DFS-R时,我不喜欢混合2008年和2003年.我很高兴能从我们的DFS树上获得2003年的最后一台机器.