Highlighted
Absent Member.
Absent Member.
8856 views

Win7 x64 Novell Client 2 SP1 IR5 BSOD in ncfsd.sys

Hi,

One user in our company is using Windows 7 x64 and is having a trouble with latest Novell Client. It seems that specific program we use here that accesses databases from network drive is capable of repeatedly producing BSOD's in ncfsd.sys. Normally everything works but as this user had to put the program through some more rigorous usage tests today, he got four identical BSOD's in duration of few hours.

What happened was that immediately after starting the program it sometimes hung on it's first database access attempt. It was seemingly random that the program would hung on any particular time and not on some other - usually it started up normally as it has done already for months on that same system. If it hung, OS and other programs continued to be responsive for a minute or two (Netware server was also accessible), and only then - always - the BSOD came.

The databases our program uses are of Clipper / Foxpro type (DBF).

I uploaded file Heigo_20110208.7z containing one of the minidumps to ftp.novell.com incoming folder, perhaps You can read something useful out of it. Other minidumps contain the same (bugcheck 0xd1, error in ncfsd.sys, checked with WinDbg).

Thanks!
Labels (1)
0 Likes
19 Replies
Highlighted
Absent Member.
Absent Member.

On 9/7/2011 5:16 PM, samthendsgod wrote:
>
> grimlock;2135391 Wrote:
>> On 9/7/2011 4:26 PM, samthendsgod wrote:
>>>
>>> hanks for the reply Grimlock. I was using an older version of

>> Treesize
>>> (4.x). I just upgraded to 5.2.2. I've started a scan, and will let

>> you
>>> know tomorrow if it makes it through this one directory structure.
>>>
>>> Thanks
>>> Sam
>>>
>>>

>>
>> 5.2.2 or 5.5.2?

>
> My apologies...5.5.2. I kicked it off on its scan about two hours ago.
> So far so good. But yesterday it took about seven hours to crash. So we
> should know by morning. 🙂
>
> Thank you again for your help Grimlock!
> Sam
>
>


5.5.2 is a lot nicer.. It does not however like to look directly at
network drives. They don't show up in the list on mine. I can however
right click on a drive in explorer and tree size it. When you get this
sorted, try this on a weekend. Right click on a big network drive and
select tree size file search. Go to search options, uncheck custom
search and check duplicate files and click start.

Come back on monday and see how much dupe stuff you have 😛


0 Likes
Highlighted
Absent Member.
Absent Member.

On 9/8/2011 12:56 AM, samthendsgod wrote:
> Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
> file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys


What version is that file?

Mine is 1.0.47.7836

Just want to rule out the obvious.

0 Likes
Highlighted
Absent Member.
Absent Member.

grimlock;2135632 wrote:
On 9/8/2011 12:56 AM, samthendsgod wrote:
> Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
> file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys


What version is that file?

Mine is 1.0.47.7836

Just want to rule out the obvious.



Hmmm... mine is Version 1.0.47.7835. a point older. Let me see if I can find the newer one. This one's from the IR8 version of the client.

(And here's the rest of the story)

Directory of C:\Program Files\Novell\Client\XTier\Drivers

07/17/2011 10:23 PM 90,200 ncfsd.sys
1 File(s) 90,200 bytes

0 Likes
Highlighted
Absent Member.
Absent Member.

On 9/8/2011 12:46 PM, samthendsgod wrote:
>
> grimlock;2135632 Wrote:
>> On 9/8/2011 12:56 AM, samthendsgod wrote:
>>> Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
>>> file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys

>>
>> What version is that file?
>>
>> Mine is 1.0.47.7836
>>
>> Just want to rule out the obvious.

>
>
> Hmmm... mine is Version 1.0.47.7835. a point older. Let me see if I can
> find the newer one. This one's from the IR8 version of the client.
>
> (And here's the rest of the story)
>
> Directory of C:\Program Files\Novell\Client\XTier\Drivers
>
> 07/17/2011 10:23 PM 90,200 ncfsd.sys
> 1 File(s) 90,200 bytes
>
>


I'm running IR8 as well. Perhaps a full remove and reinstall of the client?

