Windows SBS 2003 Server Reboot

I have problems with my server SBS
Hello,
I have a SBS 2003 biXéon 2.8Ghz and ECC 2Go. Each day the server reboot
Here is an example of Windows Debugger analyse crash dump

Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
Debug session time: Tue Nov 22 11:16:26.640 2005 (GMT+1)
System Uptime: 0 days 20:31:55.265
Loading Kernel Symbols
..............................................................................................................
Loading unloaded module list
....
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {4, 2, 1, 809dca18}

Probably caused by : e1000325.sys ( e1000325!RxPacketAssemble+2c )

Followup: MachineOwner
---------

2: kd> analyze -v
*** ERROR: Module load completed but symbols could not be loaded for exifs.sys
*** ERROR: Module load completed but symbols could not be loaded for ino_fltr.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_adpu320.sys
*** WARNING: Unable to verify timestamp for afd.sys
*** ERROR: Module load completed but symbols could not be loaded for afd.sys
*** ERROR: Module load completed but symbols could not be loaded for fweng.sys
*** ERROR: Module load completed but symbols could not be loaded for VIDEOPRT.SYS
*** ERROR: Symbol file could not be found. Defaulted to export symbols for dxg.sys -
*** WARNING: Unable to verify timestamp for ati2drad.dll
*** ERROR: Module load completed but symbols could not be loaded for adpu320.sys
*** ERROR: Module load completed but symbols could not be loaded for ACPI.sys
*** WARNING: Unable to verify timestamp for Msfs.SYS
*** ERROR: Module load completed but symbols could not be loaded for Msfs.SYS
*** WARNING: Unable to verify timestamp for flpydisk.sys
*** ERROR: Module load completed but symbols could not be loaded for flpydisk.sys
*** WARNING: Unable to verify timestamp for fdc.sys
*** ERROR: Module load completed but symbols could not be loaded for fdc.sys
*** WARNING: Unable to verify timestamp for dmload.sys
*** ERROR: Module load completed but symbols could not be loaded for dmload.sys
*** ERROR: Module load completed but symbols could not be loaded for ino_flpy.sys
*** WARNING: Unable to verify timestamp for Null.SYS
*** ERROR: Module load completed but symbols could not be loaded for Null.SYS
*** WARNING: Unable to verify timestamp for Fs_Rec.SYS
*** ERROR: Module load completed but symbols could not be loaded for Fs_Rec.SYS
*** WARNING: Unable to verify timestamp for parvdm.sys
*** ERROR: Module load completed but symbols could not be loaded for parvdm.sys
*** ERROR: Module load completed but symbols could not be loaded for QntmDLT.sys
Couldn't resolve error at 'nalyze -v'
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 809dca18, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000004

CURRENT_IRQL: 2

FAULTING_IP:
nt!ViDeadlockAllocateFromPoolCache+1f
809dca18 894a04 mov [edx+0x4],ecx

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 809dcad0 to 809dca18

TRAP_FRAME: f78b6cf0 -- (.trap fffffffff78b6cf0)
ErrCode = 00000002
eax=87ff4940 ebx=8a9163e8 ecx=8a3de678 edx=00000000 esi=00000000 edi=00000068
eip=809dca18 esp=f78b6d64 ebp=f78b6d64 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!ViDeadlockAllocateFromPoolCache+0x1f:
809dca18 894a04 mov [edx+0x4],ecx ds:0023:00000004=????????
Resetting default scope

STACK_TEXT:
f78b6d64 809dcad0 8a3de688 00000080 8a3de678 nt!ViDeadlockAllocateFromPoolCache+0x1f
f78b6d88 809dde32 00000002 8a9166a8 00000000 nt!ViDeadlockAllocate+0x76
f78b6dd4 809d530e 8a9166a8 00000005 8945d418 nt!VfDeadlockAcquireResource+0x5a
f78b6df4 ba461bc2 00000000 f78b6e54 00000000 nt!VerifierKeAcquireSpinLockAtDpcLevel+0x46
f78b6e30 ba462262 8a9163e8 f78b6e54 f78b6f60 e1000325!RxPacketAssemble+0x2c
f78b6f64 ba462393 8a9163e8 f78b6f93 89e398f8 e1000325!RxProcessReceiveArray+0x32
f78b6f88 f721c12f 009163e8 f773fa40 8a91673c e1000325!E1000HandleInterrupt+0xa7
f78b6f9c 8083eb0f 8a91673c 8a916728 00000000 NDIS!ndisMDpcX+0x1f
f78b6ff4 8083a92b b9c03c8c 00000000 00000000 nt!KiRetireDpcList+0xca
f78b6ff8 b9c03c8c 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x3f
WARNING: Frame IP not in any known module. Following frames may be wrong.
8083a92b 00000000 0000000a bb837775 00000128 0xb9c03c8c


