1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Windows Server 2003, 0x0000000A DUMP DATA

Discussion in 'Windows Server System' started by Rothgar, 2005/01/09.

Thread Status:
Not open for further replies.
  1. 2005/01/09
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    Hi, I have been stumped on this problem for a number of weeks now and am now seeking some insight. I don't have any experience with dump files and so thus I am posting here.[/QUOTE]I think only about 11 or 12 people in the entire world are really good at working with those dump files. We are very lucky to have Joe Hobart and Ben McDonald on the forum since they seem to be among that very select group.

    I've been involved with computers since the early 1980s and Microsoft sytems since the early 1990s and before seeing posts by Joe / Ben, I was convinced there were no people who could use the dump files and who could also converse with us ordinary mortals.
     
    Last edited: 2005/01/09
  2. 2005/01/09
    BenMcDonald[MS]

    BenMcDonald[MS] Inactive

    Joined:
    2004/12/14
    Messages:
    228
    Likes Received:
    0
    ill look at this tomorrow. probably software memory corruption.
     

  3. to hide this advert.

  4. 2005/01/09
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    Thanks Ben appreciate it.

    We have had the majority of the memory changed. It is now running all HP certified memory where as previously it was using some Kingston mixed with HP. HP didn't want to deal with anything other than their hardware with good reasoning.

    The system will sporadically crash it seems, It could be a week or a couple of days between crashing. I also have another bug check code 0x0000008E that comes up on occasion referencing different addresses.

    I looked around and the cases for the 8E bug check for Windows XP seemed mainly to be memory related, however microsoft KB says it is the ntfs.sys file on Server 2003 and have an unreleased hotfix of which we have applied. It did not fix the issue however.

    The last 8E bugcheck was:
    0x0000008E (0xC00000005, 0x804EE997, 0xF4632ABC, 0x00000000)

    That was on the 23rd of December, before holidays.

    Look forward to hearing from you.

    Regards,
    Jason
     
    Last edited: 2005/01/09
  5. 2005/01/10
    BenMcDonald[MS]

    BenMcDonald[MS] Inactive

    Joined:
    2004/12/14
    Messages:
    228
    Likes Received:
    0
    You erased the data, i wasnt done yet :)

    Its not that small of a group. I wish it was, i'd be posting from my yacht in the carribean :p The reason you dont see folks cracking dumps in end user space is that most folks with debug skills are in corperate space. Reading dumps is time consuming and takes a lot of brain effort, too much to do a lot of it for free/on your free time.

    Post the dump data again, go ahead and include the other one too (i think you need to make two posts due to size). Please leave the data up, so others can find the stack later from searching the web. There isnt anything in this data that is compromising, no worries.
     
  6. 2005/01/10
    Scott Smith

    Scott Smith Inactive Alumni

    Joined:
    2002/01/12
    Messages:
    1,950
    Likes Received:
    4
    Would that be on Mr. Allen's Octopus ? :p :p :p
     
  7. 2005/01/10
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    Hmm, I didn't edit my first post, must've been a mistake from one of the board admins.

    Bug check was:
    0x0000000A (0x00000008, 0x00000002, 0x00000000, 0x804EE997)

    Eventlog has it as:
    System Failure: Stop error
    Reason Code: 0x805000f
    Bug ID:
    Bugcheck String: 0x0000000a (0x00000008, 0x00000002, 0x00000000, 0x804ee997)

    Here is a repost of debugfile:
    Opened log file 'c:\debuglog.txt'
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

    Microsoft (R) Windows Debugger Version 6.3.0017.0
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\MEMORY.DMP]
    Kernel Complete Dump File: Full address space is available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
    Windows Server 2003 Kernel Version 3790 MP (2 procs) Free x86 compatible
    Product: LanManNt, suite: TerminalServer SingleUserTS
    Built by: 3790.srv03_gdr.040410-1234
    Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
    Debug session time: Sun Jan 09 20:06:44 2005
    System Uptime: 16 days 8:17:16.968
    Loading Kernel Symbols
    .....................................................................................................................
    Loading unloaded module list
    ..
    Loading User Symbols
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {8, 2, 0, 804ee997}

    Probably caused by : TDI.SYS ( TDI!CTEpEventHandler+2a )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v;r;kv;lmtn;.logclose;q
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00000008, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 804ee997, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 00000008

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!ExRemoveHeadNBQueue+61
    804ee997 8b5108 mov edx,[ecx+0x8]

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    LAST_CONTROL_TRANSFER: from 804eec5d to 804ee997

    TRAP_FRAME: f78f2964 -- (.trap fffffffff78f2964)
    .trap fffffffff78f2964
    ErrCode = 00000000
    eax=865e86b0 ebx=865e86b0 ecx=00000000 edx=00fbfbd6 esi=865e5008 edi=865e5010
    eip=804ee997 esp=f78f29d8 ebp=f78f2a04 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
    nt!ExRemoveHeadNBQueue+0x61:
    804ee997 8b5108 mov edx,[ecx+0x8] ds:0023:00000008=????????
    .trap
    Resetting default scope

    STACK_TEXT:
    f78f2a04 804eec5d 865e86b0 f78f2a20 00000010 nt!ExRemoveHeadNBQueue+0x61
    f78f2a3c f2e998de 8632fcac 00000000 00000001 nt!MmMapLockedPagesSpecifyCache+0x104
    f78f2a78 f2e93187 8527ce70 f78f2d38 85d95de0 afd!AfdSetupReceiveDatagramIrp+0xee
    f78f2acc f5f5da16 85dd4ef0 00000016 f78f2b34 afd!AfdReceiveDatagramEventHandler+0x1dd
    f78f2b50 f5f5d71a 00000200 0100007f 00001c0e tcpip!UDPDeliver+0x1bc
    f78f2ba8 f5f5963f 85ffc310 0100007f 0100007f tcpip!UDPRcv+0x28c
    f78f2c08 f5f598dd 00000024 85ffc310 00000000 tcpip!DeliverToUser+0x17b
    f78f2cbc f5f6f76c 85ffc310 f78f2d30 00000030 tcpip!IPRcvPacket+0x66c
    f78f2d64 f760804c f5f99ce0 85ffc310 865a78a0 tcpip!LoopXmitRtn+0x18d
    f78f2d80 804eeabb f5f99ce0 00000000 865a78a0 TDI!CTEpEventHandler+0x2a
    f78f2dac 80596ffe f5f99ce0 00000000 00000000 nt!ExpWorkerThread+0xe9
    f78f2ddc 805008c6 804ee9f0 00000001 00000000 nt!PspSystemThreadStartup+0x2e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    FOLLOWUP_IP:
    TDI!CTEpEventHandler+2a
    f760804c 5f pop edi

