Everything sometimes hangs while updating its index
Posted: Fri Sep 07, 2018 6:34 pm
I'm running the latest released version (1.4.1.895 (x64)) as a background process, not a service. I've occasionally been seeing behavior as described by a previous user here: viewtopic.php?f=6&t=5843 - Everything has one thread using 100% of the core it's running on and it stops updating its database. No file system changes are detected after this thread seems to get stuck in a loop, but I can still open new Everything windows and search the existing (outdated) database. If I restart Everything, it will be fine for a while until something gets it back into this state.
I enabled the debug log file for Everything and the next time this happened, it logged hundreds of megabytes of "attribute list 00" before I noticed and restarted the process. Leading up to this in the log, it looks like some folders/files were deleted:
2018-09-06 14:10:42.286: remove ntfs folder js with children
2018-09-06 14:10:42.286: remove subfolders and files from js
2018-09-06 14:10:42.286: USN 2018-09-06 14:10:42.286: HARD_LINK_CHANGE 2018-09-06 14:10:42.286: CLOSE 2018-09-06 14:10:42.286: I25F00.tte
...
2018-09-06 14:10:42.286: USN 2018-09-06 14:10:42.286: DELETE 2018-09-06 14:10:42.286: CLOSE 2018-09-06 14:10:42.286: fonts
...
2018-09-06 14:10:42.291: attribute list 00
2018-09-06 14:10:42.291: attribute list 00
2018-09-06 14:10:42.291: parent backup count 0
2018-09-06 14:10:42.291: attribute list 00
2018-09-06 14:10:42.291: attribute list 00
...
2018-09-06 14:10:42.324: attribute list 00
2018-09-06 14:10:42.324: removed 0 subfolders and 36 files from js in 0.038433 seconds
2018-09-06 14:10:42.324: attribute list 00
...
2018-09-06 14:10:42.325: attribute list 00
2018-09-06 14:10:42.325: remove ntfs folder css with children
2018-09-06 14:10:42.325: remove subfolders and files from css
2018-09-06 14:10:42.325: attribute list 00
..
2018-09-06 14:10:42.348: attribute list 00
2018-09-06 14:10:42.348: removed 0 subfolders and 2 files from css in 0.023237 seconds
2018-09-06 14:10:42.348: attribute list 00
...
2018-09-06 14:10:42.348: attribute list 00
2018-09-06 14:10:42.348: remove ntfs folder js with children
2018-09-06 14:10:42.348: remove subfolders and files from js
2018-09-06 14:10:42.348: attribute list 00
Once the "attribute list 00" flood starts, there are some lines intermittently showing other stuff happening, but the vast majority of the lines logged are just the same line about the attribute list. I looked at Everything in Process Explorer and saw that the only CPU usage was a single thread maxing out one core. I took some samples of the stack for this thread to get you some idea of where it seems to be running:
ntoskrnl.exe!KiCpuId+0xaa
ntoskrnl.exe!ExReleaseResourceAndLeaveCriticalRegion+0x212
ntoskrnl.exe!KeWaitForMutexObject+0x1a3
ntoskrnl.exe!ExReleaseResourceForThreadLite+0xb8
ntoskrnl.exe!KeSetTimer+0x7e1
ntoskrnl.exe!KiCpuId+0x2533
ntoskrnl.exe!CcCopyRead+0x515
ntoskrnl.exe!NtQueryVolumeInformationFile+0x1249
ntoskrnl.exe!NtFsControlFile+0x56
ntoskrnl.exe!longjmp+0x5c63
ntdll.dll!NtFsControlFile+0xa
KERNELBASE.dll!OpenThread+0xa8
kernel32.dll!DeviceIoControl+0x7f
Everything.exe+0xcfff0
Everything.exe+0x4b3f8
Everything.exe+0x4ccc2
Everything.exe+0xdfa21
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x1d
ntoskrnl.exe!KiCpuId+0xaa
ntoskrnl.exe!ExReleaseResourceAndLeaveCriticalRegion+0x212
ntoskrnl.exe!KeWaitForMutexObject+0x1a3
ntoskrnl.exe!ExReleaseResourceForThreadLite+0xb8
ntoskrnl.exe!KeSetTimer+0x7e1
ntoskrnl.exe!KiCheckForKernelApcDelivery+0x25
Ntfs.sys+0xba3c2
fltmgr.sys!FltIsCallbackDataDirty+0x2df
fltmgr.sys!FltDeletePushLock+0x50e
