Win7 x64 Novell Client 2 SP1 IR5 BSOD in ncfsd.sys

Hi,

One user in our company is using Windows 7 x64 and is having a trouble with latest Novell Client. It seems that specific program we use here that accesses databases from network drive is capable of repeatedly producing BSOD's in ncfsd.sys. Normally everything works but as this user had to put the program through some more rigorous usage tests today, he got four identical BSOD's in duration of few hours.

What happened was that immediately after starting the program it sometimes hung on it's first database access attempt. It was seemingly random that the program would hung on any particular time and not on some other - usually it started up normally as it has done already for months on that same system. If it hung, OS and other programs continued to be responsive for a minute or two (Netware server was also accessible), and only then - always - the BSOD came.

The databases our program uses are of Clipper / Foxpro type (DBF).

I uploaded file Heigo_20110208.7z containing one of the minidumps to ftp.novell.com incoming folder, perhaps You can read something useful out of it. Other minidumps contain the same (bugcheck 0xd1, error in ncfsd.sys, checked with WinDbg).

Thanks!
Parents
  • heigo <heigo@no-mx.forums.novell.com> wrote:

    > I uploaded file Heigo_20110208.7z containing one of the minidumps to
    > ftp.novell.com incoming folder, perhaps You can read something useful
    > out of it. Other minidumps contain the same (bugcheck 0xd1, error in
    > ncfsd.sys, checked with WinDbg).


    The issue implied by the state shown in that mini-dump is an issue
    currently reported and under investigation as Bug 652220. It happens
    to be the same blue screen issue being reported by users of the
    Autodesk Revit application.

    There isn't any identified workaround or ETA for the fix yet, but
    wanted to at least confirm that issue is reported and being
    investigated. If you end up needing to contact Novell Support on the
    issue, or simply intend to look for when a future Novell Client
    release contains the fix, Bug 652220 is the reference to use.

    Alan Adams
    Novell Client CPR Group
    alan.adams@novell.com

    Novell
    Making IT Work As One
    www.novell.com

    Upgrade to OES Community
    http://www.novell.com/communities/coolsolutions/upgradetooes/
  • Alan Adams;2073788 wrote:
    heigo <heigo@no-mx.forums.novell.com> wrote:

    > I uploaded file Heigo_20110208.7z containing one of the minidumps to
    > ftp.novell.com incoming folder, perhaps You can read something useful
    > out of it. Other minidumps contain the same (bugcheck 0xd1, error in
    > ncfsd.sys, checked with WinDbg).


    The issue implied by the state shown in that mini-dump is an issue
    currently reported and under investigation as Bug 652220. It happens
    to be the same blue screen issue being reported by users of the
    Autodesk Revit application.

    There isn't any identified workaround or ETA for the fix yet, but
    wanted to at least confirm that issue is reported and being
    investigated. If you end up needing to contact Novell Support on the
    issue, or simply intend to look for when a future Novell Client
    release contains the fix, Bug 652220 is the reference to use.

    Alan Adams
    Novell Client CPR Group
    alan.adams@novell.com

    Novell
    Making IT Work As One
    NOVELL: Worldwide

    Upgrade to OES Community
    Upgrade to Open Enterprise Server | Novell User Communities


    We have the same issue with Windows 7 32bit pro using the same Novell client accessing a Cobol application that run in a maped drive with Cobol DB. The Novell server is version 6.5
    Please, we need an answer to this. Cant wait until future client releases to see if the bug has been solve..

    Thanks.
  • hanks for the reply Grimlock. I was using an older version of Treesize (4.x). I just upgraded to 5.2.2. I've started a scan, and will let you know tomorrow if it makes it through this one directory structure.

    Thanks
    Sam
  • On 9/7/2011 4:26 PM, samthendsgod wrote:
    >
    > hanks for the reply Grimlock. I was using an older version of Treesize
    > (4.x). I just upgraded to 5.2.2. I've started a scan, and will let you
    > know tomorrow if it makes it through this one directory structure.
    >
    > Thanks
    > Sam
    >
    >


    5.2.2 or 5.5.2?


  • grimlock;2135391 wrote:
    On 9/7/2011 4:26 PM, samthendsgod wrote:
    >
    > hanks for the reply Grimlock. I was using an older version of Treesize
    > (4.x). I just upgraded to 5.2.2. I've started a scan, and will let you
    > know tomorrow if it makes it through this one directory structure.
    >
    > Thanks
    > Sam
    >
    >


    5.2.2 or 5.5.2?