    SYMBOL_STACK_INDEX: 9

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: TDI!CTEpEventHandler+2a

    MODULE_NAME: TDI

    IMAGE_NAME: TDI.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 3e8001d4

    STACK_COMMAND: .trap fffffffff78f2964 ; kb

    BUCKET_ID: 0xA_TDI!CTEpEventHandler+2a

    Followup: MachineOwner
    ---------

    eax=f773713c ebx=0000000a ecx=865a78a0 edx=40000000 esi=f7737120 edi=00000008
    eip=80543ac9 esp=f78f2930 ebp=f78f2948 iopl=0 nv up ei ng nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
    nt!KeBugCheckEx+0x19:
    80543ac9 5d pop ebp
    ChildEBP RetAddr Args to Child
    f78f2948 804e2f58 0000000a 00000008 00000002 nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo])
    f78f2948 804ee997 0000000a 00000008 00000002 nt!KiTrap0E+0x224 (FPO: [0,0] TrapFrame @ f78f2964)
    f78f2a04 804eec5d 865e86b0 f78f2a20 00000010 nt!ExRemoveHeadNBQueue+0x61 (FPO: [Non-Fpo])
    f78f2a3c f2e998de 8632fcac 00000000 00000001 nt!MmMapLockedPagesSpecifyCache+0x104 (FPO: [Non-Fpo])
    f78f2a78 f2e93187 8527ce70 f78f2d38 85d95de0 afd!AfdSetupReceiveDatagramIrp+0xee (FPO: [Non-Fpo])
    f78f2acc f5f5da16 85dd4ef0 00000016 f78f2b34 afd!AfdReceiveDatagramEventHandler+0x1dd (FPO: [Non-Fpo])
    f78f2b50 f5f5d71a 00000200 0100007f 00001c0e tcpip!UDPDeliver+0x1bc (FPO: [Non-Fpo])
    f78f2ba8 f5f5963f 85ffc310 0100007f 0100007f tcpip!UDPRcv+0x28c (FPO: [Non-Fpo])
    f78f2c08 f5f598dd 00000024 85ffc310 00000000 tcpip!DeliverToUser+0x17b (FPO: [Non-Fpo])
    f78f2cbc f5f6f76c 85ffc310 f78f2d30 00000030 tcpip!IPRcvPacket+0x66c (FPO: [Non-Fpo])
    f78f2d64 f760804c f5f99ce0 85ffc310 865a78a0 tcpip!LoopXmitRtn+0x18d (FPO: [Non-Fpo])
    f78f2d80 804eeabb f5f99ce0 00000000 865a78a0 TDI!CTEpEventHandler+0x2a (FPO: [EBP 0xf78f2dac] [1,0,0])
    f78f2dac 80596ffe f5f99ce0 00000000 00000000 nt!ExpWorkerThread+0xe9 (FPO: [Non-Fpo])
    f78f2ddc 805008c6 804ee9f0 00000001 00000000 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo])
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
    start end module name
    804de000 80745000 nt ntkrnlmp.exe Thu May 27 10:32:57 2004 (40B53739)
    80745000 8076d000 hal halmacpi.dll Tue Mar 25 18:07:28 2003 (3E800030)
    bf800000 bf9c7000 win32k win32k.sys Tue Aug 10 08:48:07 2004 (4117FF27)
    bf9c7000 bfa1d680 ati2drad ati2drad.dll Tue Mar 25 20:43:37 2003 (3E8024C9)
    bff80000 bff96000 dxg dxg.sys Tue Mar 25 20:46:23 2003 (3E80256F)
    f2c2b000 f2c52140 dump_LsiCsb6 dump_LsiCsb6.sys Fri Aug 01 06:38:06 2003 (3F297E2E)
    f2c53000 f2c6b000 Cdfs Cdfs.SYS Tue Mar 25 19:17:19 2003 (3E80108F)
    f2cab000 f2cb0180 TmPreFlt TmPreFlt.sys Tue Mar 30 19:35:08 2004 (40693F4C)
    f2d95000 f2e77fa0 VSApiNt VSApiNt.sys Tue Mar 30 19:12:36 2004 (40693A04)
    f2e78000 f2ea7000 afd afd.sys Tue Mar 25 18:40:50 2003 (3E800802)
    f2f1c000 f2f7b000 srv srv.sys Tue Mar 25 19:49:51 2003 (3E80182F)
    f2fff000 f3030500 TmXPFlt TmXPFlt.sys Tue Mar 30 19:35:10 2004 (40693F4E)
    f30b3000 f30ba000 dxgthk dxgthk.sys Tue Mar 25 18:05:52 2003 (3E7FFFD0)
    f3259000 f32b1000 HTTP HTTP.sys Tue Mar 25 19:55:21 2003 (3E801979)
    f474a000 f476c000 RDPWD RDPWD.SYS Tue Mar 25 18:03:00 2003 (3E7FFF24)
    f476c000 f4799000 Fastfat Fastfat.SYS Tue Mar 25 19:00:16 2003 (3E800C90)
    f5271000 f527a000 dump_diskdump dump_diskdump.sys Tue Mar 25 18:05:15 2003 (3E7FFFAB)
    f52b1000 f52bb000 TDTCP TDTCP.SYS Tue Mar 25 18:02:52 2003 (3E7FFF1C)
    f5cdf000 f5cf2000 Fips Fips.SYS Tue Mar 25 19:54:59 2003 (3E801963)
    f5d53000 f5dbe000 mrxsmb mrxsmb.sys Tue Oct 12 10:38:12 2004 (416B2774)
    f5ef5000 f5f20000 rdbss rdbss.sys Tue Oct 12 10:38:09 2004 (416B2771)
    f5f20000 f5f55000 netbt netbt.sys Sat Jul 19 03:16:03 2003 (3F182B53)
    f5f55000 f5fb7000 tcpip tcpip.sys Tue Mar 25 19:04:01 2003 (3E800D71)
    f6093000 f60af000 ipsec ipsec.sys Tue Mar 25 18:55:45 2003 (3E800B81)
    f60e9000 f611b680 UdfReadr_xp UdfReadr_xp.SYS Wed Dec 18 07:27:56 2002 (3DFF88CC)
    f612e000 f6168e80 cdudf_xp cdudf_xp.SYS Tue Feb 04 09:23:00 2003 (3E3EEBC4)
    f67e3000 f67ed000 Msfs Msfs.SYS Tue Mar 25 18:08:56 2003 (3E800088)
    f67f3000 f67ff000 vga vga.sys Tue Mar 25 18:08:03 2003 (3E800053)
    f6803000 f680d000 flpydisk flpydisk.sys Tue Mar 25 18:04:32 2003 (3E7FFF80)
    f6922000 f6935000 usbhub usbhub.sys Tue Mar 25 18:10:46 2003 (3E8000F6)
    f6a72000 f6aa5000 update update.sys Tue Mar 25 19:59:59 2003 (3E801A8F)
    f6d92000 f6dc6000 rdpdr rdpdr.sys Tue Mar 25 18:09:30 2003 (3E8000AA)
    f6dc6000 f6ddb000 raspptp raspptp.sys Tue Mar 25 19:19:09 2003 (3E8010FD)
    f6ddb000 f6df6000 ndiswan ndiswan.sys Tue Mar 25 19:48:19 2003 (3E8017D3)
    f6df6000 f6e0d000 rasl2tp rasl2tp.sys Tue Mar 25 18:54:46 2003 (3E800B46)
    f6e0d000 f6e2ee80 USBPORT USBPORT.SYS Tue Mar 25 18:10:43 2003 (3E8000F3)
    f6e2f000 f6e47000 serial serial.sys Tue Mar 25 18:40:08 2003 (3E8007D8)
    f6e47000 f6e5e000 parport parport.sys Tue Mar 25 18:03:56 2003 (3E7FFF5C)
    f6e89000 f6e96000 netbios netbios.sys Tue Mar 25 18:09:53 2003 (3E8000C1)
    f6e99000 f6ea6000 wanarp wanarp.sys Tue Mar 25 18:11:22 2003 (3E80011A)
    f6ef9000 f6f08000 msgpc msgpc.sys Tue Mar 25 18:10:12 2003 (3E8000D4)
    f6f19000 f6f25000 Npfs Npfs.SYS Tue Mar 25 18:08:59 2003 (3E80008B)
    f6f29000 f6f3f000 i8042prt i8042prt.sys Tue Mar 25 20:01:43 2003 (3E801AF7)
    f6f3f000 f6f5cfa0 pwd_2k pwd_2k.SYS Wed Dec 18 07:29:40 2002 (3DFF8934)
    f6f5d000 f6f7cd00 ks ks.sys Thu Dec 05 04:09:38 2002 (3DEE36D2)
    f6f7d000 f6f91000 redbook redbook.sys Tue Mar 25 18:04:38 2003 (3E7FFF86)