0 Likes
Highlighted
Absent Member.
Absent Member.

grimlock;2135729 wrote:
On 9/8/2011 12:46 PM, samthendsgod wrote:
>
> grimlock;2135632 Wrote:
>> On 9/8/2011 12:56 AM, samthendsgod wrote:
>>> Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
>>> file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys

>>
>> What version is that file?
>>
>> Mine is 1.0.47.7836
>>
>> Just want to rule out the obvious.

>
>
> Hmmm... mine is Version 1.0.47.7835. a point older. Let me see if I can
> find the newer one. This one's from the IR8 version of the client.
>
> (And here's the rest of the story)
>
> Directory of C:\Program Files\Novell\Client\XTier\Drivers
>
> 07/17/2011 10:23 PM 90,200 ncfsd.sys
> 1 File(s) 90,200 bytes
>
>


I'm running IR8 as well. Perhaps a full remove and reinstall of the client?


Hi Grimlock,

Happy Friday!

So, I removed my client, deleted the directory structure to ensure the files were all gone, rebooted, reinstalled, rebooted, and checked my version again. My version didn't change. I'm wondering if perhaps you have a version that was given to you by Novell support possibly?

The other thing I noticed is that in C:\Novell\Novell Client 2 SP1 for Windows (IR8)\amd64\Redirector> there's another ncfsd.sys file. (and one in C:\Novell\Novell Client 2 SP1 for Windows (IR8)\i386\Redirector> as well). Checking the version if the one in the amd64 directory, I DO get Version 1.0.47.7836. The one in the i386 directory however matches the one in program files\novell.... and is Version 1.0.47.7835.

My PC has an Intel CPU, so I'm assuming it's using the Version 1.0.47.7835. If you have a PC with an AMD CPU, that could explain the difference.

I'd sure like to figure this out. It's imperative that Treesize work correctly and not BSOD my PC. I suppose I'll end up having to open an incident with Novell and see if they can help figure it out.

You don't know of a way to make Treesize pro write its findings directory to a file as it's discovering, rather than waiting until the scan is finished do you? I'll look at the docs and see if I can figure that out (if it's even possible). That way the BSOD won't be as devastating, losing everything it had found up to the point in the scan where the PC abends.

Thanks Grimlock, and have a great weekend!
Sam

0 Likes
Highlighted
Absent Member.
Absent Member.

On 9/9/2011 12:56 PM, samthendsgod wrote:
>
> grimlock;2135729 Wrote:
>> On 9/8/2011 12:46 PM, samthendsgod wrote:
>>>
>>> grimlock;2135632 Wrote:
>>>> On 9/8/2011 12:56 AM, samthendsgod wrote:
>>>>> Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
>>>>> file path: C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys
>>>>
>>>> What version is that file?
>>>>
>>>> Mine is 1.0.47.7836
>>>>
>>>> Just want to rule out the obvious.
>>>
>>>
>>> Hmmm... mine is Version 1.0.47.7835. a point older. Let me see if I

>> can
>>> find the newer one. This one's from the IR8 version of the client.
>>>
>>> (And here's the rest of the story)
>>>
>>> Directory of C:\Program Files\Novell\Client\XTier\Drivers
>>>
>>> 07/17/2011 10:23 PM 90,200 ncfsd.sys
>>> 1 File(s) 90,200 bytes
>>>
>>>

>>
>> I'm running IR8 as well. Perhaps a full remove and reinstall of the
>> client?

