Menu

PERFORMANCE - LINUX VS WINDOWS - SAME ARRAY

Help
2020-11-13
2022-03-10
  • Night Rider

    Night Rider - 2020-11-13

    Can anyone explain this to me? Exact same array, linux takes 4 minutes to hash, windows takes 30 minutes.
    Linux was run in a virtual machine on the same server as the windows ntfs array, which was then mounted as a SMB share in linux to perform the hash check.


    root@znode1 /fpool# snapraid -c ./snapraid.conf check -a -D -U -v -f '/{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}/duplicate.txt'
    Self test...
    Loading state from /fpool/content/C.content...
    Filtering...
    Using 6160 MiB of memory for the file-system.
    Initializing...
    Hashing...
    correct {B529D1FE-2533-408B-AF3A-3CC9AE8A2975}/duplicate.txt
    100% completed, 13 MB accessed in 0:04
    Everything OK


    [fnode1]: PS C:\array\snapraid> ./snapraid check -a -f '/{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}/duplicate.txt'
    Self test...
    Loading state from C:/C.content...
    Filtering...
    Using 6160 MiB of memory for the file-system.
    Initializing...
    Hashing...
    100% completed, 13 MB accessed in 0:29
    Everything OK

     
  • Leifi Plomeros

    Leifi Plomeros - 2020-11-13

    Did you observe it while it was in progress on the Windows machine?

    I just noticed that both fix and check takes extremely long time to finish after it is done on Windows 10 build 19041 (aka 2004) using snapraid v11.4.

    A tiny 2 KB file took 8 minutes to check (showing 100% progress the entire time).

    Restoring the same file using fix also took 8 minutes but I could verify that it was perfectly restored in the first minute.

     
    • Night Rider

      Night Rider - 2020-11-13

      I'm using Windows Server 2019 (1809) and SR 11.5 on both Windows and Linux.

      99% of the time on Windows there was 0% disk activity on the array and 15% CPU activity in task manager.

      I have no idea what SR is doing during those 25 or so minutes of zero activity.
      It just sits on "Hashing" with no activity showing at all until the last couple minutes.
      Initially I thought it froze up. After seeing the 15% cpu activity though I just let it go to see what happens.

      This is all I see for the first 25 or so minutes.

      Self test...
      Loading state from C:/C.content...
      Filtering...
      Using 6160 MiB of memory for the file-system.
      Initializing...
      Hashing...

       

      Last edit: Night Rider 2020-11-13
  • UhClem

    UhClem - 2020-11-13

    Even though you have specified one (specific) file, the (only) mechanism for doing so is filtering (-f), which requires mucho directory scanning (at the very least). Possibly, the "disk activity" metric only covers file I/O.

    Nothing jumps out to me regarding "linux via SMB" finishing faster than "native Windows" though.

     

    Last edit: UhClem 2020-11-13
    • Night Rider

      Night Rider - 2020-11-14

      Accessing the MFT, Volume Log or $Extend would still show under PerfMon.
      I see no activity at all from snapraid.exe process other than chewing up CPU cycles.
      I have run another test using Process Monitor and will post the results shortly.
      It clearly shows snapraid.exe accessing the content files then going dead.
      Then accessing the filtered file, then going dead again.
      Not sure what it is doing.

      Also, doing a "snapraid diff" only takes 2 minutes.

       

      Last edit: Night Rider 2020-11-14
  • Leifi Plomeros

    Leifi Plomeros - 2020-11-13

    After some testing and then some more testing on two different Windows machines...

    I think there is a performance problem for fix and check related to the number of blocks in the array. Presumably only in Windows.

    On my plex "server" with a tiny 15 GB array:
    Checking and fixing a 1 GB file completes in a few seconds,
    Absolutely no observable freeze before or after checking.
    Tested first on Snapraid 11.2 and then repeated in 11.5

    Changed blocksize from 256 to 2.
    Repeated test in 11.5: ~1 second freeze when expecting to see 100% + Everything OK.

    On my file "server":
    Small array with 6 TB total data, blocksize 2048, v11.2:
    2 second delay before checking begins.
    5 seconds freeze at 95% then instantly 100% + Everything OK.

    Also on the file "server":
    200 TB array, blocksize 512
    Snapraid diff: ~15-20 seconds total
    Begin sync: 1.5 minutes total time including saving state and everything else.
    Check a tiny file: 8 minutes total freeze.
    Check all files in a folder: 8 minutes total freeze.
    Fix a folder with 5 files: 8 minutes total freeze.
    Everything check or fix-related: 8 minutes total freeze.
    No difference between 11.4 and 11.5 (did not test 11.2)

    Typically smaller delay before progress starts to count and then long freeze exactly at the moment when 100% + Everything OK is expected to show. During freeze CPU usage is more or less constant at around 33-35%

    Interrestingly when I tested to fix the folder with 5 files this happened:
    Checking...
    Freeze for a while
    3 files completely restored (~200 MB total)
    Several minutes freeze.
    2 remaining files restored (0 byte size)
    Possibly short freeze (I did not pay attention)
    Total time: 8 min.

     

    Last edit: Leifi Plomeros 2020-11-13
    • Night Rider

      Night Rider - 2020-11-14

      I'm sorry, you have so many changing variables I'm not sure what you are proving here.

       
      • Leifi Plomeros

        Leifi Plomeros - 2020-11-14

        Freeze occurs before, between or after files are being checked/fixed. (Last example)

        The frozen time is constant regardless if checking 1 or many files (all examples from 200TB array)

        The frozen time is affected by number of blocks (first example: From not visible to visible when decreasing blocksize = increased number of blocks).

        It basically looks like this is what happens:
        Block 0´to 20493 = Nothing to do; short freeze while evaluating.
        Block 20494 = Match found - Do check or fix
        Block 20495 to 483983 Nothing to do; Long freeze while evaluating.
        Done, Everything OK.

         
  • Night Rider

    Night Rider - 2020-11-14

    Here is the output from procmon, I've truncated some parts for sanity.
    You can clearly see where it stops accessing the content file and freezes up doing who knows what.