    f6f91000 f6fa5000 cdrom cdrom.sys Tue Mar 25 18:05:18 2003 (3E7FFFAE)
    f6fa5000 f6ff1000 cpqasm cpqasm.sys Tue May 04 11:09:15 2004 (4096ED3B)
    f6ff1000 f700ca00 q57xp32 q57xp32.sys Tue Feb 03 13:19:08 2004 (401F051C)
    f700d000 f7026000 VIDEOPRT VIDEOPRT.SYS Tue Mar 25 18:08:02 2003 (3E800052)
    f7026000 f7079d80 ati2mpad ati2mpad.sys Fri Jul 19 11:13:20 2002 (3D3767B0)
    f71fb000 f721d000 Mup Mup.sys Tue Mar 25 19:55:58 2003 (3E80199E)
    f721d000 f725e000 NDIS NDIS.sys Tue Mar 25 19:45:35 2003 (3E80172F)
    f725e000 f72fa000 Ntfs Ntfs.sys Wed Aug 11 08:44:27 2004 (41194FCB)
    f72fa000 f731b000 KSecDD KSecDD.sys Tue Mar 25 18:05:39 2003 (3E7FFFC3)
    f731b000 f7331000 CLASSPNP CLASSPNP.SYS Tue Mar 25 18:38:14 2003 (3E800766)
    f7331000 f7345f00 adpu160m adpu160m.sys Fri Feb 14 11:43:45 2003 (3E4C3BC1)
    f7346000 f736c000 SCSIPORT SCSIPORT.SYS Tue Mar 25 19:01:25 2003 (3E800CD5)
    f736c000 f7393140 LsiCsb6 LsiCsb6.sys Fri Aug 01 06:38:06 2003 (3F297E2E)
    f7394000 f73b0000 atapi atapi.sys Tue Mar 25 18:04:48 2003 (3E7FFF90)
    f73b0000 f73d1000 volsnap volsnap.sys Tue Mar 25 18:05:47 2003 (3E7FFFCB)
    f73d1000 f73fb000 dmio dmio.sys Tue Mar 25 18:08:14 2003 (3E80005E)
    f73fb000 f7420000 ftdisk ftdisk.sys Tue Mar 25 18:05:26 2003 (3E7FFFB6)
    f7420000 f7435000 pci pci.sys Tue Mar 25 18:16:40 2003 (3E800258)
    f7435000 f7466000 ACPI ACPI.sys Tue Mar 25 18:16:21 2003 (3E800245)
    f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 18:13:00 2003 (3E80017C)
    f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 18:16:35 2003 (3E800253)
    f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Tue Mar 25 18:04:44 2003 (3E7FFF8C)
    f74b7000 f74c6000 MountMgr MountMgr.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
    f74c7000 f74d5000 PartMgr PartMgr.sys Tue Mar 25 19:04:02 2003 (3E800D72)
    f74d7000 f74df080 symc8xx symc8xx.sys Wed Sep 26 04:25:49 2001 (3BB0CC2D)
    f74e7000 f74f7000 symmpi symmpi.sys Thu May 27 02:30:13 2004 (40B4C615)
    f74f7000 f7506000 disk disk.sys Tue Mar 25 18:05:20 2003 (3E7FFFB0)
    f7507000 f7513000 Dfs Dfs.sys Tue Mar 25 18:09:52 2003 (3E8000C0)
    f7517000 f7520000 crcdisk crcdisk.sys Tue Mar 25 18:07:23 2003 (3E80002B)
    f7557000 f7565ee0 Cdr4_xp Cdr4_xp.SYS Wed Dec 18 07:32:57 2002 (3DFF89F9)
    f7577000 f7585000 NDProxy NDProxy.SYS Tue Mar 25 18:11:30 2003 (3E800122)
    f7597000 f75a5000 imapi imapi.sys Tue Mar 25 18:05:45 2003 (3E7FFFC9)
    f75b7000 f75c1000 kbdclass kbdclass.sys Tue Mar 25 18:03:10 2003 (3E7FFF2E)
    f75c7000 f75d1000 TAPE TAPE.SYS Tue Mar 25 18:05:25 2003 (3E7FFFB5)
    f75d7000 f75e1000 mouclass mouclass.sys Tue Mar 25 18:03:09 2003 (3E7FFF2D)
    f75e7000 f75f0000 ndistapi ndistapi.sys Tue Mar 25 18:11:28 2003 (3E800120)
    f75f7000 f7605000 raspppoe raspppoe.sys Tue Mar 25 18:11:37 2003 (3E800129)
    f7607000 f7612000 TDI TDI.SYS Tue Mar 25 18:14:28 2003 (3E8001D4)
    f7617000 f7621000 serenum serenum.sys Tue Mar 25 18:04:01 2003 (3E7FFF61)
    f7627000 f7632000 fdc fdc.sys Tue Mar 25 18:04:31 2003 (3E7FFF7F)
    f7637000 f7642000 ptilink ptilink.sys Tue Mar 25 18:03:51 2003 (3E7FFF57)
    f7647000 f7653000 processr processr.sys Tue Mar 25 18:07:36 2003 (3E800038)
    f7657000 f7660000 watchdog watchdog.sys Tue Mar 25 18:09:01 2003 (3E80008D)
    f7677000 f7680000 raspti raspti.sys Tue Mar 25 18:11:36 2003 (3E800128)
    f7687000 f7696000 termdd termdd.sys Tue Mar 25 18:02:52 2003 (3E7FFF1C)
    f76b7000 f76c1000 Dxapi Dxapi.sys Tue Mar 25 18:06:01 2003 (3E7FFFD9)
    f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 18:08:00 2003 (3E800050)
    f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 18:07:58 2003 (3E80004E)
    f7717000 f771e000 pciide pciide.sys Tue Mar 25 18:04:46 2003 (3E7FFF8E)
    f771f000 f7726000 dmload dmload.sys Tue Mar 25 18:08:08 2003 (3E800058)
    f7727000 f772e080 sym_hi sym_hi.sys Thu Oct 04 09:48:12 2001 (3BBBA3BC)
    f772f000 f7737000 cpqcissm cpqcissm.sys Sat Dec 07 14:37:01 2002 (3DF16CDD)
    f778f000 f7796000 sysmgmt sysmgmt.sys Tue May 04 11:09:22 2004 (4096ED42)
    f77b7000 f77bc8a0 mmc_2K mmc_2K.SYS Wed Dec 18 07:29:42 2002 (3DFF8936)
    f77c7000 f77cf000 Fs_Rec Fs_Rec.SYS Tue Mar 25 18:08:36 2003 (3E800074)
    f77cf000 f77d6000 parvdm parvdm.sys Tue Mar 25 18:03:49 2003 (3E7FFF55)
    f77d7000 f77de000 Beep Beep.SYS Tue Mar 25 18:03:04 2003 (3E7FFF28)
    f77df000 f77e7000 mnmdd mnmdd.SYS Tue Mar 25 18:07:53 2003 (3E800049)
    f77e7000 f77ef000 rasacd rasacd.sys Tue Mar 25 18:11:50 2003 (3E800136)
    f780f000 f7817000 RDPCDD RDPCDD.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
    f783f000 f7846000 Null Null.SYS Tue Mar 25 18:03:05 2003 (3E7FFF29)
    f7847000 f784f000 OPRGHDLR OPRGHDLR.SYS Tue Mar 25 18:16:25 2003 (3E800249)
    f7857000 f785c560 Cdralw2k Cdralw2k.SYS Wed Dec 18 07:32:44 2002 (3DFF89EC)
    f7877000 f787b200 usbohci usbohci.sys Tue Mar 25 18:10:41 2003 (3E8000F1)
    f788f000 f7897000 audstub audstub.sys Tue Mar 25 18:09:12 2003 (3E800098)
    f7897000 f7899800 compbatt compbatt.sys Tue Mar 25 18:16:28 2003 (3E80024C)
    f789b000 f789e880 BATTC BATTC.SYS Tue Mar 25 18:16:20 2003 (3E800244)
    f789f000 f78a2f80 symc810 symc810.sys Sat Dec 09 04:40:59 2000 (3A311D2B)
    f78a3000 f78a6460 cpqarry2 cpqarry2.sys Tue Nov 06 08:47:33 2001 (3BE708F5)
    f79e5000 f79e6b80 hpdat hpdat.sys Fri Jan 24 05:49:39 2003 (3E303943)
    f79fd000 f79fe580 USBD USBD.SYS Tue Mar 25 18:10:39 2003 (3E8000EF)
    f7acc000 f7acd000 swenum swenum.sys Thu Dec 05 04:10:07 2002 (3DEE36EF)