FOLLOWUP_IP:
e1000325!RxPacketAssemble+2c
ba461bc2 83bb2802000003 cmp dword ptr [ebx+0x228],0x3

SYMBOL_STACK_INDEX: 4

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: e1000325!RxPacketAssemble+2c

MODULE_NAME: e1000325

IMAGE_NAME: e1000325.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e230f8c

STACK_COMMAND: .trap fffffffff78b6cf0 ; kb

FAILURE_BUCKET_ID: 0xA_W_VRF_e1000325!RxPacketAssemble+2c

BUCKET_ID: 0xA_W_VRF_e1000325!RxPacketAssemble+2c

Followup: MachineOwner
---------

can I have some help?

Thank you

 

Hi,

From the stack trace, I find the footprint of driver verifier. Disable driver verifier may resolve the problem.


At command prompt
verifier /reset



STACK_TEXT:
f78b6d64 809dcad0 8a3de688 00000080 8a3de678 nt!ViDeadlockAllocateFromPoolCache+0x1f
f78b6d88 809dde32 00000002 8a9166a8 00000000 nt!ViDeadlockAllocate+0x76
f78b6dd4 809d530e 8a9166a8 00000005 8945d418 nt!VfDeadlockAcquireResource+0x5a
f78b6df4 ba461bc2 00000000 f78b6e54 00000000 nt!VerifierKeAcquireSpinLockAtDpcLevel+0x46 <---
f78b6e30 ba462262 8a9163e8 f78b6e54 f78b6f60 e1000325!RxPacketAssemble+0x2c

 

Re DUMP

It's not the solution of my problem.
I've disabled the verifiy driver and 2 days after I have another dump.
Here is the dump

Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
Debug session time: Tue Nov 29 17:11:06.259 2005 (GMT+1)
System Uptime: 2 days 5:17:38.546
Loading Kernel Symbols
..............................................................................................................
Loading unloaded module list
....
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {2, 87ffe6a8, 87fbe000, 89ebd0c0}

*** ERROR: Module load completed but symbols could not be loaded for ino_fltr.sys
Probably caused by : netbt.sys ( netbt!NTSend+1e1 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000002, Pool header has been corrupted
Arg2: 87ffe6a8, Pointer to pool header
Arg3: 87fbe000, First part of pool header contents
Arg4: 89ebd0c0, 0