    Friday, November 13, 2020 3:54:13 PM
    
    Self test...
    Loading state from C:/Array/D1/D1.content...
    Filtering...
    Using 6160 MiB of memory for the file-system.
    Initializing...
    Hashing...
    0%, 0 MB
    100% completed, 13 MB accessed in 0:28
    Everything OK
    
    Friday, November 13, 2020 4:25:13 PM
    
    ----------------
    
    3:54:13.1412264 PM  snapraid.exe    6336    Process Start       SUCCESS Parent PID: 8156, Command line: "C:\array\SnapRAID\snapraid.exe" check -a -f /{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}/duplicate.txt, Current directory: C:\array\SnapRAID\, Environment: 
    3:54:13.1412338 PM  snapraid.exe    6336    Thread Create       SUCCESS Thread ID: 256
    3:54:13.1420463 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Array\SnapRAID\snapraid.exe  SUCCESS 
    3:54:13.1421268 PM  snapraid.exe    6336    Load Image  C:\Array\SnapRAID\snapraid.exe  SUCCESS Image Base: 0x400000, Image Size: 0x242000
    3:54:13.1421412 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\ntdll.dll   SUCCESS 
    3:54:13.1422051 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\ntdll.dll   SUCCESS Image Base: 0x7ffc840b0000, Image Size: 0x1ed000
    3:54:13.1423221 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Session Manager   REPARSE Desired Access: Query Value
    3:54:13.1423381 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Session Manager   SUCCESS Desired Access: Query Value
    3:54:13.1423561 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Session Manager\RaiseExceptionOnPossibleDeadlock  NAME NOT FOUND  Length: 80
    3:54:13.1423725 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager   SUCCESS 
    3:54:13.1423915 PM  snapraid.exe    6336    RegOpenKey  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap  REPARSE Desired Access: Query Value
    3:54:13.1424043 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Session Manager\Segment Heap  NAME NOT FOUND  Desired Access: Query Value
    3:54:13.1424527 PM  snapraid.exe    6336    RegOpenKey  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager   REPARSE Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1424686 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Session Manager   SUCCESS Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1424875 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Session Manager\ResourcePolicies  NAME NOT FOUND  Length: 24
    3:54:13.1425024 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager   SUCCESS 
    3:54:13.1427830 PM  snapraid.exe    6336    CreateFile  C:\Array\SnapRAID   SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened
    3:54:13.1428558 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\kernel32.dll    SUCCESS 
    3:54:13.1429277 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\kernel32.dll    SUCCESS Image Base: 0x7ffc81ef0000, Image Size: 0xb3000
    3:54:13.1430120 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\KernelBase.dll  SUCCESS 
    3:54:13.1430796 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\KernelBase.dll  SUCCESS Image Base: 0x7ffc809f0000, Image Size: 0x295000
    3:54:13.1437277 PM  snapraid.exe    6336    CreateFile  C:\Windows\System32\conhost.exe SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.1437781 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\conhost.exe FILE LOCKED WITH ONLY READERS   SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_WRITECOPY
    3:54:13.1438064 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    REPARSE Desired Access: Read
    3:54:13.1438247 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    SUCCESS Desired Access: Read
    3:54:13.1438420 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\CI\Disable26178932    NAME NOT FOUND  Length: 20
    3:54:13.1438611 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\CI    SUCCESS 
    3:54:13.1438767 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    REPARSE Desired Access: Query Value
    3:54:13.1438927 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    SUCCESS Desired Access: Query Value
    3:54:13.1439098 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\CI\Disable26178932    NAME NOT FOUND  Length: 80
    3:54:13.1439281 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\CI    SUCCESS 
    3:54:13.1439422 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\conhost.exe SUCCESS SyncType: SyncTypeOther
    3:54:13.1439734 PM  snapraid.exe    6336    RegOpenKey  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conhost.exe  NAME NOT FOUND  Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1440043 PM  snapraid.exe    6336    QuerySecurityFile   C:\Windows\System32\conhost.exe SUCCESS Information: Label
    3:54:13.1440326 PM  snapraid.exe    6336    QueryNameInformationFile    C:\Windows\System32\conhost.exe SUCCESS Name: \Windows\System32\conhost.exe
    3:54:13.1442517 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\conhost.exe SUCCESS 
    3:54:13.1443284 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\conhost.exe SUCCESS 
    3:54:13.1443832 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2648661635-360164544-2101290831-2101 SUCCESS Desired Access: All Access
    3:54:13.1444015 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2648661635-360164544-2101290831-2101\\Device\HarddiskVolume17\Windows\System32\conhost.exe   NAME NOT FOUND  Length: 40
    3:54:13.1444220 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2648661635-360164544-2101290831-2101 SUCCESS 
    3:54:13.1444372 PM  snapraid.exe    6336    RegOpenKey  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BAM   REPARSE Desired Access: Query Value
    3:54:13.1444542 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Session Manager\BAM   NAME NOT FOUND  Desired Access: Query Value
    3:54:13.1444993 PM  snapraid.exe    6336    Process Create  C:\windows\System32\Conhost.exe SUCCESS PID: 2068, Command line: \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1
    3:54:13.1445330 PM  snapraid.exe    6336    CloseFile   C:\Windows\System32\conhost.exe SUCCESS 
    3:54:13.1716802 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Terminal Server   REPARSE Desired Access: Read
    3:54:13.1716970 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Terminal Server   SUCCESS Desired Access: Read
    3:54:13.1717132 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat   NAME NOT FOUND  Length: 548
    3:54:13.1717277 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Terminal Server\TSUserEnabled SUCCESS Type: REG_DWORD, Length: 4, Data: 0
    3:54:13.1717439 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\Terminal Server   SUCCESS 
    3:54:13.1718776 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\SafeBoot\Option   REPARSE Desired Access: Query Value, Set Value
    3:54:13.1718918 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\SafeBoot\Option   NAME NOT FOUND  Desired Access: Query Value, Set Value
    3:54:13.1719103 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Srp\GP\DLL    REPARSE Desired Access: Read
    3:54:13.1719234 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Srp\GP\DLL    NAME NOT FOUND  Desired Access: Read
    3:54:13.1719411 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers  SUCCESS Desired Access: Query Value
    3:54:13.1719575 PM  snapraid.exe    6336    RegQueryValue   HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled   NAME NOT FOUND  Length: 80
    3:54:13.1719716 PM  snapraid.exe    6336    RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers  SUCCESS 
    3:54:13.1719897 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers NAME NOT FOUND  Desired Access: Query Value
    3:54:13.1720189 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\FileSystem\   REPARSE Desired Access: Read