    Unloaded modules:
    f7b4e000 f7b4f000 MemRWNT.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f77ff000 f7807000 Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    Closing open log file c:\debuglog.txt

    Regards,
    Jason
     
    Last edited: 2005/01/10
  8. 2005/01/10
    BenMcDonald[MS]

    BenMcDonald[MS] Inactive

    Joined:
    2004/12/14
    Messages:
    228
    Likes Received:
    0
    Ok, buckle up...
    Your PTE table is corrupt. A driver came along and wacked this peaceful, gentle PTE queue. I do not know why, only that it did. There is the smallest of chances that it was causes by hardware, but this almost always is a driver.
    (for those of you following at home this is the key to knowing this is your culprit)
    nt!ExRemoveHeadNBQueue+0x61
    MmMapLockedPagesSpecifyCache+0x104


    This isnt fun to troubleshoot, so much so, I must tell you to call support for assistance. I'd say this is one of the one that isn't solvable over the internet with a few gentle suggestions (mostly because it requires full access to the dump, and lots of back and forth).

    I'll outline how to proceed, using driver verifier, special pool, and PTE tracking, but i'm not volunteering to help you do it :D The below is how this usually goes.. You may get it on step 2, you may get it on step 8. I've seen them stop at every point in the list. After someone looks at your full dump, verifies my cursory analysis, the fun begins.

    Step 1) enable driver verifier and special pool on all 3rd party drivers, wait for crash, examine crash, hope it caught the culprit.
    Step 2) Enable PTE tracking, wait for crash, hope the guarding lets you backtrack who was touching it and make a leap of faith debug.
    Step 3) Cry
    Step 4) repeat above for a month until you abandon hope
    Step 5) randomly swap out hardware hoping to change the enviroment enough to make it stop
    Step 6) Eventually you will get a crash that catches the driver or
    Step 7) Detemine you have bad hardware, start replacing backplanes and CPUs
    Step 8) Receive bill for step 7, cry.

    Be kind to the tech you get, its going to be a journey.

    I make a funny up there, but its not funny. Poorly written Kernel drivers can cause such grief on a machine. This phenomenon cannot be well guarded against without signifigant CPU and memory expense, and even with guarding, has to happen juuust right to catch it. This is just one of those thing that kernel developers need to take more care, and do more testing, and hire smart people to develop thier drivers.
    I wish you good luck in the hunt.
     
    Last edited: 2005/01/10
  9. 2005/01/11
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    Hmm, Thanks for that Ben. Unfortunately I have no idea what a PTE table is... neither could I find any good reading information on google. I would have no idea on how that would have happened. Unless it was that dodgy program they tried to run a while ago "Public Outlook ". Anyway I guess my question would be what is a PTE table, can I read anything about it? Can I replace it, perhaps with a generic one? What type of things modify the PTE table?