Debugging Details:
------------------


BUGCHECK_STR: 0xc2_2

DEFAULT_BUCKET_ID: DRIVER_FAULT

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from ba275af9 to 8087b6be

STACK_TEXT:
b9c4f688 ba275af9 000000c2 00000002 87ffe6a8 nt!KeBugCheckEx+0x1b
b9c4f6b4 ba23c087 89ebd040 b9c4f6e8 b9c4f6f0 tcpip!MdpAllocateAtDpcLevel+0xe9
b9c4f6c4 ba245549 8a136ce8 b9c4f6e8 0000000e tcpip!GetARPBufferAtDpcLevel+0x2c
b9c4f6f0 ba23bdf8 8a136ce8 8995b968 8802a6e8 tcpip!ARPSendData+0x85
b9c4f718 ba23d0d5 8a136ce8 b9c4f702 00000001 tcpip!ARPTransmit+0x11a
b9c4f748 ba23dcfe 89f5a758 b001a8c0 8995b968 tcpip!SendIPPacket+0x193
b9c4f894 ba241c11 ba279bb8 8826d768 8826d700 tcpip!_IPTransmit+0x2914
b9c4f904 ba241db0 a61bbd2c 00001002 892c780c tcpip!TCPSend+0x5fa
b9c4f92c ba242488 00000001 00000000 00001002 tcpip!TdiSend+0x1cc
b9c4f960 ba203902 892c75c8 88e70acc 892c6c28 tcpip!TCPSendData+0x83
b9c4f98c b9b9017c 89f46c78 892c75c8 00001000 netbt!NTSend+0x1e1
b9c4f9b4 b9be19a7 89f46c78 b9b901db 892c7833 srv!SrvStartSend2+0x11a
b9c4f9e0 b9b8fc95 00000000 b9c4fa1c 8083ec8a srv!SrvFsdRestartReadAndX+0x258
b9c4f9ec 8083ec8a 00000000 892c75c8 892c6c28 srv!SrvFsdIoCompletionRoutine+0x1d
b9c4fa1c f723cb6d e4974a08 00000000 b9c4fb08 nt!IopfCompleteRequest+0xcd
b9c4fa2c f723be01 886e9190 892c75c8 00000000 Ntfs!NtfsCompleteRequest+0xc8
b9c4fb08 f723b8de 886e9190 892c75c8 00000001 Ntfs!NtfsCommonRead+0xd32
b9c4fbac 8083f9d0 897231c0 892c75c8 8a125980 Ntfs!NtfsFsdRead+0x113
b9c4fbc0 f730bc53 8a125980 89f686e8 b9c4fd68 nt!IofCallDriver+0x45
b9c4fbe8 8083f9d0 896aa020 892c75c8 892c780c fltmgr!FltpDispatch+0x6f
b9c4fbfc f72fbfdf 892c75c8 89f686e8 892c780c nt!IofCallDriver+0x45
b9c4fc9c f72fc3ab 89f686e8 892c75c8 00000001 sis!SipCommonRead+0x23d
b9c4fcb4 8083f9d0 89f686e8 892c75c8 897f94b0 sis!SiRead+0x3f
b9c4fcc8 b9e15764 e47f04c0 89f738b0 00001000 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
b9c4fcec b9bade0d b9ba07f4 892c6c28 89803958 ino_fltr+0x7764
b9c4fd78 b9b8fbc6 892c6c30 89803920 b9ba5451 srv!SrvSmbReadAndX+0x5f4
b9c4fd84 b9ba5451 00000000 8a14bd48 00000000 srv!SrvProcessSmb+0xb7
b9c4fdac 8092ccff 00803920 00000000 00000000 srv!WorkerThread+0x138
b9c4fddc 80841a96 b9ba5394 89803920 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
netbt!NTSend+1e1
ba203902 6a00 push 0x0

SYMBOL_STACK_INDEX: a

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: netbt!NTSend+1e1

MODULE_NAME: netbt

IMAGE_NAME: netbt.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42435dff

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xc2_2_netbt!NTSend+1e1

BUCKET_ID: 0xc2_2_netbt!NTSend+1e1

Followup: MachineOwner
---------

 

Hi,

Bugcheck code C2 is related to faulty memory. TCPIP is a stable module. It crashes only if hardware error. I believe the culprit is faulty memory. BTW you don't provide the output of module list (ie lm tn) which is very useful to diagnostic the problem.

The culprit is faulty memory. You can run memtest to stress the ram. If memtest reports the ram is faulty, ram is bad. However Memtest is not a perfect tool to test the memory as some faulty ram can pass memtest.

Suggestion
1. Check the temperature of the CPU and make sure that it is not overheat (ie temperature < 60C)
Make sure that the CPU fan works properly
2. Reseat the memory stick to another memory slot. Reseat video card as well.
3. Downclock the ram. Check to default setting if you video card is overclocked.
4. Clean the dust inside the computer case
5. Make sure that the ram is compatible to the motherboard
6. Check the bios setting about memory timing and make sure that it is on
For example : DIMM1 and DIMM2 do not have the same timing.
DIMM1: Corsair CMX512-3200C2 512 MB PC3200 DDR SDRAM (2.5-3-3-8 @ 200 MHz) (2.0-3-3-7 @ 166 MHz)
DIMM2: Corsair CMX512-3200C2 512 MB PC3200 DDR SDRAM (3.0-3-3-8 @ 200 MHz)
DIMM3: Corsair CMX512-3200C2 512 MB PC3200 DDR SDRAM (3.0-3-3-8 @ 200 MHz)
7. Make sure that your PSU have adequate power to drive all the hardware including USB devices
8. Run chkdsk /r at command prompt
9. Run 3DMark 2005 to test your video card
10. Upgrade BIOS

If it still crashes, diagnostic which memory stick is faulty
Take out one memory stick. If windows does not crash, the removed memory stick is faulty.

 

Memory

I have changed all the memory stick. There are Four 512 Mb of ECC Memory.
And the problem is the same.