fltmgr.sys!FltIsCallbackDataDirty+0x2df
fltmgr.sys!FltDeletePushLock+0x50e
ntoskrnl.exe!CcCopyRead+0x4aa
ntoskrnl.exe!NtQueryVolumeInformationFile+0x1249
ntoskrnl.exe!NtFsControlFile+0x56
ntoskrnl.exe!longjmp+0x5c63
ntdll.dll!NtFsControlFile+0xa
KERNELBASE.dll!OpenThread+0xa8
kernel32.dll!DeviceIoControl+0x7f
Everything.exe+0xcfff0
Everything.exe+0x4b3f8
Everything.exe+0x4ccc2
Everything.exe+0xdfa21
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x1d
ntoskrnl.exe!KiCpuId+0xaa
ntoskrnl.exe!ExReleaseResourceAndLeaveCriticalRegion+0x212
ntoskrnl.exe!KeWaitForMutexObject+0x1a3
ntoskrnl.exe!ExReleaseResourceForThreadLite+0xb8
ntoskrnl.exe!KeSetTimer+0x7e1
ntoskrnl.exe!KiCheckForKernelApcDelivery+0x25
fltmgr.sys!FltAcquirePushLockShared+0x2ab
fltmgr.sys!FltIsCallbackDataDirty+0xa67
fltmgr.sys!FltDeletePushLock+0x4f2
fltmgr.sys!FltIsCallbackDataDirty+0x2df
fltmgr.sys!FltDeletePushLock+0x50e
ntoskrnl.exe!CcCopyRead+0x4aa
ntoskrnl.exe!NtQueryVolumeInformationFile+0x1249
ntoskrnl.exe!NtFsControlFile+0x56
ntoskrnl.exe!longjmp+0x5c63
ntdll.dll!NtFsControlFile+0xa
KERNELBASE.dll!OpenThread+0xa8
kernel32.dll!DeviceIoControl+0x7f
Everything.exe+0xcfff0
Everything.exe+0x4b3f8
Everything.exe+0x4ccc2
Everything.exe+0xdfa21
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x1d
ntoskrnl.exe!KiCpuId+0xaa
ntoskrnl.exe!ExReleaseResourceAndLeaveCriticalRegion+0x212
ntoskrnl.exe!KeWaitForMutexObject+0x1a3
ntoskrnl.exe!ExReleaseResourceForThreadLite+0xb8
ntoskrnl.exe!KeSetTimer+0x7e1
ntoskrnl.exe!KiCheckForKernelApcDelivery+0x25
ntoskrnl.exe!ObReferenceObjectByHandleWithTag+0x3ce
ntoskrnl.exe!ObReferenceObjectByHandle+0x25
ntoskrnl.exe!NtQueryVolumeInformationFile+0x75b
ntoskrnl.exe!NtFsControlFile+0x56
ntoskrnl.exe!longjmp+0x5c63
ntdll.dll!NtFsControlFile+0xa
KERNELBASE.dll!OpenThread+0xa8
kernel32.dll!DeviceIoControl+0x7f
Everything.exe+0xcfff0
Everything.exe+0x4b3f8
Everything.exe+0x4ccc2
Everything.exe+0xdfa21
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x1d
Hopefully this is helpful. Let me know if there's anything else I can do to help with this. If the full debug log files would help (I captured logs when this happened a couple times), let me know and I can email them to you - it's about 3MB total when compressed with 7z. Thank you!
I enabled the debug log file for Everything and the next time this happened, it logged hundreds of megabytes of "attribute list 00" before I noticed and restarted the process. Leading up to this in the log, it looks like some folders/files were deleted:
2018-09-06 14:10:42.286: remove ntfs folder js with children
2018-09-06 14:10:42.286: remove subfolders and files from js
2018-09-06 14:10:42.286: USN 2018-09-06 14:10:42.286: HARD_LINK_CHANGE 2018-09-06 14:10:42.286: CLOSE 2018-09-06 14:10:42.286: I25F00.tte
...
2018-09-06 14:10:42.286: USN 2018-09-06 14:10:42.286: DELETE 2018-09-06 14:10:42.286: CLOSE 2018-09-06 14:10:42.286: fonts
...
2018-09-06 14:10:42.291: attribute list 00
2018-09-06 14:10:42.291: attribute list 00
2018-09-06 14:10:42.291: parent backup count 0
2018-09-06 14:10:42.291: attribute list 00
2018-09-06 14:10:42.291: attribute list 00
...
2018-09-06 14:10:42.324: attribute list 00
2018-09-06 14:10:42.324: removed 0 subfolders and 36 files from js in 0.038433 seconds
2018-09-06 14:10:42.324: attribute list 00
...
2018-09-06 14:10:42.325: attribute list 00
2018-09-06 14:10:42.325: remove ntfs folder css with children
2018-09-06 14:10:42.325: remove subfolders and files from css
2018-09-06 14:10:42.325: attribute list 00
..
2018-09-06 14:10:42.348: attribute list 00
2018-09-06 14:10:42.348: removed 0 subfolders and 2 files from css in 0.023237 seconds
2018-09-06 14:10:42.348: attribute list 00
...