    Microsoft I don't beleive are necessary in this problem as we plan to re-image it in around 6 months. Also we all know how much Microsoft loves to help (for the right price) and how knowledgeable most support help desk guys are. It would probably take hours to get correctly escalated.

    It mentioned TDI.sys in the dump log, would that be the corrupt file? If so from what I could see on google it looked to be network related, would that mean a networking driver? Is there a way to determine what kind of driver it is from the dump, i.e what area, network, storage, display etc?

    Thanks again,
    Jason
     
  10. 2005/01/11
    BenMcDonald[MS]

    BenMcDonald[MS] Inactive

    Joined:
    2004/12/14
    Messages:
    228
    Likes Received:
    0
    Also we all know how much Microsoft loves to help (for the right price) and how knowledgeable most support help desk guys are.
    Is my check in the mail? :eek: Taking a cheap shot at the 200 folks who I eat lunch with every day who could slam dunk your dump while playing halo2 on mute?? And yet, such love have I for my customers, I still search MSN to find you links to help you improve your technical skill and help you impress your boss.

    PTEs are an internal system object used to manage virtual memory

    Microsoft® Windows® Internals, Fourth Edition: Microsoft Windows Serverâ„¢ 2003, Windows XP, and Windows 2000
    http://www.microsoft.com/MSPress/books/6710.asp

    This book has 100 pages on memory management, and gets as high an endorsement from me as I can give. You want to learn what a PTE table is, there you go. Its worth it just for the first three chapters. buy this book, seriously.

    A quick search yields the following: I skimmed these, but i do not vouch for accuracy. 100s more out there. read these, and that will give you some new keywords to search on.
    http://people.msoe.edu/~barnicks/courses/cs384/papers19992000/buyssej-Term.pdf
    http://www.windowsitlibrary.com/Content/356/04/3.html?Ad=1&


    It mentioned TDI.sys in the dump log, would that be the corrupt file?
    Step 5) randomly swap out hardware hoping to change the enviroment enough to make it stop
    I see you are skipping striaght to step 5. If i could have guessed at which driver, i would have. You can play go fish with the software and maybe change the enviroment enough to make it stop crashing, but thats the act of a desperate man. Your chances of success are exactly between 0 and 100% with an untargeted fishing expidition.

    If you can handle the frequency of the crashes for 6 months, then that certainly is an option. I would take regular full system state backups. All those crashes, you are bound to corrupt something.
     
  11. 2005/01/11
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    Yeah, I seem to take my frustrations out on most help desks these days based on the experiences I have had with Veritas and HP. Although I haven't called Microsoft's HD much, I haven't had any real problem with it thus far. I just generalize.

    Thanks for that, I saw a few acronyms pop up while googling but didn't find any real solid reading. I saw "Page Table Entries ", still unsure if that is correct but I will read those two links and perhaps one day buy the book, there are a few others I would like to purchase.

    I did no such thing, well at least not on purpose. I saw TDI.sys in the dump file and googled around beforehand and any reference I saw seemed to point at network. You mentioned a driver corrupted the PTE table, so I was curious as to if it could have been network drivers... I was in no way planning on changing any hardware on the system. I do believe it is software or perhaps memory issues. However it is looking more and more software related.

    Yeah we have been dealing with them for a while now and have been doing full backups every night with a 2 week rotation. This includes the system state and once a week a tape is taken off site. We feel the same way, eventually we foresee it not coming back up after one of these crashes. It already corrupted the registry once. However they have deadlines and don't want us to touch the server.

    I'll read those two links and let you know if I have any more questions.

    Thanks,
    Jason
     
  12. 2005/01/12
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    Here is a second dump Ben, fresh from today, looks slightly different in the debuglog, however the bugcheck is the same.

    Opened log file 'c:\debuglog.txt'
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

    Microsoft (R) Windows Debugger Version 6.3.0017.0
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\MEMORY.DMP]
    Kernel Complete Dump File: Full address space is available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
    Windows Server 2003 Kernel Version 3790 MP (2 procs) Free x86 compatible
    Product: LanManNt, suite: TerminalServer SingleUserTS
    Built by: 3790.srv03_gdr.040410-1234
    Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
    Debug session time: Thu Jan 13 11:34:54 2005
    System Uptime: 3 days 2:11:33.995
    Loading Kernel Symbols
    .....................................................................................................................
    Loading unloaded module list
    .......
    Loading User Symbols
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {8, 2, 0, 804ee997}

    *** ERROR: Symbol file could not be found. Defaulted to export symbols for TmPreFlt.sys -
    Probably caused by : CLASSPNP.SYS ( CLASSPNP!SubmitTransferPacket+86 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v;r;kv;lmtn;.logclose;q
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00000008, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 804ee997, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 00000008

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!ExRemoveHeadNBQueue+61
    804ee997 8b5108 mov edx,[ecx+0x8]

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    LAST_CONTROL_TRANSFER: from 804eec5d to 804ee997

    TRAP_FRAME: f2d6f2d0 -- (.trap fffffffff2d6f2d0)
    .trap fffffffff2d6f2d0
    ErrCode = 00000000
    eax=865e82f0 ebx=865e82f0 ecx=00000000 edx=004cd543 esi=865e5008 edi=865e5010
    eip=804ee997 esp=f2d6f344 ebp=f2d6f370 iopl=0 nv up ei pl nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    nt!ExRemoveHeadNBQueue+0x61:
    804ee997 8b5108 mov edx,[ecx+0x8] ds:0023:00000008=????????
    .trap
    Resetting default scope