 

Windows SBS Server Reboot

Hi,
make all MEMORY IDENTICAL

Regards

 

Hi Procd,

Maybe one of the ram slot is bad. Reboot your windows with one memory module. If all the ram slot has the same problem, the ram slot is not the culprit. Try downclock the ram. If it still crashes, post the minidump here.

 

Here is a new dump

Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
Debug session time: Wed Dec 7 16:28:57.636 2005 (GMT+1)
System Uptime: 1 days 14:19:01.796
Loading Kernel Symbols
..............................................................................................................
Loading unloaded module list
....
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {4, 2, 1, 80853b3b}

*** ERROR: Module load completed but symbols could not be loaded for ino_fltr.sys
Probably caused by : fltmgr.sys ( fltmgr!FltpCreate+a7 )

Followup: MachineOwner
---------

1: kd> analyze -v
*** ERROR: Module load completed but symbols could not be loaded for exifs.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_adpu320.sys
*** ERROR: Module load completed but symbols could not be loaded for fweng.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for VIDEOPRT.SYS -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for dxg.sys -
*** ERROR: Module load completed but symbols could not be loaded for adpu320.sys
*** ERROR: Module load completed but symbols could not be loaded for ACPI.sys
*** ERROR: Module load completed but symbols could not be loaded for ino_flpy.sys
*** ERROR: Module load completed but symbols could not be loaded for QntmDLT.sys
Couldn't resolve error at 'nalyze -v'
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 80853b3b, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000004

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiDeliverApc+d9
80853b3b 894104 mov [ecx+0x4],eax

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 808472e1 to 80853b3b

TRAP_FRAME: b7e417f8 -- (.trap ffffffffb7e417f8)
ErrCode = 00000002
eax=8888fa8c ebx=80a7a1c0 ecx=00000000 edx=88891268 esi=888cfa60 edi=8888fa7c
eip=80853b3b esp=b7e4186c ebp=b7e418a0 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!KiDeliverApc+0xd9:
80853b3b 894104 mov [ecx+0x4],eax ds:0023:00000004=????????
Resetting default scope

STACK_TEXT:
b7e418a0 808472e1 00000000 00000000 00000000 nt!KiDeliverApc+0xd9
b7e418b0 f7271280 0000000e 8a1d9340 8856b630 nt!KiCheckForKernelApcDelivery+0x1c
b7e419a8 8083f9d0 8a08a020 8856b630 8a21b7a8 Ntfs!NtfsFsdCreate+0x2ff
b7e419bc f731941b 8a21b7a8 8a342008 00000000 nt!IofCallDriver+0x45
b7e419e4 8083f9d0 8a227c70 8856b630 8856b79c fltmgr!FltpCreate+0xa7
b7e419f8 b96bb273 8858f490 89f5a480 88847fa0 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
b7e41a5c 8083f9d0 0000001c 8856b630 8856b630 ino_fltr+0xc273
b7e41a70 8092e269 b7e41c18 8a3e33b0 00000000 nt!IofCallDriver+0x45
b7e41b58 80936caa 8a3e33c8 00000000 8854d7d8 nt!IopParseDevice+0xa35
b7e41bd8 80936aa5 00000000 b7e41c18 00000040 nt!ObpLookupObjectName+0x5a9
b7e41c2c 80936f27 00000000 00000000 e41cc401 nt!ObOpenObjectByName+0xea
b7e41ca8 80936ff8 4b09f410 00100001 4b09f3c8 nt!IopCreateFile+0x447
b7e41d04 8093d023 4b09f410 00100001 4b09f3c8 nt!IoCreateFile+0xa3
b7e41d44 80834d3f 4b09f410 00100001 4b09f3c8 nt!NtOpenFile+0x27
b7e41d44 7c94ed54 4b09f410 00100001 4b09f3c8 nt!KiFastCallEntry+0xfc
4b09f690 00000000 00000000 00000000 00000000 0x7c94ed54


FOLLOWUP_IP:
fltmgr!FltpCreate+a7
f731941b e991010000 jmp fltmgr!FltpCreate+0x23d (f73195b1)

SYMBOL_STACK_INDEX: 4

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: fltmgr!FltpCreate+a7

MODULE_NAME: fltmgr

IMAGE_NAME: fltmgr.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42435ba1

STACK_COMMAND: .trap ffffffffb7e417f8 ; kb

FAILURE_BUCKET_ID: 0xA_W_fltmgr!FltpCreate+a7

BUCKET_ID: 0xA_W_fltmgr!FltpCreate+a7

Followup: MachineOwner
---------