{"id":107327,"date":"2022-10-27T07:00:00","date_gmt":"2022-10-27T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=107327"},"modified":"2022-10-27T06:32:30","modified_gmt":"2022-10-27T13:32:30","slug":"20221027-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20221027-00\/?p=107327","title":{"rendered":"Why am I seeing two WRITE requests at the same offset from a single call to WriteFile?"},"content":{"rendered":"

A customer was doing a little performance analysis and found an oddity: A single non-extending write request at the application layer was turning into two<\/i> write requests at the I\/O layer, both at the same offset:<\/p>\n\n\n\n\n\n
Op<\/th>\nFile<\/th>\nOffset<\/th>\nLength<\/th>\nFlags<\/th>\nPriority<\/th>\nStatus<\/th>\n<\/tr>\n
IRP_MJ_WRITE<\/td>\ntest.txt<\/td>\n69,632<\/td>\n61,440<\/td>\nNon-cached, Write Through<\/td>\nNormal<\/td>\nSUCCESS<\/td>\n<\/tr>\n
IRP_MJ_WRITE<\/td>\ntest.txt<\/td>\n69,632<\/td>\n61,440<\/td>\nNon-cached, Write Through
\nPaging, Synchronous Paging<\/td>\n		Normal<\/td>\nSUCCESS<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Friend-of-the-blog Malcolm Smith observed that the first write is non-cached. One possibility is that the first write is a flush of previously-dirty data due to a cached write or a writable memory-mapped view. The system then follows up with the second write, which is triggered by the application-level write.<\/p>\n

However, if nobody else is writing to the file at the time the test is being run, then that scenario is ruled out.<\/p>\n

Another possibility is that the file is compressed. In that case, the application-level write goes into the system cache, and then is flushed. This looks like two write operations from the file system’s point of view, which is what the log is watching. But really, only one write is issued to the physical drive.<\/p>\n

The customer confirmed that they are writing to a compressed file.<\/p>\n

Malcolm explained that NTFS compression is rather expensive.<\/p>\n

The idea behind NTFS compression is that the file is broken up into 64KB chunks, with each chunk compressed separately,\u00b9 and each chunk is managed independently.<\/p>\n

This means that a simple write operation that isn’t a full chunk explodes into a sequence of operations:<\/p>\n