Server Blue Screen-Dump File

youdarazi · 2011/09/26

Good Day to all,
My Server is restarting since 1 month each 2 or 3 days without leaving any dump files or any event in the event viewer except the famous message : The previsous system shutodwn was unexpected.
Yesterday for the first time he left me a dump file that i'm posting here hoping that someone can help me.
I have run all the system hardware diagnosctics without any problem.
My server is an HP DL 380 G5 with windows 2003 Enterprise Server SP2.
3.25 GB RAM , and 8 core intel Zeon CPU X5450 @ 3GHz.
And here is the dump file :

Use !analyze -v to get detailed debugging information.

BugCheck D1, {a, d000001b, 0, a}

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
Probably caused by : ntkrnlmp.exe ( nt!KiTrap0E+2a7 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000a, memory referenced
Arg2: d000001b, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 0000000a, address which referenced memory

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details

READ_ADDRESS: 0000000a

CURRENT_IRQL: 1b

FAULTING_IP:
+385952f01fedfdc
0000000a ?? ???

PROCESS_NAME: sqlagent.exe

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

TRAP_FRAME: b8ebd7d8 -- (.trap 0xffffffffb8ebd7d8)
ErrCode = 00000000
eax=00000036 ebx=8087b35d ecx=89befa70 edx=808af9c8 esi=00000202 edi=00000008
eip=0000000a esp=b8ebd84c ebp=c0850846 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0030 es=dd40 fs=b376 gs=0000 efl=00010246
0000000a ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 0000000a to 80836e17

FAILED_INSTRUCTION_ADDRESS:
+385952f01fedfdc
0000000a ?? ???

STACK_TEXT:
b8ebd7d8 0000000a badb0d00 b88b3000 00000000 nt!KiTrap0E+0x2a7
WARNING: Frame IP not in any known module. Following frames may be wrong.
b8ebd848 c0850846 b8ebd88c 00000001 b8ebd896 0xa
b8ebd8a4 808457ff 00000023 f7737120 00000000 0xc0850846
b8ebd948 808093eb b8ebd9f8 00000000 808093f0 nt!KeContextFromKframes+0x9b
b8ebd9c8 80837cbe b8ebd9f8 00000000 80829fa3 nt!KiSaveProcessorState+0x20
b8ebd9e0 80a828fc b8ebd9f8 00000000 00000000 nt!KiIpiServiceRoutine+0x8b
b8ebd9e0 80829fa3 b8ebd9f8 00000000 00000000 hal!HalpIpiHandler+0xcc
b8ebda74 808165b3 b8ebda97 00000000 00000000 nt!ExpOptimizePushLockList+0x27
b8ebdae4 00000000 00000000 00000000 00000000 nt!ExfAcquirePushLockExclusive+0xcc

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+2a7
80836e17 833d40ee8a8000 cmp dword ptr [nt!KiFreezeFlag (808aee40)],0

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiTrap0E+2a7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4cbdaf65

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+2a7

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+2a7

Followup: MachineOwner
---------

Thanks in advance for your help.
Regards.

Admin. · 2011/09/26

Follow these instructions to post a Dump Data Log.

youdarazi · 2011/09/27

DUMP DATA - Windows 2003 Server

Opened log file 'c:\debuglog.txt'

Loading Dump File [C:\Documents and Settings\darjos01\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.101019-0340
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Sun Sep 25 22:58:16.909 2011 (GMT-4)
System Uptime: 0 days 13:42:53.765
Loading Kernel Symbols
...............................................................
..................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {a, d000001b, 0, a}

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
Probably caused by : ntkrnlmp.exe ( nt!KiTrap0E+2a7 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000a, memory referenced
Arg2: d000001b, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 0000000a, address which referenced memory

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details

READ_ADDRESS: 0000000a

CURRENT_IRQL: 1b

FAULTING_IP:
+366952f0189dfdc
0000000a ?? ???

PROCESS_NAME: sqlagent.exe

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

TRAP_FRAME: b8ebd7d8 -- (.trap 0xffffffffb8ebd7d8)
.trap 0xffffffffb8ebd7d8
ErrCode = 00000000
eax=00000036 ebx=8087b35d ecx=89befa70 edx=808af9c8 esi=00000202 edi=00000008
eip=0000000a esp=b8ebd84c ebp=c0850846 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0030 es=dd40 fs=b376 gs=0000 efl=00010246
0000000a ?? ???
.trap
Resetting default scope

LAST_CONTROL_TRANSFER: from 0000000a to 80836e17

FAILED_INSTRUCTION_ADDRESS:
+366952f0189dfdc
0000000a ?? ???

STACK_TEXT:
b8ebd7d8 0000000a badb0d00 b88b3000 00000000 nt!KiTrap0E+0x2a7
WARNING: Frame IP not in any known module. Following frames may be wrong.
b8ebd848 c0850846 b8ebd88c 00000001 b8ebd896 0xa
b8ebd8a4 808457ff 00000023 f7737120 00000000 0xc0850846
b8ebd948 808093eb b8ebd9f8 00000000 808093f0 nt!KeContextFromKframes+0x9b
b8ebd9c8 80837cbe b8ebd9f8 00000000 80829fa3 nt!KiSaveProcessorState+0x20
b8ebd9e0 80a828fc b8ebd9f8 00000000 00000000 nt!KiIpiServiceRoutine+0x8b
b8ebd9e0 80829fa3 b8ebd9f8 00000000 00000000 hal!HalpIpiHandler+0xcc
b8ebda74 808165b3 b8ebda97 00000000 00000000 nt!ExpOptimizePushLockList+0x27
b8ebdae4 00000000 00000000 00000000 00000000 nt!ExfAcquirePushLockExclusive+0xcc

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+2a7
80836e17 833d40ee8a8000 cmp dword ptr [nt!KiFreezeFlag (808aee40)],0

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiTrap0E+2a7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4cbdaf65

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+2a7

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+2a7

Followup: MachineOwner
---------

Closing open log file c:\debuglog.txt

Arie · 2011/09/28

There's not much usable information here, but since it seems to be a driver error, go ahead and run Driver Verifier.

Please read these instructions BEFORE using it as it can cause a BSOD loop that won't let you into Windows:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using Windows Repair feature - See How to recover from a corrupted registry that prevents Windows XP from starting).

Windows 7 & Vista users can follow the XP procedure to restore their system.

Then, here's the procedure:

In your Start Search box type Verifier and press ENTER (In XP go to Start > Run and type verifierin the Open box, press OK)

Select Create custom settings (for code developers) and click Next

Select Select individual settings from a full list and click Next

Select everything EXCEPT FOR Low Resource Simulation and click Next

Select Automatically select unsigned drivers and click Next

If no drivers show up, then select Select driver names from a list and click Next

Then select all drivers NOT provided by Microsoft and click Next

Select Finish on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Reboot into Windows, turn off Driver Verifier by going back in and selecting Delete existing settings on the first page, then locate and post the memory dump file with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.

If you can't get into Safe Mode, try using System Restore as indicated above to set the system back to the previous restore point that you created.
Click to expand...

More information on Drive Verifier here: Using Driver Verifier to identify issues with Windows drivers for advanced users

Log in or Sign up

Server Blue Screen-Dump File

youdarazi Inactive Thread Starter

Admin. Administrator Administrator Staff

youdarazi Inactive Thread Starter

Arie Administrator Administrator Staff

Share This Page

Log in or Sign up

Server Blue Screen-Dump File

youdarazi Inactive Thread Starter

Admin. Administrator Administrator Staff

youdarazi Inactive Thread Starter

Arie Administrator Administrator Staff

Share This Page

Useful Searches