    My apologies...5.5.2. I kicked it off on its scan about two hours ago. So far so good. But yesterday it took about seven hours to crash. So we should know by morning. :)

    Thank you again for your help Grimlock!
    Sam
  • samthendsgod;2135398 wrote:
    My apologies...5.5.2. I kicked it off on its scan about two hours ago. So far so good. But yesterday it took about seven hours to crash. So we should know by morning. :)

    Thank you again for your help Grimlock!
    Sam


    Bad news - crashed again, same error code. I'm going to try disabling the AV on the PC and see if that helps, but I don't see how it would. It's worth a shot though.

    (I'm not sure if any of this is of much help, but just in case):


    Problem signature:
    Problem Event Name: BlueScreen
    OS Version: 6.1.7600.2.0.0.256.48
    Locale ID: 1033

    Additional information about the problem:
    BCCode: 1000008e
    BCP1: C0000005
    BCP2: 9BF0E4E9
    BCP3: 8DADE588
    BCP4: 00000000
    OS Version: 6_1_7600
    Service Pack: 0_0
    Product: 256_1

    And from the coredump analysis tool I have ("whocrashed"):

    On Thu 9/8/2011 1:56:52 AM GMT your computer crashed
    crash dump file: C:\Windows\Minidump\090711-15724-01.dmp
    This was probably caused by the following module: ncfsd.sys (ncfsd 0x54E9)
    Bugcheck code: 0x1000008E (0xFFFFFFFFC0000005, 0xFFFFFFFF9BF0E4E9, 0xFFFFFFFF8DADE588, 0x0)
    Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
    file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys
    product: NovellRegistered Client(TM) for WindowsRegistered
    company: Novell, Inc.
    description: Novell Client File System Driver
    Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
    This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
    A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: ncfsd.sys (Novell Client File System Driver, Novell, Inc.).
    Google query: ncfsd.sys Novell, Inc. KERNEL_MODE_EXCEPTION_NOT_HANDLED_M




    On Thu 9/8/2011 1:56:52 AM GMT your computer crashed
    crash dump file: C:\Windows\memory.dmp
    This was probably caused by the following module: ncfsd.sys (ncfsd 0x5B27)
    Bugcheck code: 0x8E (0xFFFFFFFFC0000005, 0xFFFFFFFF9BF0E4E9, 0xFFFFFFFF8DADE588, 0x0)
    Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED
    file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys
    product: NovellRegistered Client(TM) for WindowsRegistered
    company: Novell, Inc.
    description: Novell Client File System Driver
    Bug check description: This bug check indicates that a kernel-mode application generated an exception that the error handler did not catch.
    A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: ncfsd.sys (Novell Client File System Driver, Novell, Inc.).
    Google query: ncfsd.sys Novell, Inc. KERNEL_MODE_EXCEPTION_NOT_HANDLED


    It always crashes twice, in case that's relevant.

    Thanks
    Sam
  • On 9/7/2011 5:16 PM, samthendsgod wrote:
    >
    > grimlock;2135391 Wrote:
    >> On 9/7/2011 4:26 PM, samthendsgod wrote:
    >>>
    >>> hanks for the reply Grimlock. I was using an older version of

    >> Treesize
    >>> (4.x). I just upgraded to 5.2.2. I've started a scan, and will let

    >> you
    >>> know tomorrow if it makes it through this one directory structure.
    >>>
    >>> Thanks
    >>> Sam
    >>>
    >>>

    >>
    >> 5.2.2 or 5.5.2?

    >
    > My apologies...5.5.2. I kicked it off on its scan about two hours ago.
    > So far so good. But yesterday it took about seven hours to crash. So we
    > should know by morning. :)
    >
    > Thank you again for your help Grimlock!
    > Sam
    >
    >


    5.5.2 is a lot nicer.. It does not however like to look directly at
    network drives. They don't show up in the list on mine. I can however
    right click on a drive in explorer and tree size it. When you get this
    sorted, try this on a weekend. Right click on a big network drive and
    select tree size file search. Go to search options, uncheck custom
    search and check duplicate files and click start.

    Come back on monday and see how much dupe stuff you have :p


  • On 9/7/2011 5:16 PM, samthendsgod wrote:
    >
    > grimlock;2135391 Wrote:
    >> On 9/7/2011 4:26 PM, samthendsgod wrote:
    >>>
    >>> hanks for the reply Grimlock. I was using an older version of

    >> Treesize
    >>> (4.x). I just upgraded to 5.2.2. I've started a scan, and will let

    >> you
    >>> know tomorrow if it makes it through this one directory structure.
    >>>
    >>> Thanks
    >>> Sam
    >>>
    >>>

    >>
    >> 5.2.2 or 5.5.2?

    >
    > My apologies...5.5.2. I kicked it off on its scan about two hours ago.
    > So far so good. But yesterday it took about seven hours to crash. So we
    > should know by morning. :)
    >
    > Thank you again for your help Grimlock!
    > Sam
    >
    >


    5.5.2 is a lot nicer.. It does not however like to look directly at
    network drives. They don't show up in the list on mine. I can however
    right click on a drive in explorer and tree size it. When you get this
    sorted, try this on a weekend. Right click on a big network drive and
    select tree size file search. Go to search options, uncheck custom
    search and check duplicate files and click start.