    3:54:13.1720310 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\FileSystem    SUCCESS Desired Access: Read
    3:54:13.1720448 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\FileSystem\LongPathsEnabled   SUCCESS Type: REG_DWORD, Length: 4, Data: 0
    3:54:13.1720595 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\FileSystem    SUCCESS 
    3:54:13.1721473 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\msvcrt.dll  SUCCESS 
    3:54:13.1722182 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\msvcrt.dll  SUCCESS Image Base: 0x7ffc81b10000, Image Size: 0x9e000
    3:54:13.1723274 PM  snapraid.exe    6336    Thread Create       SUCCESS Thread ID: 3584
    3:54:13.1723631 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\user32.dll  SUCCESS 
    3:54:13.1724250 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\user32.dll  SUCCESS Image Base: 0x7ffc82110000, Image Size: 0x197000
    3:54:13.1724995 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\win32u.dll  SUCCESS 
    3:54:13.1725685 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\win32u.dll  SUCCESS Image Base: 0x7ffc80e90000, Image Size: 0x20000
    3:54:13.1726431 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\gdi32.dll   SUCCESS 
    3:54:13.1727065 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\gdi32.dll   SUCCESS Image Base: 0x7ffc83d20000, Image Size: 0x29000
    3:54:13.1727804 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\gdi32full.dll   SUCCESS 
    3:54:13.1728415 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\gdi32full.dll   SUCCESS Image Base: 0x7ffc80f00000, Image Size: 0x19c000
    3:54:13.1729187 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\msvcp_win.dll   SUCCESS 
    3:54:13.1729821 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\msvcp_win.dll   SUCCESS Image Base: 0x7ffc81280000, Image Size: 0xa0000
    3:54:13.1730581 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\ucrtbase.dll    SUCCESS 
    3:54:13.1731182 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\ucrtbase.dll    SUCCESS Image Base: 0x7ffc81180000, Image Size: 0xfa000
    3:54:13.1732309 PM  snapraid.exe    6336    Thread Create       SUCCESS Thread ID: 7184
    3:54:13.1733455 PM  snapraid.exe    6336    Thread Create       SUCCESS Thread ID: 7060
    3:54:13.1735885 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions  REPARSE Desired Access: Read
    3:54:13.1736052 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions  SUCCESS Desired Access: Read
    3:54:13.1736260 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\(Default)    SUCCESS Type: REG_SZ, Length: 18, Data: 0006020F
    3:54:13.1736929 PM  snapraid.exe    6336    RegOpenKey  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager   REPARSE Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1737082 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Session Manager   SUCCESS Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1737256 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Session Manager\ResourcePolicies  NAME NOT FOUND  Length: 24
    3:54:13.1737429 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager   SUCCESS 
    3:54:13.1738684 PM  snapraid.exe    6336    RegOpenKey  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager   REPARSE Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1738835 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Session Manager   SUCCESS Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1738993 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Session Manager\ResourcePolicies  NAME NOT FOUND  Length: 24
    3:54:13.1739152 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager   SUCCESS 
    3:54:13.1741394 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Error Message Instrument\ REPARSE Desired Access: Read
    3:54:13.1741535 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Error Message Instrument  NAME NOT FOUND  Desired Access: Read
    3:54:13.1742072 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options  SUCCESS Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1742259 PM  snapraid.exe    6336    RegOpenKey  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapraid.exe NAME NOT FOUND  Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1742448 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Policies\Microsoft\Windows\Display    NAME NOT FOUND  Desired Access: Read
    3:54:13.1742695 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Policies\Microsoft\Windows\Display    NAME NOT FOUND  Desired Access: Read
    3:54:13.1742855 PM  snapraid.exe    6336    RegOpenKey  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapraid.exe NAME NOT FOUND  Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1743008 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Policies\Microsoft\Windows\Display    NAME NOT FOUND  Desired Access: Read
    3:54:13.1743165 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Policies\Microsoft\Windows\Display    NAME NOT FOUND  Desired Access: Read
    3:54:13.1743413 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize    SUCCESS Desired Access: Read
    3:54:13.1743591 PM  snapraid.exe    6336    RegQueryValue   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles   NAME NOT FOUND  Length: 20
    3:54:13.1743738 PM  snapraid.exe    6336    RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize    SUCCESS 
    3:54:13.1744048 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapraid.exe NAME NOT FOUND  Desired Access: Read
    3:54:13.1744314 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Policies\Microsoft\Windows\Control Panel\Desktop  NAME NOT FOUND  Desired Access: Read
    3:54:13.1744515 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Software\Policies\Microsoft\Windows\Control Panel\Desktop NAME NOT FOUND  Desired Access: Read
    3:54:13.1744713 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop SUCCESS Desired Access: Read
    3:54:13.1744889 PM  snapraid.exe    6336    RegQueryValue   HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop\EnablePerProcessSystemDPI   NAME NOT FOUND  Length: 20
    3:54:13.1745096 PM  snapraid.exe    6336    RegCloseKey HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop SUCCESS 
    3:54:13.1745696 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32   SUCCESS Desired Access: Read
    3:54:13.1745884 PM  snapraid.exe    6336    RegQueryValue   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32\snapraid  NAME NOT FOUND  Length: 172
    3:54:13.1746078 PM  snapraid.exe    6336    RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32   SUCCESS 
    3:54:13.1746230 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility NAME NOT FOUND  Desired Access: Read
    3:54:13.1748847 PM  snapraid.exe    6336    RegOpenKey  HKLM    SUCCESS Desired Access: Maximum Allowed, Granted Access: All Access
    3:54:13.1749048 PM  snapraid.exe    6336    RegQueryKey HKLM    SUCCESS Query: HandleTags, HandleTags: 0x0
    3:54:13.1749197 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows   SUCCESS Desired Access: Read
    3:54:13.1749390 PM  snapraid.exe    6336    RegQueryValue   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs  SUCCESS Type: REG_DWORD, Length: 4, Data: 0
    3:54:13.1749618 PM  snapraid.exe    6336    RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows   SUCCESS 
    3:54:13.1749787 PM  snapraid.exe    6336    RegOpenKey  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapraid.exe NAME NOT FOUND  Desired Access: Query Value, Enumerate Sub Keys
    3:54:13.1750614 PM  snapraid.exe    6336    QueryNameInformationFile    C:\Array\SnapRAID\snapraid.exe  SUCCESS Name: \Array\SnapRAID\snapraid.exe
    3:54:13.1751894 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\advapi32.dll    SUCCESS 
    3:54:13.1752596 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\advapi32.dll    SUCCESS Image Base: 0x7ffc82060000, Image Size: 0xa3000
