Jaa


Using MSMQ with Enhanced Write Filters from Windows XP Embedded

Probably a niche implementation but if it helps someone then it has been worthwhile.

Windows XPe (XP Embedded) comes with an option called an Enhanced Write Filter that prevents the disk devices from being updated.

Any updates are instead made to an Overlay that exists in RAM (volatile) or on another disk device (persistent).

These are touched on in this KB article:

328620 Issues with RAM-based Enhanced Write Filter (EWF) overlays

https://support.microsoft.com/default.aspx?scid=kb;EN-US;328620

"The Enhanced Write Filter (EWF) is a component in Windows XP Embedded that protects the contents of a volume on the destination media by redirecting all writes to another storage location, which is known as an overlay.”

To use MSMQ in this situation you need to be concerned with two locations:

  1. The Storage directory (which contains all the messages, queue configurations and transactional logs)

  2. The registry (which contains such dynamic values as the continually incremented MessageID)

Item #1 should be on a persistent device to avoid message loss so either use a disk-based EWF or an unfiltered disk.

Item #2 ideally should be persistent too because MSMQ checks the MessageID to ensure duplicate messages are discarded.

255546 Microsoft Message Queuing duplicate message removal mechanism

https://support.microsoft.com/default.aspx?scid=kb;EN-US;255546

So if you implement a RAM-based EWF and the embedded system is restarted, the MessageId in the overlay is lost and MSMQ starts up with the old value in the real registry. The destination machine may then decide that any new messages sent after the reboot are the same as old ones and so throw them away. Visually all that happens is messages being sent but not delivered (although incoming messages are fine). A

n option would be to disable the duplicate message removal mechanism (by setting the RemoveDuplicateSize registry value to 0) so that the destination machine doesn't care about the MessageIDs being reused.