Troubleshooting

​

Debug logging

​

Enable full debug logging

memefs -d -1 -D memefs.log -i -F NTFS -m R:

• -d -1: Enable all debug logs (0xFFFFFFFF)
• -D memefs.log: Write logs to memefs.log file
• -D -: Write logs to stderr (console)

​

Debug flag values

memefs -d 0x01 -D memefs.log -m R:  # Minimal logging
memefs -d 0xFF -D memefs.log -m R:  # Detailed logging  
memefs -d -1 -D memefs.log -m R:    # All logging

• 0x01: Errors only
• 0x03: Errors and warnings
• 0x0F: Basic operation logging
• 0xFF: Detailed operation logging
• -1: Everything (0xFFFFFFFF)

​

Reading debug logs

[timestamp] Create: FileName="\test.txt" CreateOptions=0x00000040
[timestamp] Write: Offset=0 Length=1024 BytesTransferred=1024
[timestamp] Cleanup: FileName="\test.txt" Flags=0x0001
[timestamp] Close: FileName="\test.txt"

• Timestamp: When the operation occurred
• Operation: Which file system operation (Create, Read, Write, etc.)
• Parameters: Operation-specific details
• Results: Return codes and transferred bytes

​

Log file location

memefs -d -1 -D C:\Temp\memefs.log -m R:

​

Common issues

​

Issue: “Cannot create MEMFS”

1. WinFsp not installed: memefs requires WinFsp to be installed
2. Insufficient permissions: Must run as Administrator
3. Invalid parameters: Check CLI arguments
4. Another instance running: Only one memefs instance allowed

# Check if WinFsp is installed
sc query WinFsp.Launcher

# Run as Administrator
runas /user:Administrator "memefs -i -F NTFS -m R:"

# Stop any existing instance
net stop memefs

​

Issue: “Cannot mount MEMFS”

1. Drive letter in use: R: already assigned
2. Invalid mount point: Path doesn’t exist or is invalid
3. Insufficient permissions: Can’t create mount point

# Try a different drive letter
memefs -i -F NTFS -m S:

# Use wildcard to auto-select  
memefs -i -F NTFS -m *

# Check existing drive letters
wmic logicaldisk get caption

​

Issue: “Cannot start MEMFS”

1. WinFsp driver not running: Driver stopped or disabled
2. System resources exhausted: Out of memory or handles
3. Antivirus interference: Security software blocking operations

# Check WinFsp driver status
sc query WinFsp

# Start WinFsp driver
sc start WinFsp

# Check system resources
taskmgr

# Temporarily disable antivirus

​

Issue: Out of memory / STATUS_DISK_FULL

1. Memory limit reached: Hit the -s limit
2. Actual RAM exhausted: System out of physical memory
3. Address space exhausted: 32-bit process limit (rare on 64-bit)

# Increase memory limit
memefs -i -F NTFS -m R: -s 17179869184  # 16GB

# Check current usage
dir R:\ /s

# Free up space
del R:\large-file.dat

# PowerShell: Check free space
Get-PSDrive R | Select-Object Used,Free

​

Issue: Slow performance

1. Memory pressure: System swapping to disk
2. Debug logging enabled: -d -1 slows operations significantly
3. Antivirus scanning: Real-time scanning of RAM disk
4. Too many small files: Map lookups for large directories

# Disable debug logging
memefs -i -F NTFS -m R:  # No -d flag

# Exclude from antivirus
# Add R:\ to exclusion list in antivirus settings

# Check system memory
taskmgr  # Look at memory usage and paging

# Organize files into subdirectories

​

Issue: File/directory access denied

1. Security descriptor issues: Incorrect ACLs
2. File in use: Another process has the file open
3. Root SDDL too restrictive: -S parameter too strict

# Use permissive root SDDL
memefs -i -F NTFS -m R: -S "O:BAG:BAD:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;WD)"