    3:54:13.1753395 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\sechost.dll SUCCESS 
    3:54:13.1754058 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\sechost.dll SUCCESS Image Base: 0x7ffc81350000, Image Size: 0x9e000
    3:54:13.1754789 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\rpcrt4.dll  SUCCESS 
    3:54:13.1755408 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\rpcrt4.dll  SUCCESS Image Base: 0x7ffc83b90000, Image Size: 0x122000
    3:54:13.1758851 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Session Manager   REPARSE Desired Access: Query Value
    3:54:13.1759024 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Session Manager   SUCCESS Desired Access: Query Value
    3:54:13.1759187 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode NAME NOT FOUND  Length: 16
    3:54:13.1759980 PM  snapraid.exe    6336    QueryOpen   C:\Array\SnapRAID\CRYPTBASE.DLL NAME NOT FOUND  
    3:54:13.1760705 PM  snapraid.exe    6336    QueryOpen   C:\Windows\System32\cryptbase.dll   SUCCESS CreationTime: 9/14/2018 11:12:23 PM, LastAccessTime: 1/13/2019 9:17:59 AM, LastWriteTime: 9/14/2018 11:12:23 PM, ChangeTime: 1/13/2019 9:33:01 AM, AllocationSize: 36,864, EndOfFile: 33,832, FileAttributes: A
    3:54:13.1761383 PM  snapraid.exe    6336    CreateFile  C:\Windows\System32\cryptbase.dll   SUCCESS Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.1761777 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\cryptbase.dll   FILE LOCKED WITH ONLY READERS   SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE
    3:54:13.1762034 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    REPARSE Desired Access: Read
    3:54:13.1762210 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    SUCCESS Desired Access: Read
    3:54:13.1762370 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\CI\Disable26178932    NAME NOT FOUND  Length: 20
    3:54:13.1762556 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\CI    SUCCESS 
    3:54:13.1762707 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    REPARSE Desired Access: Query Value
    3:54:13.1762853 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    SUCCESS Desired Access: Query Value
    3:54:13.1763000 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\CI\Disable26178932    NAME NOT FOUND  Length: 80
    3:54:13.1763169 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\CI    SUCCESS 
    3:54:13.1763294 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\cryptbase.dll   SUCCESS SyncType: SyncTypeOther
    3:54:13.1763569 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\cryptbase.dll   SUCCESS 
    3:54:13.1764210 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\cryptbase.dll   SUCCESS Image Base: 0x7ffc7fab0000, Image Size: 0xc000
    3:54:13.1764946 PM  snapraid.exe    6336    QueryNormalizedNameInformationFile  C:\Windows\System32\bcryptprimitives.dll    SUCCESS 
    3:54:13.1765630 PM  snapraid.exe    6336    Load Image  C:\Windows\System32\bcryptprimitives.dll    SUCCESS Image Base: 0x7ffc810a0000, Image Size: 0x7e000
    3:54:13.1766218 PM  snapraid.exe    6336    CloseFile   C:\Windows\System32\cryptbase.dll   SUCCESS 
    3:54:13.1767179 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy   REPARSE Desired Access: Query Value
    3:54:13.1767334 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy   SUCCESS Desired Access: Query Value
    3:54:13.1767507 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\Enabled   SUCCESS Type: REG_DWORD, Length: 4, Data: 0
    3:54:13.1767682 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Lsa   REPARSE Desired Access: Query Value
    3:54:13.1767810 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\Lsa   SUCCESS Desired Access: Query Value
    3:54:13.1767953 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy   NAME NOT FOUND  Length: 20
    3:54:13.1768092 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled    NAME NOT FOUND  Length: 20
    3:54:13.1768237 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy   SUCCESS 
    3:54:13.1768357 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\Lsa   SUCCESS 
    3:54:13.1768483 PM  snapraid.exe    6336    RegOpenKey  HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration REPARSE Desired Access: Query Value
    3:54:13.1768614 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration NAME NOT FOUND  Desired Access: Query Value
    3:54:13.1769794 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101   SUCCESS Desired Access: Maximum Allowed, Granted Access: All Access
    3:54:13.1769983 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop\MuiCached\MachineLanguageConfiguration  NAME NOT FOUND  Desired Access: Read
    3:54:13.1770151 PM  snapraid.exe    6336    RegCloseKey HKU\S-1-5-21-2648661635-360164544-2101290831-2101   SUCCESS 
    3:54:13.1770282 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Policies\Microsoft\MUI\Settings   NAME NOT FOUND  Desired Access: Read
    3:54:13.1770495 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101   SUCCESS Desired Access: Maximum Allowed, Granted Access: All Access
    3:54:13.1770665 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND  Desired Access: Read
    3:54:13.1770839 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop\LanguageConfiguration   SUCCESS Desired Access: Read
    3:54:13.1771055 PM  snapraid.exe    6336    RegEnumValue    HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop\LanguageConfiguration   NO MORE ENTRIES Index: 0, Length: 512
    3:54:13.1771212 PM  snapraid.exe    6336    RegCloseKey HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop\LanguageConfiguration   SUCCESS 
    3:54:13.1771322 PM  snapraid.exe    6336    RegCloseKey HKU\S-1-5-21-2648661635-360164544-2101290831-2101   SUCCESS 
    3:54:13.1771464 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Policies\Microsoft\MUI\Settings   NAME NOT FOUND  Desired Access: Read
    3:54:13.1771657 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101   SUCCESS Desired Access: Maximum Allowed, Granted Access: All Access
    3:54:13.1771820 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND  Desired Access: Read
    3:54:13.1771976 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop SUCCESS Desired Access: Read
    3:54:13.1772120 PM  snapraid.exe    6336    RegQueryValue   HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop\PreferredUILanguages    NAME NOT FOUND  Length: 12
    3:54:13.1772282 PM  snapraid.exe    6336    RegCloseKey HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop SUCCESS 
    3:54:13.1772395 PM  snapraid.exe    6336    RegCloseKey HKU\S-1-5-21-2648661635-360164544-2101290831-2101   SUCCESS 
    3:54:13.1772557 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Policies\Microsoft\MUI\Settings   NAME NOT FOUND  Desired Access: Read
    3:54:13.1772743 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101   SUCCESS Desired Access: Maximum Allowed, Granted Access: All Access
    3:54:13.1772901 PM  snapraid.exe    6336    RegOpenKey  HKU\S-1-5-21-2648661635-360164544-2101290831-2101\Control Panel\Desktop\MuiCached   NAME NOT FOUND  Desired Access: Read
    3:54:13.1773059 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\MUI\Settings  REPARSE Desired Access: Read
    3:54:13.1773186 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\MUI\Settings  SUCCESS Desired Access: Read
    3:54:13.1773337 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\MUI\Settings\PreferredUILanguages NAME NOT FOUND  Length: 12
    3:54:13.1773479 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\MUI\Settings  SUCCESS 
    3:54:13.1773593 PM  snapraid.exe    6336    RegCloseKey HKU\S-1-5-21-2648661635-360164544-2101290831-2101   SUCCESS 