2018-09-06 14:10:42.348: attribute list 00
2018-09-06 14:10:42.348: remove ntfs folder js with children
2018-09-06 14:10:42.348: remove subfolders and files from js
2018-09-06 14:10:42.348: attribute list 00
Once the "attribute list 00" flood starts, there are some lines intermittently showing other stuff happening, but the vast majority of the lines logged are just the same line about the attribute list. I looked at Everything in Process Explorer and saw that the only CPU usage was a single thread maxing out one core. I took some samples of the stack for this thread to get you some idea of where it seems to be running:
ntoskrnl.exe!KiCpuId+0xaa
ntoskrnl.exe!ExReleaseResourceAndLeaveCriticalRegion+0x212
ntoskrnl.exe!KeWaitForMutexObject+0x1a3
ntoskrnl.exe!ExReleaseResourceForThreadLite+0xb8
ntoskrnl.exe!KeSetTimer+0x7e1
ntoskrnl.exe!KiCpuId+0x2533
ntoskrnl.exe!CcCopyRead+0x515
ntoskrnl.exe!NtQueryVolumeInformationFile+0x1249
ntoskrnl.exe!NtFsControlFile+0x56
ntoskrnl.exe!longjmp+0x5c63
ntdll.dll!NtFsControlFile+0xa
KERNELBASE.dll!OpenThread+0xa8
kernel32.dll!DeviceIoControl+0x7f
Everything.exe+0xcfff0
Everything.exe+0x4b3f8
Everything.exe+0x4ccc2
Everything.exe+0xdfa21
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x1d
ntoskrnl.exe!KiCpuId+0xaa
ntoskrnl.exe!ExReleaseResourceAndLeaveCriticalRegion+0x212
ntoskrnl.exe!KeWaitForMutexObject+0x1a3
ntoskrnl.exe!ExReleaseResourceForThreadLite+0xb8
ntoskrnl.exe!KeSetTimer+0x7e1
ntoskrnl.exe!KiCheckForKernelApcDelivery+0x25
Ntfs.sys+0xba3c2
fltmgr.sys!FltIsCallbackDataDirty+0x2df
fltmgr.sys!FltDeletePushLock+0x50e
fltmgr.sys!FltIsCallbackDataDirty+0x2df
fltmgr.sys!FltDeletePushLock+0x50e
ntoskrnl.exe!CcCopyRead+0x4aa
ntoskrnl.exe!NtQueryVolumeInformationFile+0x1249
ntoskrnl.exe!NtFsControlFile+0x56
ntoskrnl.exe!longjmp+0x5c63
ntdll.dll!NtFsControlFile+0xa
KERNELBASE.dll!OpenThread+0xa8
kernel32.dll!DeviceIoControl+0x7f
Everything.exe+0xcfff0
Everything.exe+0x4b3f8
Everything.exe+0x4ccc2
Everything.exe+0xdfa21
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x1d
ntoskrnl.exe!KiCpuId+0xaa
ntoskrnl.exe!ExReleaseResourceAndLeaveCriticalRegion+0x212
ntoskrnl.exe!KeWaitForMutexObject+0x1a3
ntoskrnl.exe!ExReleaseResourceForThreadLite+0xb8
ntoskrnl.exe!KeSetTimer+0x7e1
ntoskrnl.exe!KiCheckForKernelApcDelivery+0x25
fltmgr.sys!FltAcquirePushLockShared+0x2ab
fltmgr.sys!FltIsCallbackDataDirty+0xa67
fltmgr.sys!FltDeletePushLock+0x4f2
fltmgr.sys!FltIsCallbackDataDirty+0x2df
fltmgr.sys!FltDeletePushLock+0x50e
ntoskrnl.exe!CcCopyRead+0x4aa
ntoskrnl.exe!NtQueryVolumeInformationFile+0x1249
ntoskrnl.exe!NtFsControlFile+0x56
ntoskrnl.exe!longjmp+0x5c63
ntdll.dll!NtFsControlFile+0xa
KERNELBASE.dll!OpenThread+0xa8
kernel32.dll!DeviceIoControl+0x7f
Everything.exe+0xcfff0
Everything.exe+0x4b3f8
Everything.exe+0x4ccc2
Everything.exe+0xdfa21
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x1d
ntoskrnl.exe!KiCpuId+0xaa
ntoskrnl.exe!ExReleaseResourceAndLeaveCriticalRegion+0x212
ntoskrnl.exe!KeWaitForMutexObject+0x1a3
ntoskrnl.exe!ExReleaseResourceForThreadLite+0xb8
ntoskrnl.exe!KeSetTimer+0x7e1
ntoskrnl.exe!KiCheckForKernelApcDelivery+0x25
ntoskrnl.exe!ObReferenceObjectByHandleWithTag+0x3ce
ntoskrnl.exe!ObReferenceObjectByHandle+0x25
ntoskrnl.exe!NtQueryVolumeInformationFile+0x75b
ntoskrnl.exe!NtFsControlFile+0x56
ntoskrnl.exe!longjmp+0x5c63
ntdll.dll!NtFsControlFile+0xa
KERNELBASE.dll!OpenThread+0xa8
kernel32.dll!DeviceIoControl+0x7f
Everything.exe+0xcfff0
Everything.exe+0x4b3f8
Everything.exe+0x4ccc2
Everything.exe+0xdfa21
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x1d
Hopefully this is helpful. Let me know if there's anything else I can do to help with this. If the full debug log files would help (I captured logs when this happened a couple times), let me know and I can email them to you - it's about 3MB total when compressed with 7z. Thank you!