Description of Ghost Diagnostic Error File

Article:TECH106777  |  Created: 1999-01-19  |  Updated: 2007-01-14  |  Article URL http://www.symantec.com/docs/TECH106777
Article Type
Technical Solution

Product(s)

Environment

Issue



This document describes the usage and contents of the Ghost Diagnostic Error File.


Solution



The Ghost Diagnostic Error File (Ghosterr.txt) is created automatically when Ghost encounters a problem that causes it to exit to DOS or to stop responding.

The Ghosterr.txt file can be found in one of these locations:
  • For Symantec Ghost, the file can be found in the folder in which Ghost is installed.
  • For Norton Ghost 2003 installed on Windows 2000/XP, the file can be found in the \Documents and Settings\All Users\Application Data\Symantec\Ghost\GhostStartLogs folder.
    The file name appears as the date and time, for example, 2004-12-01-14-14-40.log, of the Ghost operation. The file can also be viewed through the Norton Ghost 2003 View Log window. To view the log open Norton Ghost 2003, select Ghost Basic, View log, select the Task, and then click View Log. If Norton Ghost 2003 is installed on Windows 98/Me/NT, view the file through the Norton Ghost 2003 View Log window.

The Ghost Diagnostic Error File is very similar to the Ghost Diagnostic File, GhstStat.txt. If Symantec Technical Support requests that you send them a log file, send the Ghost Diagnostic Error File rather than the Ghost Diagnostic File unless you are specifically requested to use the -DD switch or another switch to create the log file. For information on the differences between the Ghost Diagnostic Error File and the Ghost Diagnostic File, see the document Description of the GhstStat.txt diagnostic file.

To create the Ghosterr.txt file
You have two ways to force Ghost to create this file:
  • Launch Ghost with a command-line with switches. Once Ghost has loaded, type CTRL+C.
  • Launch Ghost without command-line switches. Answer the Ghost prompts until you reach the question "Proceed with... Yes/No," just before Ghost begins to transfer the data. At that question, type CTRL+C.

By default, Ghost saves this file in the directory that the Ghost executable file is in. If that directory is read-only, use the -AFILE switch to change the location that Ghost saves the error file to. To save this file under a different name and location than the default, use the -AFILE=drive:\path\file name switch on the Ghost command-line, such as:

ghost.exe -afile=a:\errdata\currerr.txt

Description of the Ghosterr.txt file
The following table describes the information that is in the Diagnostic Error File.

Field Type
Content (Sample)
(Italics and bolding have been added for clarity)
Explanation
GeneralDate: Wed May 30 13:19:36 2003This is the date and time that the error log was created.
Error NumberError Number: (10170)This identifies the error.
Error MessageMessage: Operation aborted at user requestThis is the text that accompanies the error number. The text indicates what happened, but is not always a description of the problem that caused Ghost to fail. Sometimes the message contains numbers which can assist in diagnosing the cause of the problem, such as a return value, sector numbers, and so on.
VersionVersion: 2003.789 (May 28 2003, Build=789)
License: GM1998
This is the Ghost version that the error occurred in. It is important to check this field, because many bugs have been fixed in later versions. The Build number is for development use. The license number is occasionally useful.
ModeProgMode : PROG_LOCALThis indicates the type of cloning operation. For instance, PROG_LOCAL indicates that Ghost was running in a peer-to-peer (LPT, NetBIOS, or TCP/IP) configuration.
PathNamePathName :GHOST\PACKAGE\
README.TXT
This indicates which file was being copied or checked when the error occurred. This information is useful when the problem always happens on the same file or type of file, or when the file is unusual in some way, such as a very large file.
Position in the dump fileDumpPos: 3464263This indicates when the error occurred. It represents the position in the image file that Ghost was at while writing the image information to memory or to a disk or partition.

If a problem repeatedly occurs at the same point in the image file, the image file might be corrupt, or the source disk or partition might have disk errors.
Compression ModeFlagImplode: 2
FlagExplode: 0
Indicates what, if any, type of compression or decompression Ghost is using.
Cloning DetailsCloneSrc: 2
BatchPartSrc: 7454160
BatchPartMSrc: 2

CloneDst: D:\MYDOCU~1\BACKUP.GHO
BatchPartDst: 0
This field lists the source partition and the destination file when creating an image file.

This field is present for most Ghost cloning operations that run Ghost from the DOS command prompt to create an image file.

This information helps with diagnosis when Ghost cannot locate a particular source partition or destination file.

This field is only listed with Norton Ghost 2003 and later.
IRQ StatusKeyboard IRQ Status: Not in IRQ
Mouse IRQ Status: Not in IRQ(0)
Indicates whether the error occurred when processing keyboard or mouse interrupts.
Function call historyTraceback:
( 0)[main]
( 1)[AttemptOperation]
( 2)[CopyMainline]
( 3)[CopyDiskToFile]
( 4)[CopyAllPartitions]
( 8)[CalculateNewOffsets]
( 9)[Abort]
This indicates what function the error occurred in. It is useful to Ghost developers and technical support.

