SMB2 File Corruption
Posted: Sat May 15, 2021 12:44 pm
SMB2 Client Redirector Caches Explained
The following information is extracted from Microsoft Knowledge Base article found here:
https://docs.microsoft.com/en-us/previo ... v=ws.10%29
Summary
The SMB Redirector component implements the client portion of the file-and-print sharing functionality exposed by Windows through Microsoft Networking. The implementation is based on the Server Message Block (SMB) protocol. The SMB protocol allows the client computer to access files on another computer that implements the SMB server portion of the file-and-print sharing functionality, as well as access to a shared printer. The SMB protocol also establishes caches on a client which allow the client to more efficiently satisfy file data, metadata (file attributes, presence or absence of files) and directory enumeration.
Details
With the release of SMB 2.0 in Windows Vista® and Windows Server 2008, three file metadata caches were implemented to speed up the return of the most recently accessed file and directory information. These caches also reduce the number of interactions a client requires with a SMB server for common file browsing operations. This has value in a scenario such as a client browsing a network file directory while connected via a low bandwidth or high latency connection. For common network file browsing scenarios, the default values are sufficient and should not be altered. Changing these cache timeout values can have significant performance implications to many network file scenarios. As each of these caches is designed to reduce the number of SMB server requests, they are important not only in client response time evaluation, but also in overall SMB server scalability and performance.
If changes are deemed necessary to these default values, they may be altered by creating these client registry keys and changing to the appropriate setting. Each cache is independent and controls specific information. It is not necessary to change all of the caches if a change to any one of the caches is necessary, as they operate independently and control different redirector optimizations.The default values were selected for the broadest range of SMB file access scenarios. However these default settings may not be appropriate for all network application usage.
Applications which require a high level of file information consistency across clients which may utilize creation or changing of a file as a notification mechanism to other nodes may encounter delays or consistency issues with these default values. There are other programmatic recommendations for an application to be notified of a change on a file, or directory such as the FindFirstChangeNotification, FindNextChangeNotification, or the ReadDirectoryChangesW APIs which are described within the Win32 and Com Development File Systems documentation on the Microsoft Developer Network. For more information on the specific reference to Obtaining Directory Change, see Obtaining Directory Change Notifications in the Microsoft Developer Network (http://go.microsoft.com/fwlink/?LinkId=187242).
There are three different caches utilized by the client SMB network redirector if SMB 2.0 is the negotiated protocol.
File Information Cache [DWORD] FileInfoCacheLifetime
File attribute information which is contained in the File_Network_Open_Information structure which is useful in conserving network IO for retrieving common file metadata information. To disable or turn off the caching behavior the value of this registry key should be changed to 0. Turning off the file information cache is not recommended as it could nearly double the number of network transactions required for executing a given scenario.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters
Default setting: 10 (seconds)
File Not Found Cache [DWORD] FileNotFoundCacheLifetime
This is a cache of files which the client failed to open because the file was not present on the server. This prevents the client from repeatedly attempting to open files which are known not to exist on the server. This cache is likely to affect distributed applications running on multiple computers accessing a set of files on a server – where the applications use an out of band mechanism to signal each other about addition/deletion of files on the server.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters
Default setting: 10 (seconds)
Directory Cache [DWORD] DirectoryCacheLifetime
This is a cache of recent directory enumerations performed by the client. Subsequent enumeration requests made by client applications as well as metadata queries for files in the directory can be satisfied from the cache. The client also uses the directory cache to determine the presence or absence of a file in the directory and uses that information to prevent clients from repeatedly attempting to open files which are known not to exist on the server. This cache is likely to affect distributed applications running on multiple computers accessing a set of files on a server – where the applications use an out of band mechanism to signal each other about modification/addition/deletion of files on the server.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters
Default setting: 10 (seconds)
Recommendations
If you suspect metadata caching in the redirector as cause for misbehaving applications, disable the caches in the following order to determine which of these caches is affecting the application. Disabling the File information cache can have significant effect on client performance and show an increase in the number of metadata requests that are sent to the server.
Directory cache, by setting DirectoryCacheLifetime to ZERO.
File Not Found cache, by setting FileNotFoundCacheLifetime to ZERO.