    3:54:13.1774375 PM  snapraid.exe    6336    QueryOpen   C:\Windows\System32\tzres.dll   SUCCESS CreationTime: 10/12/2020 4:08:53 PM, LastAccessTime: 10/12/2020 4:08:53 PM, LastWriteTime: 10/12/2020 4:08:53 PM, ChangeTime: 11/11/2020 6:10:23 PM, AllocationSize: 4,096, EndOfFile: 2,560, FileAttributes: A
    3:54:13.1775163 PM  snapraid.exe    6336    CreateFile  C:\Windows\System32\tzres.dll   SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.1775659 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\tzres.dll   FILE LOCKED WITH ONLY READERS   SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE
    3:54:13.1775898 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    REPARSE Desired Access: Read
    3:54:13.1776050 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    SUCCESS Desired Access: Read
    3:54:13.1776201 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\CI\Disable26178932    NAME NOT FOUND  Length: 20
    3:54:13.1776413 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\CI    SUCCESS 
    3:54:13.1776534 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\tzres.dll   SUCCESS SyncType: SyncTypeOther
    3:54:13.1776815 PM  snapraid.exe    6336    CloseFile   C:\Windows\System32\tzres.dll   SUCCESS 
    3:54:13.1777444 PM  snapraid.exe    6336    RegOpenKey  HKLM\SOFTWARE\Policies\Microsoft\WindowsStore   NAME NOT FOUND  Desired Access: Read
    3:54:13.1777635 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys   REPARSE Desired Access: Read
    3:54:13.1777770 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys   NAME NOT FOUND  Desired Access: Read
    3:54:13.1777972 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US   NAME NOT FOUND  Desired Access: Read
    3:54:13.1778700 PM  snapraid.exe    6336    CreateFile  C:\Windows\System32\en-US\tzres.dll.mui SUCCESS Desired Access: Generic Read, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.1779050 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\en-US\tzres.dll.mui FILE LOCKED WITH ONLY READERS   SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE
    3:54:13.1779176 PM  snapraid.exe    6336    QueryStandardInformationFile    C:\Windows\System32\en-US\tzres.dll.mui SUCCESS AllocationSize: 45,056, EndOfFile: 44,544, NumberOfLinks: 2, DeletePending: False, Directory: False
    3:54:13.1779355 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\en-US\tzres.dll.mui SUCCESS SyncType: SyncTypeOther
    3:54:13.1779850 PM  snapraid.exe    6336    CloseFile   C:\Windows\System32\en-US\tzres.dll.mui SUCCESS 
    3:54:13.1780858 PM  snapraid.exe    6336    QueryOpen   C:\Windows\System32\tzres.dll   SUCCESS CreationTime: 10/12/2020 4:08:53 PM, LastAccessTime: 10/12/2020 4:08:53 PM, LastWriteTime: 10/12/2020 4:08:53 PM, ChangeTime: 11/11/2020 6:10:23 PM, AllocationSize: 4,096, EndOfFile: 2,560, FileAttributes: A
    3:54:13.1781503 PM  snapraid.exe    6336    CreateFile  C:\Windows\System32\tzres.dll   SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.1781928 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\tzres.dll   FILE LOCKED WITH ONLY READERS   SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE
    3:54:13.1782156 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    REPARSE Desired Access: Read
    3:54:13.1782311 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\CI    SUCCESS Desired Access: Read
    3:54:13.1782472 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Control\CI\Disable26178932    NAME NOT FOUND  Length: 20
    3:54:13.1782645 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\CI    SUCCESS 
    3:54:13.1782755 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\tzres.dll   SUCCESS SyncType: SyncTypeOther
    3:54:13.1783023 PM  snapraid.exe    6336    CloseFile   C:\Windows\System32\tzres.dll   SUCCESS 
    3:54:13.1783445 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys   REPARSE Desired Access: Read
    3:54:13.1783587 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys   NAME NOT FOUND  Desired Access: Read
    3:54:13.1783762 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US   NAME NOT FOUND  Desired Access: Read
    3:54:13.1784443 PM  snapraid.exe    6336    CreateFile  C:\Windows\System32\en-US\tzres.dll.mui SUCCESS Desired Access: Generic Read, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.1784771 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\en-US\tzres.dll.mui FILE LOCKED WITH ONLY READERS   SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE
    3:54:13.1784873 PM  snapraid.exe    6336    QueryStandardInformationFile    C:\Windows\System32\en-US\tzres.dll.mui SUCCESS AllocationSize: 45,056, EndOfFile: 44,544, NumberOfLinks: 2, DeletePending: False, Directory: False
    3:54:13.1785037 PM  snapraid.exe    6336    CreateFileMapping   C:\Windows\System32\en-US\tzres.dll.mui SUCCESS SyncType: SyncTypeOther
    3:54:13.1785482 PM  snapraid.exe    6336    CloseFile   C:\Windows\System32\en-US\tzres.dll.mui SUCCESS 
    3:54:13.3263844 PM  snapraid.exe    6336    CreateFile  C:\Array\SnapRAID\snapraid.conf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3264821 PM  snapraid.exe    6336    ReadFile    C:\Array\SnapRAID\snapraid.conf SUCCESS Offset: 0, Length: 3,626, Priority: Normal
    3:54:13.3266020 PM  snapraid.exe    6336    CreateFile  C:\Array\P1 REPARSE Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    3:54:13.3266666 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume8\    SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3267062 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume8\    SUCCESS VolumeCreationTime: 11/2/2020 5:29:53 PM, VolumeSerialNumber: 48D5-7F00, SupportsObjects: True, VolumeLabel: P1
    3:54:13.3267177 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume8\    SUCCESS CreationTime: 11/2/2020 5:29:53 PM, LastAccessTime: 11/12/2020 12:39:02 AM, LastWriteTime: 11/12/2020 12:39:02 AM, ChangeTime: 11/12/2020 12:39:02 AM, FileAttributes: HSDNCI, AllocationSize: 16,384, EndOfFile: 4,096, NumberOfLinks: 1, DeletePending: False, Directory: True, IndexNumber: 0x5000000000005, EaSize: 0, Access: Read Attributes, Synchronize, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word
    3:54:13.3267330 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume8\    SUCCESS 
    3:54:13.3268204 PM  snapraid.exe    6336    CreateFile  C:\Array\D1 REPARSE Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    3:54:13.3268570 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume6\    SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3268848 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume6\    SUCCESS VolumeCreationTime: 10/30/2020 2:31:09 AM, VolumeSerialNumber: DAC9-E026, SupportsObjects: True, VolumeLabel: D1
    3:54:13.3268943 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume6\    SUCCESS CreationTime: 10/30/2020 2:31:09 AM, LastAccessTime: 11/12/2020 12:39:02 AM, LastWriteTime: 11/12/2020 12:39:02 AM, ChangeTime: 11/12/2020 12:39:02 AM, FileAttributes: HSDNCI, AllocationSize: 4,096, EndOfFile: 4,096, NumberOfLinks: 1, DeletePending: False, Directory: True, IndexNumber: 0x5000000000005, EaSize: 0, Access: Read Attributes, Synchronize, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word
    3:54:13.3269064 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume6\    SUCCESS 
    3:54:13.3269780 PM  snapraid.exe    6336    CreateFile  C:\Array\D2 REPARSE Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    3:54:13.3270172 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume13\   SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3270485 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume13\   SUCCESS VolumeCreationTime: 11/4/2020 6:56:18 PM, VolumeSerialNumber: 9E3D-C18E, SupportsObjects: True, VolumeLabel: D2