The most useful information here is the operation that was being performed and the last function called. The operation in this example is listed under the CopyMainline entry (CopyDiskToFile) and the last function is listed just before the Abort entry (CalculateNewOffsets).
Memory InformationStart heap available : 20873216
Cur heap available: 21876736
Total Memory: 66531328

Maximum conventional allocated: 136252
Current conventional allocated: 136252
This indicates the amount of memory available to Ghost. Note that the figures for total memory may not accurately reflect the amount of RAM installed on the computer.
Memory system dump_______
length:  
580 [ghost.cpp], line = 1619
length:    
16 [sectors.cpp], line = 1369
etc
This information is sometimes useful to the Ghost developers, but does not provide useful information to technical support for diagnosing or resolving the problem.
FAT Volume InfoFat details:  SRC:  FatType..........32  
first_sect.......63  ClusterSize......4096  clusters.........654916  root_next_avail..0  data_next_avail..0  dir_sector.......0  root_sector......10266  data_sector......10266
FAT_sector.......0
This displays the details for a FAT partition.
NTFS Volume InfoNTFS details:This displays the details for an NTFS partition. These details are useful for the Ghost developers.
NTFS Global FlagsThese are program variables that may be useful for the Ghost developers.
Operation StatisticsOperation Details :
Total size.........1230
MB copied..........6
MB remaining.......1224
Percent complete...0%
Speed..............360MB/min
Time elapsed.......0:01
Time remaining.....3:00
This field provides data on the performance of the Ghost operation.

This information may be useful for diagnostic purposes if there is a large deviation from the norm.

This field is only listed with Norton Ghost 2003 and later.
Source Drive InfoDisk Info :
remote............0
drive.............81
sectors_used......4120641
estimated_used....709555
pemax.............1
Version...........512
  • Remote indicates whether the drive is local or on the slave peer-to-peer PC.
  • Drive indicates which drive number is the source drive
  • Sectors used is the amount of partitioned space on the drive.
  • Estimated used is an estimate of the data usage on the drive.
  • Pemax indicates the number of partitions (i.e. primary or logical drives)
  • Version indicates what version of Ghost was used to create the source. It is important when checking what version was used to create a source image file.
Source Partition Info# Ord Boot Id Ext First Num Last Used NTFS 0 0 80 b No 00000063 05249601 05249664 01478019 No
1 1 0 0 Yes 05249664 00000000 05249664 00000000 No
This information is from the partition entry in the partition table. It is very useful for double checking against the other information in the error file. For example, if the last sector of a partition is greater than the total sectors , then there's a problem.
Target Drive InfoDisk Info :
remote.............0
drive..............0
sectors_used.......0
estimated_used.....0
pemax..............0
Version............0
Zero entries indicate that the target is an image file.
Partition InfoSee Example ------------># Ord Boot Id Ext First Num Last Used NTFS

Empty entries indicate that the target is an image file.
All Disk InfoAll Disk Info:

Remote Drives

Local Drives

Drive 0

Int13h
Available
Cylinders         781
Heads             128
Sectors per Track 63
Total Sectors     6297984
MB                3075

Extended Int13h (Active)
Available
Cylinders         782
Heads             128
Sectors per Track 63
Total Sectors     6306048
MB                3079

ASPI
Unavailable

IDE
Unavailable


Drive 1

Int13h
Available
Cylinders         1022
Heads             64
Sectors per Track 63
Total Sectors     4120704
MB                2012

Extended Int13h (Active)
Available
Cylinders         1023
Heads             64
Sectors per Track 63
Total Sectors     4124736
MB                2014

ASPI
Unavailable

IDE
Unavailable
This displays detailed information for each of the drives that Ghost initially detects. In this example, the local drives are Drive 0 and Drive 1.

For each drive, the log file displays information for each hard disk access method that Ghost supports. Ghost currently supports the following hard disk access methods:
  • Int13h
  • Extended Int13h
  • ASPI
  • IDE

NOTE: Symantec Ghost 7.0 and later display the methods "IDE using PIO" and "IDE using UDMA" instead of "IDE."

Ghost lists the following information for each of these access methods:
  • Name of the disk access method, as listed above. The word "(Active)" follows the name when this is the method that Ghost uses to initially access the drive.
  • Available or Unavailable: This indicates whether this method could have been used to access the drive.
    • If a command line switch was used to disable the method (-FNX, -FNS,-FNI) this line displays "Disabled via command line".
    • If the access method was initially selected to be used but failed a read test, this line displays "Failed access test".
  • Number of cylinders: 0 indicates unknown.
  • Number of heads: 0 indicates unknown.
  • Number of sectors per track: 0 indicates unknown.
  • Total number of sectors:
  • MB: Capacity in Megabytes, calculated from the total number of sectors.