    STACK_TEXT:
    f2d6f370 804eec5d 865e82f0 f2d6f38c 86567b00 nt!ExRemoveHeadNBQueue+0x61
    f2d6f3a8 f734946f 863245ec 00000000 00000001 nt!MmMapLockedPagesSpecifyCache+0x104
    f2d6f3dc 8074a4a9 86567a48 85ed2e70 84ca3368 SCSIPORT!SpReceiveScatterGather+0x109
    f2d6f408 f7349340 84ca3368 86567a48 863245d0 hal!HalBuildScatterGatherList+0x1c5
    f2d6f454 804f12db 86567a48 84ca3368 86567b00 SCSIPORT!ScsiPortStartIo+0x368
    f2d6f478 f73495c4 86567a48 85ed2e70 00000000 nt!IoStartPacket+0xa4
    f2d6f4ac f73486f8 86567a48 01ed2f04 85ed20b4 SCSIPORT!ScsiPortFdoDispatch+0x26e
    f2d6f4c4 f7348441 865730e8 85ed2e70 86573030 SCSIPORT!SpDispatchRequest+0x65
    f2d6f4dc f734862a 86573030 85ed2e70 8657fa50 SCSIPORT!ScsiPortPdoScsi+0x128
    f2d6f4ec 804f0473 86573030 85ed2e70 85ed2008 SCSIPORT!ScsiPortGlobalDispatch+0x1a
    f2d6f4fc f731d726 862f5e70 85ed2008 f731d197 nt!IofCallDriver+0x3f
    f2d6f508 f731d197 85ed2008 8656d0e8 862f5f70 CLASSPNP!SubmitTransferPacket+0x86
    f2d6f540 f731d28c 00000000 00001000 862f5e70 CLASSPNP!ServiceTransferRequest+0x1d5
    f2d6f564 804f0473 8656d030 00000000 86576968 CLASSPNP!ClassReadWrite+0x157
    f2d6f574 f74c90e4 863780e8 862f5f94 f2d6f5b0 nt!IofCallDriver+0x3f
    f2d6f584 804f0473 865af850 862f5e70 862f5fb8 PartMgr!PmReadWrite+0x93
    f2d6f594 f73fce6e 862f5e70 8657fb48 e246a410 nt!IofCallDriver+0x3f
    f2d6f5b0 804f0473 86378030 862f5e70 86378670 ftdisk!FtDiskReadWrite+0x194
    f2d6f5c0 f73b15f4 86576db0 e246a410 863785b8 nt!IofCallDriver+0x3f
    f2d6f5d8 804f0473 863785b8 862f5e70 862f5e70 volsnap!VolSnapRead+0x26
    f2d6f5e8 f726206e f2d6f8cc f2d6f7cc f7261941 nt!IofCallDriver+0x3f
    f2d6f5f4 f7261941 f2d6f8cc 863785b8 f9c5e000 Ntfs!NtfsSingleAsync+0x96
    f2d6f7cc f72640f8 f2d6f8cc 862f5e70 e246a410 Ntfs!NtfsNonCachedIo+0x2db
    f2d6f8b8 f7264040 f2d6f8cc 862f5e70 00000001 Ntfs!NtfsCommonRead+0xaf1
    f2d6fa60 804f0473 86184340 862f5e70 85f06f38 Ntfs!NtfsFsdRead+0x20f
    f2d6fa70 f52d1668 804f0473 862c48c8 862f5e70 nt!IofCallDriver+0x3f
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f2d6fa98 80508fa9 862c48c8 86324508 863245b0 TmPreFlt!TmpSetFilterNet+0x11a
    f2d6fab8 80509286 85dc1900 863245d0 863245b0 nt!IoPageRead+0x19
    f2d6fb38 804f4c21 00000001 dfb7f000 c037edfc nt!MiDispatchFault+0x939
    f2d6fb94 80507494 00000000 dfb7f000 00000000 nt!MmAccessFault+0x5ca
    f2d6fbc0 8059fbe8 dfb7f000 00000001 f2d6fd04 nt!MmCheckCachedPageState+0x41d
    f2d6fc50 f728ab23 85dc1900 01c7f000 00001000 nt!CcFastCopyRead+0x346
    f2d6fca8 f52d3a7b 85dc1900 f2d6fd04 00001000 Ntfs!NtfsCopyReadA+0x1bf
    f2d6fcd0 f4327cc0 85dc1900 f2d6fd04 00001000 TmPreFlt!TmpAddRdr+0x1d3b
    f2d6fd78 f4312854 85c44f98 862ccb60 f4326c47 srv!SrvSmbReadAndX+0x689
    f2d6fd84 f4326c47 00000000 86254568 00000000 srv!SrvProcessSmb+0xb5
    f2d6fdac 80596ffe 002ccb60 00000000 00000000 srv!WorkerThread+0x136
    f2d6fddc 805008c6 f4326b80 862ccb60 00000000 nt!PspSystemThreadStartup+0x2e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    FOLLOWUP_IP:
    CLASSPNP!SubmitTransferPacket+86
    f731d726 5f pop edi

    SYMBOL_STACK_INDEX: b

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: CLASSPNP!SubmitTransferPacket+86

    MODULE_NAME: CLASSPNP

    IMAGE_NAME: CLASSPNP.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 3e800766