    3:54:13.3270600 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume13\   SUCCESS CreationTime: 11/4/2020 6:56:18 PM, LastAccessTime: 11/12/2020 10:36:01 AM, LastWriteTime: 11/12/2020 10:36:01 AM, ChangeTime: 11/12/2020 10:36:01 AM, FileAttributes: HSD, AllocationSize: 4,096, EndOfFile: 4,096, NumberOfLinks: 1, DeletePending: False, Directory: True, IndexNumber: 0x5000000000005, EaSize: 0, Access: Read Attributes, Synchronize, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word
    3:54:13.3270735 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume13\   SUCCESS 
    3:54:13.3271474 PM  snapraid.exe    6336    CreateFile  C:\Array\P1 REPARSE Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    3:54:13.3271768 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume8\    SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3272017 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume8\    SUCCESS VolumeCreationTime: 11/2/2020 5:29:53 PM, VolumeSerialNumber: 48D5-7F00, SupportsObjects: True, VolumeLabel: P1
    3:54:13.3272104 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume8\    SUCCESS CreationTime: 11/2/2020 5:29:53 PM, LastAccessTime: 11/12/2020 12:39:02 AM, LastWriteTime: 11/12/2020 12:39:02 AM, ChangeTime: 11/12/2020 12:39:02 AM, FileAttributes: HSDNCI, AllocationSize: 16,384, EndOfFile: 4,096, NumberOfLinks: 1, DeletePending: False, Directory: True, IndexNumber: 0x5000000000005, EaSize: 0, Access: Read Attributes, Synchronize, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word
    3:54:13.3272221 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume8\    SUCCESS 
    3:54:13.3273092 PM  snapraid.exe    6336    CreateFile  C:\Array\D1\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\ REPARSE Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    3:54:13.3273853 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}  SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3274153 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}  SUCCESS VolumeCreationTime: 10/30/2020 2:31:09 AM, VolumeSerialNumber: DAC9-E026, SupportsObjects: True, VolumeLabel: D1
    3:54:13.3274246 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}  BUFFER OVERFLOW CreationTime: 11/4/2020 7:01:17 PM, LastAccessTime: 11/11/2020 3:51:14 AM, LastWriteTime: 11/11/2020 3:51:14 AM, ChangeTime: 11/11/2020 3:51:14 AM, FileAttributes: DNCI, AllocationSize: 4,096, EndOfFile: 4,096, NumberOfLinks: 1, DeletePending: False, Directory: True, IndexNumber: 0x1000000000026, EaSize: 0, Access: Read Attributes, Synchronize, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word
    3:54:13.3274363 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}  SUCCESS 
    3:54:13.3275639 PM  snapraid.exe    6336    CreateFile  C:\Array\D2\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\ REPARSE Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    3:54:13.3276484 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume13\{B3E80E18-72D9-47EC-A971-9F836BC2B64A} SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3276808 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume13\{B3E80E18-72D9-47EC-A971-9F836BC2B64A} SUCCESS VolumeCreationTime: 11/4/2020 6:56:18 PM, VolumeSerialNumber: 9E3D-C18E, SupportsObjects: True, VolumeLabel: D2
    3:54:13.3276919 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume13\{B3E80E18-72D9-47EC-A971-9F836BC2B64A} BUFFER OVERFLOW CreationTime: 11/4/2020 7:01:17 PM, LastAccessTime: 11/11/2020 3:51:14 AM, LastWriteTime: 11/11/2020 3:51:14 AM, ChangeTime: 11/11/2020 3:51:14 AM, FileAttributes: D, AllocationSize: 0, EndOfFile: 0, NumberOfLinks: 1, DeletePending: False, Directory: True, IndexNumber: 0x1000000000026, EaSize: 0, Access: Read Attributes, Synchronize, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word
    3:54:13.3277085 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume13\{B3E80E18-72D9-47EC-A971-9F836BC2B64A} SUCCESS 
    3:54:13.3277793 PM  snapraid.exe    6336    ReadFile    C:\Array\SnapRAID\snapraid.conf END OF FILE Offset: 3,626, Length: 65,536
    3:54:13.3277934 PM  snapraid.exe    6336    CloseFile   C:\Array\SnapRAID\snapraid.conf SUCCESS 
    3:54:13.3279320 PM  snapraid.exe    6336    CreateFile  C:\Array\D1\D1.content  REPARSE Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    3:54:13.3279990 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume6\D1.content  SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3280777 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume6\D1.content  SUCCESS VolumeCreationTime: 10/30/2020 2:31:09 AM, VolumeSerialNumber: DAC9-E026, SupportsObjects: True, VolumeLabel: D1
    3:54:13.3280875 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume6\D1.content  BUFFER OVERFLOW CreationTime: 11/12/2020 12:37:15 AM, LastAccessTime: 11/12/2020 12:38:49 AM, LastWriteTime: 11/12/2020 12:38:49 AM, ChangeTime: 11/12/2020 12:39:02 AM, FileAttributes: ANCI, AllocationSize: 2,200,801,280, EndOfFile: 2,200,799,098, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x26000000005808, EaSize: 0, Access: Generic Read, Position: 0, Mode: Sequential Access, Synchronous IO Non-Alert, AlignmentRequirement: Word
    3:54:13.3281540 PM  snapraid.exe    6336    CreateFile  C:\Array\D1\D1.content  REPARSE Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    3:54:13.3282152 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume6\D1.content  SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3282470 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume6\D1.content  SUCCESS VolumeCreationTime: 10/30/2020 2:31:09 AM, VolumeSerialNumber: DAC9-E026, SupportsObjects: True, VolumeLabel: D1
    3:54:13.3282562 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume6\D1.content  BUFFER OVERFLOW CreationTime: 11/12/2020 12:37:15 AM, LastAccessTime: 11/12/2020 12:38:49 AM, LastWriteTime: 11/12/2020 12:38:49 AM, ChangeTime: 11/12/2020 12:39:02 AM, FileAttributes: ANCI, AllocationSize: 2,200,801,280, EndOfFile: 2,200,799,098, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x26000000005808, EaSize: 0, Access: Read Attributes, Synchronize, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word
    3:54:13.3282691 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume6\D1.content  SUCCESS 
    3:54:13.3283543 PM  snapraid.exe    6336    CreateFile  C:\Array\D2\D2.content  REPARSE Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    3:54:13.3284236 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume13\D2.content SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3284587 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume13\D2.content SUCCESS VolumeCreationTime: 11/4/2020 6:56:18 PM, VolumeSerialNumber: 9E3D-C18E, SupportsObjects: True, VolumeLabel: D2
    3:54:13.3284693 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume13\D2.content BUFFER OVERFLOW CreationTime: 11/12/2020 12:37:15 AM, LastAccessTime: 11/12/2020 12:38:49 AM, LastWriteTime: 11/12/2020 12:38:49 AM, ChangeTime: 11/12/2020 12:39:02 AM, FileAttributes: A, AllocationSize: 2,200,801,280, EndOfFile: 2,200,799,098, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x10000000002940, EaSize: 0, Access: Read Attributes, Synchronize, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word
    3:54:13.3284835 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume13\D2.content SUCCESS 
    3:54:13.3285688 PM  snapraid.exe    6336    CreateFile  C:\Array\P1\P1.content  REPARSE Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    3:54:13.3286426 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume8\P1.content  SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    3:54:13.3286749 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume8\P1.content  SUCCESS VolumeCreationTime: 11/2/2020 5:29:53 PM, VolumeSerialNumber: 48D5-7F00, SupportsObjects: True, VolumeLabel: P1