# Grant full access to Everyone (WD)
# SY = SYSTEM, BA = Administrators, WD = Everyone

# Check file security
icacls R:\file.txt

# Close all handles to a file
handle.exe R:\file.txt /accepteula

​

Issue: UNC path not accessible

1. Incorrect UNC prefix: Must use single backslash in -u parameter
2. Network discovery disabled: Windows firewall blocking
3. Authentication issues: Credentials required

# Correct UNC syntax
memefs -i -F NTFS -u "\Server\Share" -m *

# Check network discovery
Get-NetFirewallRule -DisplayGroup "Network Discovery" | Enable-NetFirewallRule

# Access the share
net use * \\Server\Share

​

Issue: Volume label won’t change

1. Label too long: Maximum 32 characters
2. Invalid characters: Some characters not allowed
3. Cache issues: Explorer caching old label

# Use shorter label
memefs -i -F NTFS -m R: -l "RAMDISK"

# Refresh Explorer
# Press F5 in Windows Explorer

# Check label
vol R:

​

Error codes

​

STATUS_SUCCESS (0x00000000)

​

STATUS_UNSUCCESSFUL (0xC0000001)

​

STATUS_NOT_IMPLEMENTED (0xC0000002)

​

STATUS_INVALID_PARAMETER (0xC000000D)

​

STATUS_NO_SUCH_FILE (0xC000000F)

​

STATUS_END_OF_FILE (0xC0000011)

​

STATUS_DISK_FULL (0xC000007F)

​

STATUS_OBJECT_NAME_COLLISION (0xC0000035)

​

STATUS_ACCESS_DENIED (0xC0000022)

​

STATUS_DIRECTORY_NOT_EMPTY (0xC0000101)

​

Event log

​

Viewing event log

# PowerShell: View memefs events
Get-EventLog -LogName Application -Source memefs -Newest 20

• Information: Normal startup/shutdown messages (main.cpp:171-178)
• Warning: Non-critical issues (main.cpp:27)
• Error: Failures like “cannot create MEMFS” (main.cpp:28)

​

Common event log messages

memefs -s 8589934592 -u \Server\Share -m R: -l RAMDISK

cannot create MEMFS
cannot mount MEMFS  
cannot start MEMFS

​

Diagnostic checklist

1. WinFsp installed: sc query WinFsp
2. Running as Administrator: Required for service operations
3. Drive letter available: Not already in use
4. Sufficient RAM: Check Task Manager
5. No other instance: Only one memefs allowed
6. Valid parameters: Check CLI syntax
7. Event log: Look for error messages
8. Debug log: Enable with -d -1 -D memefs.log
9. Antivirus: May interfere with operations
10. Windows version: Ensure compatibility

​

Advanced debugging

​

Using Process Monitor

1. Download and run procmon.exe
2. Filter for “Path begins with R:”
3. Perform the failing operation
4. Review the operation sequence

• ACCESS_DENIED: Permission issues
• NAME_NOT_FOUND: File not found
• END_OF_FILE: Read past EOF
• BUFFER_OVERFLOW: Buffer too small

​

Using WinDbg

# Find memefs process ID
tasklist | findstr memefs

# Attach debugger
windbg -p <PID>

• k: Stack trace
• !analyze -v: Analyze crash
• lm: List modules
• ~*k: All thread stacks

​

Memory leak detection

# Enable debug logging  
memefs -d -1 -D memefs.log -m R:

# Perform operations
# ...

# Check allocated sectors
# Look at process memory in Task Manager

​

Getting help

1. Check GitHub issues: WinFsp-MemFs-Extended issues
2. Review WinFsp docs: winfsp.dev
3. Collect debug logs: Use -d -1 -D memefs.log
4. Note system info: Windows version, RAM, memefs version
5. Create minimal reproduction: Simplest command that fails

• Exact command line used
• Error messages from event log
• Debug log excerpt (if relevant)
• System specifications
• Steps to reproduce