I'm working on an old code base. The application is a complex accounting system coded in C, C++ and Delphi. It uses an in-house shared file database system for storage: data is stored in files accessed directly by the applications. Concurrent users access these files from their networked machines and the application uses file locking to protect concurrent access.
The system has worked more or less OK for more than 25 years and it's deploy at several thousand locations so we know it is mostly fine.
I'm faced with a really strange issue at one customers: it looks like about once every few days, the OS reports to the application that the file it is working on does not exists or that it is empty. When this happens, the application will either fail to display the data (if it's accessing a datafile) or assume the file really isn't present and try to re-create it (in case of an index file), causing an apparent data lose.
We went through the logs with a comb and added a lot of additional checks and all but we've been unable to find anything wrong.
We have 2 categories of failures:
- Failure of GetFileAttributes with GetLastError returning ERROR_FILE_NOT_FOUND (0x2).
- Failure of ReadFile (returning 0) with GetLastError returning ERROR_HANDLE_EOF (0x26)
The weird thing is that we couldn't find any failure to write data. When the error occurs, it's specific to that file: the log file (which is on the same network share as the data disk) is correctly written. We couldn't rule out completely any failure to lock and write to the lock file but we couldn't find any trace of such occurrence.
Our main suspect is the AV: Kaspersky. That is the only thing that we could see could mess with the result of some API, sometimes.
Does anyone ever encountered something similar?