    Come back on monday and see how much dupe stuff you have :p


  • On 9/7/2011 5:16 PM, samthendsgod wrote:
    >
    > grimlock;2135391 Wrote:
    >> On 9/7/2011 4:26 PM, samthendsgod wrote:
    >>>
    >>> hanks for the reply Grimlock. I was using an older version of

    >> Treesize
    >>> (4.x). I just upgraded to 5.2.2. I've started a scan, and will let

    >> you
    >>> know tomorrow if it makes it through this one directory structure.
    >>>
    >>> Thanks
    >>> Sam
    >>>
    >>>

    >>
    >> 5.2.2 or 5.5.2?

    >
    > My apologies...5.5.2. I kicked it off on its scan about two hours ago.
    > So far so good. But yesterday it took about seven hours to crash. So we
    > should know by morning. :)
    >
    > Thank you again for your help Grimlock!
    > Sam
    >
    >


    5.5.2 is a lot nicer.. It does not however like to look directly at
    network drives. They don't show up in the list on mine. I can however
    right click on a drive in explorer and tree size it. When you get this
    sorted, try this on a weekend. Right click on a big network drive and
    select tree size file search. Go to search options, uncheck custom
    search and check duplicate files and click start.

    Come back on monday and see how much dupe stuff you have :p


  • On 9/8/2011 12:56 AM, samthendsgod wrote:
    > Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
    > file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys


    What version is that file?

    Mine is 1.0.47.7836

    Just want to rule out the obvious.

  • grimlock;2135632 wrote:
    On 9/8/2011 12:56 AM, samthendsgod wrote:
    > Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
    > file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys


    What version is that file?

    Mine is 1.0.47.7836

    Just want to rule out the obvious.



    Hmmm... mine is Version 1.0.47.7835. a point older. Let me see if I can find the newer one. This one's from the IR8 version of the client.

    (And here's the rest of the story)

    Directory of C:\Program Files\Novell\Client\XTier\Drivers

    07/17/2011 10:23 PM 90,200 ncfsd.sys
    1 File(s) 90,200 bytes
  • On 9/8/2011 12:46 PM, samthendsgod wrote:
    >
    > grimlock;2135632 Wrote:
    >> On 9/8/2011 12:56 AM, samthendsgod wrote:
    >>> Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
    >>> file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys

    >>
    >> What version is that file?
    >>
    >> Mine is 1.0.47.7836
    >>
    >> Just want to rule out the obvious.

    >
    >
    > Hmmm... mine is Version 1.0.47.7835. a point older. Let me see if I can
    > find the newer one. This one's from the IR8 version of the client.
    >
    > (And here's the rest of the story)
    >
    > Directory of C:\Program Files\Novell\Client\XTier\Drivers
    >
    > 07/17/2011 10:23 PM 90,200 ncfsd.sys
    > 1 File(s) 90,200 bytes
    >
    >


    I'm running IR8 as well. Perhaps a full remove and reinstall of the client?

Reply
  • On 9/8/2011 12:46 PM, samthendsgod wrote:
    >
    > grimlock;2135632 Wrote:
    >> On 9/8/2011 12:56 AM, samthendsgod wrote:
    >>> Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
    >>> file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys

    >>
    >> What version is that file?
    >>
    >> Mine is 1.0.47.7836
    >>
    >> Just want to rule out the obvious.

    >
    >
    > Hmmm... mine is Version 1.0.47.7835. a point older. Let me see if I can
    > find the newer one. This one's from the IR8 version of the client.
    >
    > (And here's the rest of the story)
    >
    > Directory of C:\Program Files\Novell\Client\XTier\Drivers
    >
    > 07/17/2011 10:23 PM 90,200 ncfsd.sys
    > 1 File(s) 90,200 bytes
    >
    >


    I'm running IR8 as well. Perhaps a full remove and reinstall of the client?

Children
  • grimlock;2135729 wrote:
    On 9/8/2011 12:46 PM, samthendsgod wrote:
    >
    > grimlock;2135632 Wrote:
    >> On 9/8/2011 12:56 AM, samthendsgod wrote:
    >>> Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
    >>> file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys

    >>
    >> What version is that file?
    >>
    >> Mine is 1.0.47.7836
    >>
    >> Just want to rule out the obvious.