    3:54:13.3286841 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume8\P1.content  BUFFER OVERFLOW CreationTime: 11/12/2020 12:37:15 AM, LastAccessTime: 11/12/2020 12:38:49 AM, LastWriteTime: 11/12/2020 12:38:49 AM, ChangeTime: 11/12/2020 12:39:02 AM, FileAttributes: ANCI, AllocationSize: 2,200,813,568, EndOfFile: 2,200,799,098, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x1f00000000002b, EaSize: 0, Access: Read Attributes, Synchronize, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word
    3:54:13.3286966 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume8\P1.content  SUCCESS 
    3:54:13.3287245 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 0, Length: 65,536, Priority: Normal
    3:54:13.3294198 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 65,536, Length: 65,536
    3:54:13.3300596 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 131,072, Length: 65,536
    3:54:13.3305976 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 196,608, Length: 65,536
    3:54:13.3311330 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 262,144, Length: 65,536
    3:54:13.3317462 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 327,680, Length: 65,536
    3:54:13.3322603 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 393,216, Length: 65,536
    3:54:13.3327822 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 458,752, Length: 65,536
    3:54:13.3333097 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 524,288, Length: 65,536
    3:54:13.3340980 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 589,824, Length: 65,536
    3:54:13.3346213 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 655,360, Length: 65,536
    3:54:13.3352089 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 720,896, Length: 65,536
    3:54:13.3357239 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 786,432, Length: 65,536
    3:54:13.3362676 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 851,968, Length: 65,536
    3:54:13.3368355 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 917,504, Length: 65,536
    3:54:13.3373072 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 983,040, Length: 65,536
    [TRUNCATED]
    3:54:56.0488594 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,043,520, Length: 65,536
    3:54:56.0490572 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,109,056, Length: 65,536
    3:54:56.0492960 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,174,592, Length: 65,536
    3:54:56.0495311 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,240,128, Length: 65,536
    3:54:56.0497629 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,305,664, Length: 65,536
    3:54:56.0501089 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,371,200, Length: 65,536
    3:54:56.0504331 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,436,736, Length: 65,536
    3:54:56.0508018 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,502,272, Length: 65,536
    3:54:56.0510572 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,567,808, Length: 65,536
    3:54:56.0513602 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,633,344, Length: 65,536
    3:54:56.0516848 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,698,880, Length: 65,536
    3:54:56.0519765 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  SUCCESS Offset: 2,200,764,416, Length: 34,682
    3:55:20.1795443 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\D1.content  END OF FILE Offset: 2,200,799,098, Length: 65,536
    3:55:20.2265008 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume6\D1.content  SUCCESS 
    4:25:13.7045461 PM  snapraid.exe    6336    RegOpenKey  HKLM\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize    SUCCESS Desired Access: Read
    4:25:13.7045754 PM  snapraid.exe    6336    RegQueryValue   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles   NAME NOT FOUND  Length: 20
    4:25:13.7045937 PM  snapraid.exe    6336    RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize    SUCCESS 
    4:25:13.7047053 PM  snapraid.exe    6336    Thread Exit     SUCCESS Thread ID: 256, User Time: 1854.6875000, Kernel Time: 2.9687500
    4:25:13.7050363 PM  snapraid.exe    6336    Process Exit        SUCCESS Exit Status: 0, User Time: 1854.6875000 seconds, Kernel Time: 2.9687500 seconds, Private Bytes: 27,119,616, Peak Private Bytes: 6,619,254,784, Working Set: 17,285,120, Peak Working Set: 6,509,309,952
    4:25:13.7050561 PM  snapraid.exe    6336    RegOpenKey  HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2648661635-360164544-2101290831-2101 SUCCESS Desired Access: All Access
    4:25:13.7050832 PM  snapraid.exe    6336    RegQueryValue   HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2648661635-360164544-2101290831-2101\\Device\HarddiskVolume17\Array\SnapRAID\snapraid.exe    NAME NOT FOUND  Length: 40
    4:25:13.7051002 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2648661635-360164544-2101290831-2101 SUCCESS 
    4:25:13.7051406 PM  snapraid.exe    6336    CloseFile   C:\Array\SnapRAID   SUCCESS 
    4:25:13.7052111 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions  SUCCESS 
    4:25:13.7052207 PM  snapraid.exe    6336    RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options  SUCCESS 
    4:25:13.7052311 PM  snapraid.exe    6336    RegCloseKey HKLM    SUCCESS 
    4:25:13.7052402 PM  snapraid.exe    6336    RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager   SUCCESS 
    4:20:04.0263850 PM  snapraid.exe    6336    CreateFile  C:\Array\D1\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt REPARSE Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>
    4:20:04.0264716 PM  snapraid.exe    6336    CreateFile  \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
    4:20:04.0265792 PM  snapraid.exe    6336    QueryInformationVolume  \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS VolumeCreationTime: 10/30/2020 2:31:09 AM, VolumeSerialNumber: DAC9-E026, SupportsObjects: True, VolumeLabel: D1
    4:20:04.0265921 PM  snapraid.exe    6336    QueryAllInformationFile \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt BUFFER OVERFLOW CreationTime: 12/11/2019 2:29:53 PM, LastAccessTime: 3/4/2020 10:40:14 AM, LastWriteTime: 12/11/2019 2:29:53 PM, ChangeTime: 11/2/2020 2:43:01 AM, FileAttributes: NCI, AllocationSize: 12,685,312, EndOfFile: 12,682,426, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x10000000b0df6, EaSize: 0, Access: Generic Read, Position: 0, Mode: Sequential Access, Synchronous IO Non-Alert, AlignmentRequirement: Word
    4:20:04.0266118 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 0, Length: 16,384, Priority: Normal
    4:20:04.0266709 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 0, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Priority: Normal
    4:20:04.2580724 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 16,384, Length: 16,384
    4:20:04.2674509 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 32,768, Length: 16,384
    4:20:04.2674847 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 49,152, Length: 16,384
    4:20:04.2675040 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 65,536, Length: 16,384
    4:20:04.2675214 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 81,920, Length: 16,384
    4:20:04.2675425 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 98,304, Length: 16,384
    [TRUNCATED]
    4:20:04.3407149 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 12,632,064, Length: 16,384
    4:20:04.3407310 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 12,648,448, Length: 16,384
    4:20:04.3408699 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 12,664,832, Length: 16,384
    4:20:04.3408962 PM  snapraid.exe    6336    ReadFile    \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS Offset: 12,681,216, Length: 1,210
    4:20:04.3409218 PM  snapraid.exe    6336    CloseFile   \Device\HarddiskVolume6\{B3E80E18-72D9-47EC-A971-9F836BC2B64A}\{B529D1FE-2533-408B-AF3A-3CC9AE8A2975}\duplicate.txt SUCCESS 
    