How to use this information:
Compare the disk size displayed for each available disk access method to the actual disk size.
  • If the displayed disk size for an active disk access method is significantly different from the actual disk size, then that disk access method might be at fault. If you suspect a problem may be caused by the disk access method that Ghost uses, run Ghost with a switch that disables the active access method.
  • If the displayed disk size is zero, that disk access method is not available. Using an unavailable disk access method might solve the problem, provided you enable it. How to enable any particular disk access method depends on why it is not available. For instance, loading an ASPI driver, or ensuring that you are running Ghost under DOS instead of in Windows, might make one or more of the unavailable methods available.
Drive DetailsKey A:
Path A:
Desc
Type Floppy

Key C:
Path C:
Desc [-VPSGHBOOT-]
Type Disk
Disk 0
Offset 2200905
Lists all the storage devices that Ghost can use as a destination to save the image file to. The information in this field may be different when you load different drivers or change which cloning operation you will perform.

When a source or destination drive is not listed here, it usually means one of the following:
  • The correct driver was not loaded for the drive.
  • Ghost cannot access the drive. This may happen, for instance, when the disk is not partitioned, or drive uses a Linux volume. Though Ghost can create an image file of Linux volume, Ghost cannot save an image file to a Linux volume.

Note that when you load a driver that is unstable, the storage devices that the driver handles might not be listed here.


This field is only listed with Norton Ghost 2003 and later.


Disk access methods

Int13h
Int13h is the basic way to access hard drives through the BIOS. Ghost will not use a disk unless it can access the disk through Int13h.

Int13h can only access the first 8 GB of a disk, and will never report a drive as being larger than 8 GB. Int13h always reports the numbers of cylinders (1 - 1024), heads (1 - 256), and sectors per track (1 - 63),and these numbers multiplied together will equal the total sectors.

Extended Int13h
Extended Int13h is supported by some types of BIOS as a more modern way to access hard drives. When the BIOS does not support Extended Int13h and the computer is running in Windows 95/98, Windows supplies the Extended 13h functionality as long as the computer is not running in MS-DOS Compatibility Mode.

Extended Int13h does not have an 8 GB limitation. Windows can generally access the full size of the drive even if the drive is reported as being only 8 GB. Extended Int13h usually reports the number of cylinders, heads and sectors per track, but there are no definite ranges for these values. In the Ghost error log, the values generally match either the Int13h or the IDE figures. When multiplied, these numbers might not result in the actual number of total sectors.

Partitions which extend beyond the first 8 GB of a disk cannot be accessed in DOS unless the computer supports Extended Int13h. This often limits the size of bootable partitions.

To disable Extended Int13h access use the -FNX switch on the Ghost.exe, Ghostpe.exe, or Ghostwks.exe command line. To force Ghost to use Extended Int13h access, use the -FFX switch.

ASPI
The ASPI access method is used to access SCSI drives if you load an ASPI driver during startup. In addition, Windows, in some rare circumstances, will load an ASPI driver which will allow access to IDE drives through the ASPI interface.

There is no 8 GB limit with ASPI access. ASPI will never report numbers of cylinders, heads and sectors per track.

The ASPI access method was first supported in Ghost 5.1c . To disable ASPI access use the -FNS switch on the Ghost.exe, Ghostpe.exe, or Ghostwks.exe command line. To force Ghost to use ASPI access, use the -FFS switch.

IDE
The IDE access method accesses IDE drives by communicating directly with the IDE controller. No support is needed from the BIOS or from any additional drivers. Ghost supports only the standard primary and secondary controllers. IDE access is not used when running under Windows.

Symantec Ghost 7.0 and 7.5 display the methods IDE using PIO and IDE using UDMA instead of IDE.
  • UDMA stands for Ultra Direct Memory Access, or Ultra DMA. IDE using UDMA accesses the computer's memory (RAM) directly, bypassing the CPU. DMA and Ultra DMA access are significantly faster than PIO access.
  • PIO stands for Programmed Input/Output. IDE using PIO accesses the computer's memory through the CPU.

IDE can access the full size of the drive, though IDE drives are currently limited to 128 GB. IDE will always report the number of cylinders (1 - 65536), heads (1 - 16), and sectors per track (1 - 256). When multiplied, these numbers might not result in the actual number of total sectors; large drives will normally report 16383 cylinders, 16 heads and 63 sectors per track.

The IDE access method was first supported in Ghost 5.1c . To disable IDE access use the -FNI switch on the Ghost.exe, Ghostpe.exe, or Ghostwks.exe command line. To force Ghost to use IDE access, use the -FFI switch.


Possible uses for this information
  • If you suspect a problem may be caused by the disk access method chosen, it may help to disable the active access method.
  • If the disk size displayed in Ghost is not accurate, this should help establish either:
    • Which method was at fault.
    • Which methods are not available that might have helped had they been available. This may suggest an action, such as loading an ASPI driver or ensuring that you are running Ghost under DOS instead of in Windows.

Example Command Lines
Command Line
Result
GHOST -FNSWill disable the ASPI method from being used by Ghost for drive geometry detection.
GHOST -FNX -FNIWill disable Extended Int13h and Direct IDE methods from being used by Ghost for drive geometry detection.
GHOST -FNX -FFIWill disable Extended Int13h and force Ghost to use the Direct IDE method of drive geometry first.
GHOST -FFXWill force Ghost to use Extended Int13h as the first choice for drive geometry detection.







Legacy ID



1999021911433525


Article URL http://www.symantec.com/docs/TECH106777


Terms of use for this information are found in Legal Notices