    STACK_COMMAND: .trap fffffffff2d6f2d0 ; kb

    BUCKET_ID: 0xA_CLASSPNP!SubmitTransferPacket+86

    Followup: MachineOwner
    ---------

    eax=ffdff13c ebx=0000000a ecx=86254568 edx=40000000 esi=ffdff120 edi=00000008
    eip=80543ac9 esp=f2d6f29c ebp=f2d6f2b4 iopl=0 nv up ei ng nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
    nt!KeBugCheckEx+0x19:
    80543ac9 5d pop ebp
    ChildEBP RetAddr Args to Child
    f2d6f2b4 804e2f58 0000000a 00000008 00000002 nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo])
    f2d6f2b4 804ee997 0000000a 00000008 00000002 nt!KiTrap0E+0x224 (FPO: [0,0] TrapFrame @ f2d6f2d0)
    f2d6f370 804eec5d 865e82f0 f2d6f38c 86567b00 nt!ExRemoveHeadNBQueue+0x61 (FPO: [Non-Fpo])
    f2d6f3a8 f734946f 863245ec 00000000 00000001 nt!MmMapLockedPagesSpecifyCache+0x104 (FPO: [Non-Fpo])
    f2d6f3dc 8074a4a9 86567a48 85ed2e70 84ca3368 SCSIPORT!SpReceiveScatterGather+0x109 (FPO: [Non-Fpo])
    f2d6f408 f7349340 84ca3368 86567a48 863245d0 hal!HalBuildScatterGatherList+0x1c5 (FPO: [Non-Fpo])
    f2d6f454 804f12db 86567a48 84ca3368 86567b00 SCSIPORT!ScsiPortStartIo+0x368 (FPO: [Non-Fpo])
    f2d6f478 f73495c4 86567a48 85ed2e70 00000000 nt!IoStartPacket+0xa4 (FPO: [Non-Fpo])
    f2d6f4ac f73486f8 86567a48 01ed2f04 85ed20b4 SCSIPORT!ScsiPortFdoDispatch+0x26e (FPO: [Non-Fpo])
    f2d6f4c4 f7348441 865730e8 85ed2e70 86573030 SCSIPORT!SpDispatchRequest+0x65 (FPO: [2,0,0])
    f2d6f4dc f734862a 86573030 85ed2e70 8657fa50 SCSIPORT!ScsiPortPdoScsi+0x128 (FPO: [2,0,0])
    f2d6f4ec 804f0473 86573030 85ed2e70 85ed2008 SCSIPORT!ScsiPortGlobalDispatch+0x1a (FPO: [2,0,0])
    f2d6f4fc f731d726 862f5e70 85ed2008 f731d197 nt!IofCallDriver+0x3f (FPO: [0,0,0])
    f2d6f508 f731d197 85ed2008 8656d0e8 862f5f70 CLASSPNP!SubmitTransferPacket+0x86 (FPO: [1,0,0])
    f2d6f540 f731d28c 00000000 00001000 862f5e70 CLASSPNP!ServiceTransferRequest+0x1d5 (FPO: [Non-Fpo])
    f2d6f564 804f0473 8656d030 00000000 86576968 CLASSPNP!ClassReadWrite+0x157 (FPO: [Non-Fpo])
    f2d6f574 f74c90e4 863780e8 862f5f94 f2d6f5b0 nt!IofCallDriver+0x3f (FPO: [0,0,0])
    f2d6f584 804f0473 865af850 862f5e70 862f5fb8 PartMgr!PmReadWrite+0x93 (FPO: [Non-Fpo])
    f2d6f594 f73fce6e 862f5e70 8657fb48 e246a410 nt!IofCallDriver+0x3f (FPO: [0,0,0])
    f2d6f5b0 804f0473 86378030 862f5e70 86378670 ftdisk!FtDiskReadWrite+0x194 (FPO: [Non-Fpo])
    start end module name
    804de000 80745000 nt ntkrnlmp.exe Thu May 27 10:32:57 2004 (40B53739)
    80745000 8076d000 hal halmacpi.dll Tue Mar 25 18:07:28 2003 (3E800030)
    bf800000 bf9c7000 win32k win32k.sys Tue Aug 10 08:48:07 2004 (4117FF27)
    bf9c7000 bfa1d680 ati2drad ati2drad.dll Tue Mar 25 20:43:37 2003 (3E8024C9)
    bff80000 bff96000 dxg dxg.sys Tue Mar 25 20:46:23 2003 (3E80256F)
    f2c1c000 f2c51000 netbt netbt.sys Sat Jul 19 03:16:03 2003 (3F182B53)
    f2c6b000 f2c83000 Cdfs Cdfs.SYS Tue Mar 25 19:17:19 2003 (3E80108F)
    f2c83000 f2c96000 Fips Fips.SYS Tue Mar 25 19:54:59 2003 (3E801963)
    f2db1000 f2dd8140 dump_LsiCsb6 dump_LsiCsb6.sys Fri Aug 01 06:38:06 2003 (3F297E2E)
    f2f43000 f2f74500 TmXPFlt TmXPFlt.sys Tue Mar 30 19:35:10 2004 (40693F4E)
    f2f75000 f2fa4000 afd afd.sys Tue Mar 25 18:40:50 2003 (3E800802)
    f2fa4000 f2fcf000 rdbss rdbss.sys Tue Oct 12 10:38:09 2004 (416B2771)
    f3b64000 f3b6d000 dump_diskdump dump_diskdump.sys Tue Mar 25 18:05:15 2003 (3E7FFFAB)
    f3d44000 f3d71000 Fastfat Fastfat.SYS Tue Mar 25 19:00:16 2003 (3E800C90)
    f4019000 f403b000 RDPWD RDPWD.SYS Tue Mar 25 18:03:00 2003 (3E7FFF24)
    f4103000 f415b000 HTTP HTTP.sys Tue Mar 25 19:55:21 2003 (3E801979)
    f430f000 f436e000 srv srv.sys Tue Mar 25 19:49:51 2003 (3E80182F)
    f436e000 f4450fa0 VSApiNt VSApiNt.sys Tue Mar 30 19:12:36 2004 (40693A04)
    f4451000 f44bc000 mrxsmb mrxsmb.sys Tue Oct 12 10:38:12 2004 (416B2774)
    f48dc000 f48e3000 sysmgmt sysmgmt.sys Tue May 04 11:09:22 2004 (4096ED42)
    f4b45000 f4ba7000 tcpip tcpip.sys Tue Mar 25 19:04:01 2003 (3E800D71)
    f4bde000 f4bfa000 ipsec ipsec.sys Tue Mar 25 18:55:45 2003 (3E800B81)
    f4c0c000 f4c3e680 UdfReadr_xp UdfReadr_xp.SYS Wed Dec 18 07:27:56 2002 (3DFF88CC)
    f4c79000 f4cb3e80 cdudf_xp cdudf_xp.SYS Tue Feb 04 09:23:00 2003 (3E3EEBC4)
    f4d57000 f4d5e000 parvdm parvdm.sys Tue Mar 25 18:03:49 2003 (3E7FFF55)
    f50be000 f50cb000 wanarp wanarp.sys Tue Mar 25 18:11:22 2003 (3E80011A)
    f52d1000 f52d6180 TmPreFlt TmPreFlt.sys Tue Mar 30 19:35:08 2004 (40693F4C)
    f52f9000 f5308000 msgpc msgpc.sys Tue Mar 25 18:10:12 2003 (3E8000D4)
    f5309000 f5315000 Npfs Npfs.SYS Tue Mar 25 18:08:59 2003 (3E80008B)
    f5319000 f5323000 Msfs Msfs.SYS Tue Mar 25 18:08:56 2003 (3E800088)
    f5329000 f5333000 TDTCP TDTCP.SYS Tue Mar 25 18:02:52 2003 (3E7FFF1C)
    f5339000 f5346000 netbios netbios.sys Tue Mar 25 18:09:53 2003 (3E8000C1)
    f5369000 f5373000 Dxapi Dxapi.sys Tue Mar 25 18:06:01 2003 (3E7FFFD9)
    f55cf000 f55d7000 rasacd rasacd.sys Tue Mar 25 18:11:50 2003 (3E800136)
