{"id":91821,"date":"2015-08-13T07:00:00","date_gmt":"2015-08-13T21:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/20150813-00\/?p=91821\/"},"modified":"2019-03-13T12:18:29","modified_gmt":"2019-03-13T19:18:29","slug":"20150813-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20150813-00\/?p=91821","title":{"rendered":"Crashes in the I\/O stack tend to occur in programs which do the most I\/O"},"content":{"rendered":"<p>A customer was diagnosing repeated blue screen errors on their system. They shared a few crash dumps, and they all had a similar profile: The crash occurred in the file system filter stack as the I\/O request passed through the anti-virus software. <\/p>\n<p>Some of the crashes reported <code>PROCESS_NAME: ngen.exe<\/code>. &#8220;Could <code>ngen.exe<\/code> be the problem?&#8221; <!--more--><\/p>\n<p>As a general rule, user-mode code cannot be responsible for blue-screen failures. It&#8217;s the job of the kernel to be resistant to misbehavior in user-mode. Failures of the form <code>IRQL_NOT_LESS_THAN_OR_EQUAL<\/code> and <code>PAGE_FAULT_IN_NON_PAGED_AREA<\/code> are typically driver bugs or faulty hardware (for example, due to overheating or <a HREF=\"http:\/\/blogs.msdn.com\/b\/oldnewthing\/archive\/2005\/04\/12\/407562.aspx\">overclocking<\/a>). <\/p>\n<p>The application that happened to be active at the time of the failure is not typically interesting in and of itself, although it can give a clue as to what part of the kernel is misbehaving. The fact that <code>ngen<\/code> appears is more an indication that <code>ngen<\/code> performs a lot of disk I\/O, so if there&#8217;s a problem in the I\/O stack, there&#8217;s a good chance that <code>ngen<\/code> was involved, simply because <code>ngen<\/code> is involved in a lot of I\/O requests. <\/p>\n<ul>\n<li>Bob goes to the beach very frequently. \n<li>Every time there is a     <a HREF=\"http:\/\/abcnews.go.com\/US\/jaws-sharknado-americas-obsession-sharks-growing\/story?id=24927068\">    shark attack<\/a>,     Bob is at the beach. \n<li>Conclusion: Bob causes shark attacks. <\/ul>\n<p>Blaming <code>ngen<\/code> for the kernel crash is like blaming Bob for the shark attacks. <\/p>\n<p><b>Bonus chatter<\/b>: Some of my colleagues came to different conclusions: <\/p>\n<ul>\n<li>Conclusion: Bob should stop going to the beach. \n<li>Conclusion: Bob must be the shark. <\/ul>\n","protected":false},"excerpt":{"rendered":"<p>just playing the odds.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-91821","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"<p>just playing the odds.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/91821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=91821"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/91821\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=91821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=91821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=91821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}