Can anyone please comment on this? I've had a process logging driver running
OK on a number of machines but am still concerned I may be bit by being
re-entered when this gets rolled out to a larger audience.

Also for performance reasons, rather than open/write/close the file each
process callback, I'm considering opening the file handle in DriverEntry
which I'm guessing is the system process and then writing to the file from
PsSetCreateProcessNotifyRoutine callbacks which I'm guessing runs on the
respective process thread. Is that OK to do? Do I need to lock writing to
the file to prevent reentrancy issues or will the Zw routines handle this OK
for me if I even am re-entered?

Thanks,
Dave

"Dave" <DaveAtHomeREMOVETHIS@nc.rr.com> wrote in message
news:OQ5DJyfODHA.2316@TK2MSFTNGP12.phx.gbl...

The best practice is to assume any kernel-mode callback can be
re-entered, and code accordingly. You'll have to open the file with
OBJ_KERNEL_HANDLE to allow you to use the handle in the context of any
process. The OS and the filesystem can handle re-entrancy into file I/O
routines, but you have to make sure you take the necessary locks or
whatever so that your own modifications to the file are consistent.

Dave Kolb wrote:

Understood in general but one more question - if the callback writes a text
line to the file and whilst doing so is reentered and will call the file
system to write another text line to the file, will the file system handle
writing both lines? IOW, will the filesystem serialize the writes OK or do I
need to serialize that I/O myself? So far the I/O works fine and I have not
had any problems but have not pushed real hard on multiple processors yet.

Thanks,
Dave

"Nick Ryan" <nryan@nryan.com> wrote in message
news:CqeRa.79802$H17.22686@sccrnsc02...