    >
    >
    > Hmmm... mine is Version 1.0.47.7835. a point older. Let me see if I can
    > find the newer one. This one's from the IR8 version of the client.
    >
    > (And here's the rest of the story)
    >
    > Directory of C:\Program Files\Novell\Client\XTier\Drivers
    >
    > 07/17/2011 10:23 PM 90,200 ncfsd.sys
    > 1 File(s) 90,200 bytes
    >
    >


    I'm running IR8 as well. Perhaps a full remove and reinstall of the client?


    Hi Grimlock,

    Happy Friday!

    So, I removed my client, deleted the directory structure to ensure the files were all gone, rebooted, reinstalled, rebooted, and checked my version again. My version didn't change. I'm wondering if perhaps you have a version that was given to you by Novell support possibly?

    The other thing I noticed is that in C:\Novell\Novell Client 2 SP1 for Windows (IR8)\amd64\Redirector> there's another ncfsd.sys file. (and one in C:\Novell\Novell Client 2 SP1 for Windows (IR8)\i386\Redirector> as well). Checking the version if the one in the amd64 directory, I DO get Version 1.0.47.7836. The one in the i386 directory however matches the one in program files\novell.... and is Version 1.0.47.7835.

    My PC has an Intel CPU, so I'm assuming it's using the Version 1.0.47.7835. If you have a PC with an AMD CPU, that could explain the difference.

    I'd sure like to figure this out. It's imperative that Treesize work correctly and not BSOD my PC. I suppose I'll end up having to open an incident with Novell and see if they can help figure it out.

    You don't know of a way to make Treesize pro write its findings directory to a file as it's discovering, rather than waiting until the scan is finished do you? I'll look at the docs and see if I can figure that out (if it's even possible). That way the BSOD won't be as devastating, losing everything it had found up to the point in the scan where the PC abends.

    Thanks Grimlock, and have a great weekend!
    Sam
  • On 9/9/2011 12:56 PM, samthendsgod wrote:
    >
    > grimlock;2135729 Wrote:
    >> On 9/8/2011 12:46 PM, samthendsgod wrote:
    >>>
    >>> grimlock;2135632 Wrote:
    >>>> On 9/8/2011 12:56 AM, samthendsgod wrote:
    >>>>> Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
    >>>>> file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys
    >>>>
    >>>> What version is that file?
    >>>>
    >>>> Mine is 1.0.47.7836
    >>>>
    >>>> Just want to rule out the obvious.
    >>>
    >>>
    >>> Hmmm... mine is Version 1.0.47.7835. a point older. Let me see if I

    >> can
    >>> find the newer one. This one's from the IR8 version of the client.
    >>>
    >>> (And here's the rest of the story)
    >>>
    >>> Directory of C:\Program Files\Novell\Client\XTier\Drivers
    >>>
    >>> 07/17/2011 10:23 PM 90,200 ncfsd.sys
    >>> 1 File(s) 90,200 bytes
    >>>
    >>>

    >>
    >> I'm running IR8 as well. Perhaps a full remove and reinstall of the
    >> client?

    >
    > Hi Grimlock,
    >
    > Happy Friday!
    >
    > So, I removed my client, deleted the directory structure to ensure the
    > files were all gone, rebooted, reinstalled, rebooted, and checked my
    > version again. My version didn't change. I'm wondering if perhaps you
    > have a version that was given to you by Novell support possibly?
    >
    > The other thing I noticed is that in C:\Novell\Novell Client 2 SP1 for
    > Windows (IR8)\amd64\Redirector> there's another ncfsd.sys file. (and one
    > in C:\Novell\Novell Client 2 SP1 for Windows (IR8)\i386\Redirector> as
    > well). Checking the version if the one in the amd64 directory, I DO get
    > Version 1.0.47.7836. The one in the i386 directory however matches the
    > one in program files\novell.... and is Version 1.0.47.7835.
    >
    > My PC has an Intel CPU, so I'm assuming it's using the Version
    > 1.0.47.7835. If you have a PC with an AMD CPU, that could explain the
    > difference.
    >
    > I'd sure like to figure this out. It's imperative that Treesize work
    > correctly and not BSOD my PC. I suppose I'll end up having to open an
    > incident with Novell and see if they can help figure it out.
    >
    > You don't know of a way to make Treesize pro write its findings
    > directory to a file as it's discovering, rather than waiting until the
    > scan is finished do you? I'll look at the docs and see if I can figure
    > that out (if it's even possible). That way the BSOD won't be as
    > devastating, losing everything it had found up to the point in the scan
    > where the PC abends.
    >
    > Thanks Grimlock, and have a great weekend!
    > Sam
    >
    >


    I don't have any special client version from Novell. I downloaded it
    from the public site.

    C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys is 1.0.47.7836

    I see the same thing that you do with the client version in the
    extracted files. The 7836 file is the file that should be in use for 64
    bit windows. The 7835 version is for 32 bit windows. Your subject
    title indicates windows 64 bit. Can you double check that it really is?