     
  • Night Rider

    Night Rider - 2020-11-14

    I'm willing to entertain the fact that somehow it's my Windows installation that is the problem.
    I will be booting this machine from a vanilla Windows 20H2 image and will retest.

     
    • Leifi Plomeros

      Leifi Plomeros - 2020-11-14

      I wouldn't see the same problem if it was limited to your installation.

      I also just noticed this detail in your first post:
      "Using 6160 MiB of memory for the file-system."
      And it gives you 25 minutes where "nothing" happens.

      For me that number is 1981 MiB and gives me 8 minutes where "nothing" happens.

      The time frozen is perfectly correlated to the size of the file system, even between our most likely very different setups.

       
  • UhClem

    UhClem - 2020-11-15

    Here's the deal ...

    For fix & check, there is a very small amount of "housekeeping" overhead for each/every data block (only excluding those blocks outside of any -S/-B range). With "real" activity (massively) reduced by filtering, that (cumulative) overhead becomes very "visible".

    [Note that during those "frozen" periods, SnapRAID is solidly CPU-bound. Your, e.g., 15% suggests you have a 6- or 8-core processor.]

    If Andrea is interested, a slight re-arrangement of code reduces this overhead by 25-30%.


    "A penny here, and a penny there ... pretty soon you're talking about real money."

     

    Last edit: UhClem 2020-11-15
    • Leifi Plomeros

      Leifi Plomeros - 2020-11-15

      Nice.

      Any theory regarding 4 minutes in Linux vs 29 minutes in Windows?
      The only thing I could think of would be much larger block size in the Linux array.

      Wouldn't it be possible to get rid of the overhead by "pre-filtering" in order to determine a relevant -S/-B range? Or is the overhead basically an unavoidable part of the filter process?

       
      • Night Rider

        Night Rider - 2020-11-15

        Exact same array, same settings, setting cannot be changed on an existing array.
        Nobody has been able to explain why windows takes 8 times longer to do anything.

         
    • Night Rider

      Night Rider - 2020-11-15

      Then explain why this "overhead" takes 8 times longer on windows please, exact same array.

       
  • UhClem

    UhClem - 2020-11-15

    Wouldn't it be possible to get rid of the overhead by "pre-filtering" in order to determine a relevant -S/-B range?

    YES! and it's easy , efficient, and effective! ((1) Cheap, (2) Fast, (3) Good... Get all 3!

    I hope Andrea agrees. (It's obvious what to do & where.)

    Re: 4min vs 29 min ... ??? the "frozen" time thing is OS-agnostic.

     

    Last edit: UhClem 2020-11-15
  • Night Rider

    Night Rider - 2020-11-15

    So after extensive testing in a controlled environment with the least amount of variables:
    Windows 8
    Windows 8.1
    Windows 10 (1809)
    Windows 10 (20H2)
    Windows Server 2019
    Snapraid versions 11.2 - 11.5 on each.
    ~20 individual tests.

    I've concluded this software is useless in Windows. It takes 8 times longer to do anything in windows than it does in Linux.

    Thank you all for your replies but nobody has been able to explain why this discrepancy exists.
    I'm not interested in peoples "opinions", I'm more interested in factual proof backed up by actual tests and log data.

    Maybe @amadvance (Andrea) can explain it. I will await his reply when he has time.

    As for now, I will be transferring the array back to a Linux server. It makes absolutely no sense using Windows with this software, unless you get paid by the hour.

     
    • Leifi Plomeros

      Leifi Plomeros - 2020-11-15

      I've concluded this software is useless in Windows. It takes 8 times longer to do anything in windows than it does in Linux.

      Did you really test anything other than checking a specific file?

      If you have the same problem with sync, scrub, unfiltered check/fix, then there is obviously a local problem, most likely not limited to snapraid.

      As for now, I will be transferring the array back to a Linux server. It makes absolutely no sense using Windows with this software, unless you get paid by the hour.

      I would absolutely agree if it was true. However I find the performance in Windows to be very good. Please review:

      C:\Snapraid>snapraid sync
      Self test...
      Loading state from E:/snapraid.content...
      WARNING! Content file 'E:/snapraid.content' not found, trying with another copy...
      Loading state from F:/snapraid.content...
      WARNING! Content file 'F:/snapraid.content' not found, trying with another copy...
      Loading state from C:/Snapraid/snapraid.content...
      No content file found. Assuming empty.
      Scanning disk d1...
      Scanning disk d2...
      Using 0 MiB of memory for the file-system.
      Initializing...
      Resizing...
      Saving state to E:/snapraid.content...
      Saving state to F:/snapraid.content...
      Saving state to C:/Snapraid/snapraid.content...
      Verifying E:/snapraid.content...
      Verifying F:/snapraid.content...
      Verified E:/snapraid.content in 0 seconds
      Verifying C:/Snapraid/snapraid.content...
      Verified F:/snapraid.content in 0 seconds
      Verified C:/Snapraid/snapraid.content in 0 seconds
      Syncing...
      Using 32 MiB of memory for 32 cached blocks.
      100% completed, 4192 MB accessed in 0:00     0:00 ETA
      
             d1 12% | *******
             d2 81% | ************************************************
         parity  0% |
       2-parity  0% |
           raid  1% | *
           hash  3% | **
          sched  0% |
           misc  0% |
                    |____________________________________________________________
                                  wait time (total, less is better)
      
      Everything OK
      Saving state to E:/snapraid.content...
      Saving state to F:/snapraid.content...
      Saving state to C:/Snapraid/snapraid.content...
      Verifying E:/snapraid.content...
      Verifying F:/snapraid.content...
      Verified E:/snapraid.content in 0 seconds
      Verifying C:/Snapraid/snapraid.content...
      Verified F:/snapraid.content in 0 seconds
      Verified C:/Snapraid/snapraid.content in 0 seconds
      
      C:\Snapraid>snapraid check -a -f TestFile.mkv
      Self test...
      Loading state from E:/snapraid.content...
      Filtering...
      Using 0 MiB of memory for the file-system.
      Initializing...
      Hashing...
      100% completed, 517 MB accessed in 0:00
      Everything OK
      
      C:\Snapraid>snapraid check
      Self test...
      Loading state from E:/snapraid.content...
      Searching disk d1...
      Searching disk d2...
      Using 0 MiB of memory for the file-system.
      Initializing...
      Checking...
      100% completed, 4192 MB accessed in 0:00     0:00 ETA
      Everything OK
      

      Checking a single file took ~2 seconds.
      Checking the entire array took 23 seconds.

      I doubt it would be much faster in Linux.

       
      • Night Rider

        Night Rider - 2020-11-17

        You can believe what you want to believe. I trust nobody, and much rather do my own testing and bench-marking. And have clearly come to the conclusion SnapRAID on windows is useless compared to Linux, for me. Believe me or not. If you are happy and can live with the degraded performance then koodos to you, I on the other hand cannot. As far as I'm concerned this mystery has been solved, and I am quite happy and capable of moving back to Linux.

         
  • Night Rider

    Night Rider - 2020-11-17

    I've found my answer. It's most likely how SnapRAID was compiled.

    https://www.youtube.com/watch?v=8e7IdHG5fhQ

     
  • kamikazeepl

    kamikazeepl - 2022-03-09

    Maybe Windows Defender (MS antivirus software) is checking snapraid

     
    • Night Rider

      Night Rider - 2022-03-10

      Thanks but it was being run on server 2019 without defender.

       

Log in to post a comment.