File information cache, by setting FileInfoCacheLifetime to ZERO.
The following information is extracted from Microsoft Knowledge Base article found here:
https://docs.microsoft.com/en-us/previo ... v=ws.10%29
Summary
The SMB Redirector component implements the client portion of the file-and-print sharing functionality exposed by Windows through Microsoft Networking. The implementation is based on the Server Message Block (SMB) protocol. The SMB protocol allows the client computer to access files on another computer that implements the SMB server portion of the file-and-print sharing functionality, as well as access to a shared printer. The SMB protocol also establishes caches on a client which allow the client to more efficiently satisfy file data, metadata (file attributes, presence or absence of files) and directory enumeration.
Details
With the release of SMB 2.0 in Windows Vista® and Windows Server 2008, three file metadata caches were implemented to speed up the return of the most recently accessed file and directory information. These caches also reduce the number of interactions a client requires with a SMB server for common file browsing operations. This has value in a scenario such as a client browsing a network file directory while connected via a low bandwidth or high latency connection. For common network file browsing scenarios, the default values are sufficient and should not be altered. Changing these cache timeout values can have significant performance implications to many network file scenarios. As each of these caches is designed to reduce the number of SMB server requests, they are important not only in client response time evaluation, but also in overall SMB server scalability and performance.
If changes are deemed necessary to these default values, they may be altered by creating these client registry keys and changing to the appropriate setting. Each cache is independent and controls specific information. It is not necessary to change all of the caches if a change to any one of the caches is necessary, as they operate independently and control different redirector optimizations.The default values were selected for the broadest range of SMB file access scenarios. However these default settings may not be appropriate for all network application usage.
Applications which require a high level of file information consistency across clients which may utilize creation or changing of a file as a notification mechanism to other nodes may encounter delays or consistency issues with these default values. There are other programmatic recommendations for an application to be notified of a change on a file, or directory such as the FindFirstChangeNotification, FindNextChangeNotification, or the ReadDirectoryChangesW APIs which are described within the Win32 and Com Development File Systems documentation on the Microsoft Developer Network. For more information on the specific reference to Obtaining Directory Change, see Obtaining Directory Change Notifications in the Microsoft Developer Network (http://go.microsoft.com/fwlink/?LinkId=187242).
There are three different caches utilized by the client SMB network redirector if SMB 2.0 is the negotiated protocol.
File Information Cache [DWORD] FileInfoCacheLifetime
File attribute information which is contained in the File_Network_Open_Information structure which is useful in conserving network IO for retrieving common file metadata information. To disable or turn off the caching behavior the value of this registry key should be changed to 0. Turning off the file information cache is not recommended as it could nearly double the number of network transactions required for executing a given scenario.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters
Default setting: 10 (seconds)
File Not Found Cache [DWORD] FileNotFoundCacheLifetime
This is a cache of files which the client failed to open because the file was not present on the server. This prevents the client from repeatedly attempting to open files which are known not to exist on the server. This cache is likely to affect distributed applications running on multiple computers accessing a set of files on a server – where the applications use an out of band mechanism to signal each other about addition/deletion of files on the server.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters
Default setting: 10 (seconds)
Directory Cache [DWORD] DirectoryCacheLifetime
This is a cache of recent directory enumerations performed by the client. Subsequent enumeration requests made by client applications as well as metadata queries for files in the directory can be satisfied from the cache. The client also uses the directory cache to determine the presence or absence of a file in the directory and uses that information to prevent clients from repeatedly attempting to open files which are known not to exist on the server. This cache is likely to affect distributed applications running on multiple computers accessing a set of files on a server – where the applications use an out of band mechanism to signal each other about modification/addition/deletion of files on the server.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters
Default setting: 10 (seconds)
Recommendations
If you suspect metadata caching in the redirector as cause for misbehaving applications, disable the caches in the following order to determine which of these caches is affecting the application. Disabling the File information cache can have significant effect on client performance and show an increase in the number of metadata requests that are sent to the server.
Directory cache, by setting DirectoryCacheLifetime to ZERO.
File Not Found cache, by setting FileNotFoundCacheLifetime to ZERO.
File information cache, by setting FileInfoCacheLifetime to ZERO.