>
> Hi Grimlock,
>
> Happy Friday!
>
> So, I removed my client, deleted the directory structure to ensure the
> files were all gone, rebooted, reinstalled, rebooted, and checked my
> version again. My version didn't change. I'm wondering if perhaps you
> have a version that was given to you by Novell support possibly?
>
> The other thing I noticed is that in C:\Novell\Novell Client 2 SP1 for
> Windows (IR8)\amd64\Redirector> there's another ncfsd.sys file. (and one
> in C:\Novell\Novell Client 2 SP1 for Windows (IR8)\i386\Redirector> as
> well). Checking the version if the one in the amd64 directory, I DO get
> Version 1.0.47.7836. The one in the i386 directory however matches the
> one in program files\novell.... and is Version 1.0.47.7835.
>
> My PC has an Intel CPU, so I'm assuming it's using the Version
> 1.0.47.7835. If you have a PC with an AMD CPU, that could explain the
> difference.
>
> I'd sure like to figure this out. It's imperative that Treesize work
> correctly and not BSOD my PC. I suppose I'll end up having to open an
> incident with Novell and see if they can help figure it out.
>
> You don't know of a way to make Treesize pro write its findings
> directory to a file as it's discovering, rather than waiting until the
> scan is finished do you? I'll look at the docs and see if I can figure
> that out (if it's even possible). That way the BSOD won't be as
> devastating, losing everything it had found up to the point in the scan
> where the PC abends.
>
> Thanks Grimlock, and have a great weekend!
> Sam
>
>


I don't have any special client version from Novell. I downloaded it
from the public site.

C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys is 1.0.47.7836

I see the same thing that you do with the client version in the
extracted files. The 7836 file is the file that should be in use for 64
bit windows. The 7835 version is for 32 bit windows. Your subject
title indicates windows 64 bit. Can you double check that it really is?

0 Likes
Highlighted
Absent Member.
Absent Member.

samthendsgod <samthendsgod@no-mx.forums.novell.com> wrote:

> I'm using Novell Client 2 SP1 for Windows 7 (IR8), and still having the
> BSOD pointing back to ncfsd.sys KERNEL_MODE_EXCEPTION_NOT_HANDLED.
> ...
> I wanted to add that I have several crash dumps of this happening, and
> can upload them if needed (the ones Windows generates upon a BSOD) if
> they would help. Since I can't add an attachment I'm unsure of where I
> can put them though.


If you still have an IR8-based crash dump and can upload it, please
use the same information as is being provided for the "new IR9 crash"
to make the dump information available to Novell for analysis.

Currently there is a suspicion that the IR9 crash may actually be an
issue that existed in IR8, meaning for reasons unknown it escaped
detection in both Novell's testing and even most customer use of IR8.
So seeing your IR8 crash would help explore and confirm that
possibility.

> We'll take whatever minidumps someone already has just to see if enough
> clues are there, but setting Windows to "Kernel memory" dump (not
> "Complete", which isn't necessary for this) and capturing a new example
> should be assumed as the needed info.
>
> Please provide this information to me directly with the subject of IR9
> BSOD (probello@novell.com) and I will see that an SR is opened for you
> at no charge and get it assigned to the correct people or open an SR
> yourself, with the requested information. Let me know the SR number and
> again I will make sure it's assigned to the correct people.
>
> If you try emailing the file to Pam and it bounces back, please upload
> it to ftp.novell.com/incoming and email Pam the filename so that she can
> grab it from the FTP server.


Alan Adams
Novell Client CPR Group
alan.adams@novell.com

Novell
Making IT Work As One
www.novell.com

Upgrade to OES Community
http://www.novell.com/communities/coolsolutions/upgradetooes/
0 Likes
Highlighted
Absent Member.
Absent Member.

For what it's worth, I'm experiencing the same crashes as grimlock, same faulting module. I have the client installed on a Hyper-V hosted 2008 R2 virtual machine. The faults in ncfsd.sys have been there since the first client install I made, with IR5. I'm currently at IR9a. My last crash was a few moments ago with IR8, and I've installed IR9a hoping it would make a difference, but I don't see anything in the readme/release notes indicating these issues have been addressed.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.