    f5cdd000 f5cf0000 usbhub usbhub.sys Tue Mar 25 18:10:46 2003 (3E8000F6)
    f5d2e000 f5d61000 update update.sys Tue Mar 25 19:59:59 2003 (3E801A8F)
    f5d81000 f5db5000 rdpdr rdpdr.sys Tue Mar 25 18:09:30 2003 (3E8000AA)
    f5df2000 f5e07000 raspptp raspptp.sys Tue Mar 25 19:19:09 2003 (3E8010FD)
    f5e34000 f5e4f000 ndiswan ndiswan.sys Tue Mar 25 19:48:19 2003 (3E8017D3)
    f5e95000 f5eac000 rasl2tp rasl2tp.sys Tue Mar 25 18:54:46 2003 (3E800B46)
    f5eac000 f5ecde80 USBPORT USBPORT.SYS Tue Mar 25 18:10:43 2003 (3E8000F3)
    f5f79000 f5f87000 raspppoe raspppoe.sys Tue Mar 25 18:11:37 2003 (3E800129)
    f5fb9000 f5fc4000 TDI TDI.SYS Tue Mar 25 18:14:28 2003 (3E8001D4)
    f6049000 f6061000 serial serial.sys Tue Mar 25 18:40:08 2003 (3E8007D8)
    f6061000 f6078000 parport parport.sys Tue Mar 25 18:03:56 2003 (3E7FFF5C)
    f60b4000 f60ca000 i8042prt i8042prt.sys Tue Mar 25 20:01:43 2003 (3E801AF7)
    f649a000 f64b7fa0 pwd_2k pwd_2k.SYS Wed Dec 18 07:29:40 2002 (3DFF8934)
    f6757000 f6776d00 ks ks.sys Thu Dec 05 04:09:38 2002 (3DEE36D2)
    f67bf000 f67c48a0 mmc_2K mmc_2K.SYS Wed Dec 18 07:29:42 2002 (3DFF8936)
    f68b5000 f68bf000 mouclass mouclass.sys Tue Mar 25 18:03:09 2003 (3E7FFF2D)
    f68c5000 f68d1000 vga vga.sys Tue Mar 25 18:08:03 2003 (3E800053)
    f68d5000 f68df000 flpydisk flpydisk.sys Tue Mar 25 18:04:32 2003 (3E7FFF80)
    f6905000 f690f000 kbdclass kbdclass.sys Tue Mar 25 18:03:10 2003 (3E7FFF2E)
    f6925000 f692e000 ndistapi ndistapi.sys Tue Mar 25 18:11:28 2003 (3E800120)
    f6ada000 f6aee000 redbook redbook.sys Tue Mar 25 18:04:38 2003 (3E7FFF86)
    f6b73000 f6b87000 cdrom cdrom.sys Tue Mar 25 18:05:18 2003 (3E7FFFAE)
    f6d26000 f6d31000 fdc fdc.sys Tue Mar 25 18:04:31 2003 (3E7FFF7F)
    f6d36000 f6d3f000 raspti raspti.sys Tue Mar 25 18:11:36 2003 (3E800128)
    f6d46000 f6d54000 imapi imapi.sys Tue Mar 25 18:05:45 2003 (3E7FFFC9)
    f6da6000 f6db0000 serenum serenum.sys Tue Mar 25 18:04:01 2003 (3E7FFF61)
    f6f9c000 f6fe8000 cpqasm cpqasm.sys Tue May 04 11:09:15 2004 (4096ED3B)
    f6fe8000 f7003a00 q57xp32 q57xp32.sys Tue Feb 03 13:19:08 2004 (401F051C)
    f7004000 f701d000 VIDEOPRT VIDEOPRT.SYS Tue Mar 25 18:08:02 2003 (3E800052)
    f701d000 f7070d80 ati2mpad ati2mpad.sys Fri Jul 19 11:13:20 2002 (3D3767B0)
    f71fb000 f721d000 Mup Mup.sys Tue Mar 25 19:55:58 2003 (3E80199E)
    f721d000 f725e000 NDIS NDIS.sys Tue Mar 25 19:45:35 2003 (3E80172F)
    f725e000 f72fa000 Ntfs Ntfs.sys Wed Aug 11 08:44:27 2004 (41194FCB)
    f72fa000 f731b000 KSecDD KSecDD.sys Tue Mar 25 18:05:39 2003 (3E7FFFC3)
    f731b000 f7331000 CLASSPNP CLASSPNP.SYS Tue Mar 25 18:38:14 2003 (3E800766)
    f7331000 f7345f00 adpu160m adpu160m.sys Fri Feb 14 11:43:45 2003 (3E4C3BC1)
    f7346000 f736c000 SCSIPORT SCSIPORT.SYS Tue Mar 25 19:01:25 2003 (3E800CD5)
    f736c000 f7393140 LsiCsb6 LsiCsb6.sys Fri Aug 01 06:38:06 2003 (3F297E2E)
    f7394000 f73b0000 atapi atapi.sys Tue Mar 25 18:04:48 2003 (3E7FFF90)
    f73b0000 f73d1000 volsnap volsnap.sys Tue Mar 25 18:05:47 2003 (3E7FFFCB)
    f73d1000 f73fb000 dmio dmio.sys Tue Mar 25 18:08:14 2003 (3E80005E)
    f73fb000 f7420000 ftdisk ftdisk.sys Tue Mar 25 18:05:26 2003 (3E7FFFB6)
    f7420000 f7435000 pci pci.sys Tue Mar 25 18:16:40 2003 (3E800258)
    f7435000 f7466000 ACPI ACPI.sys Tue Mar 25 18:16:21 2003 (3E800245)
    f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 18:13:00 2003 (3E80017C)
    f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 18:16:35 2003 (3E800253)
    f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Tue Mar 25 18:04:44 2003 (3E7FFF8C)
    f74b7000 f74c6000 MountMgr MountMgr.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
    f74c7000 f74d5000 PartMgr PartMgr.sys Tue Mar 25 19:04:02 2003 (3E800D72)
    f74d7000 f74df080 symc8xx symc8xx.sys Wed Sep 26 04:25:49 2001 (3BB0CC2D)
    f74e7000 f74f7000 symmpi symmpi.sys Thu May 27 02:30:13 2004 (40B4C615)
    f74f7000 f7506000 disk disk.sys Tue Mar 25 18:05:20 2003 (3E7FFFB0)
    f7507000 f7513000 Dfs Dfs.sys Tue Mar 25 18:09:52 2003 (3E8000C0)
    f7517000 f7520000 crcdisk crcdisk.sys Tue Mar 25 18:07:23 2003 (3E80002B)
    f7587000 f7592000 ptilink ptilink.sys Tue Mar 25 18:03:51 2003 (3E7FFF57)
    f7597000 f75a1000 TAPE TAPE.SYS Tue Mar 25 18:05:25 2003 (3E7FFFB5)
    f7607000 f7615ee0 Cdr4_xp Cdr4_xp.SYS Wed Dec 18 07:32:57 2002 (3DFF89F9)
    f7647000 f7653000 processr processr.sys Tue Mar 25 18:07:36 2003 (3E800038)
    f7657000 f7660000 watchdog watchdog.sys Tue Mar 25 18:09:01 2003 (3E80008D)
    f7697000 f76a5000 NDProxy NDProxy.SYS Tue Mar 25 18:11:30 2003 (3E800122)
    f76b7000 f76c6000 termdd termdd.sys Tue Mar 25 18:02:52 2003 (3E7FFF1C)
    f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 18:08:00 2003 (3E800050)
    f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 18:07:58 2003 (3E80004E)
    f7717000 f771e000 pciide pciide.sys Tue Mar 25 18:04:46 2003 (3E7FFF8E)
    f771f000 f7726000 dmload dmload.sys Tue Mar 25 18:08:08 2003 (3E800058)
    f7727000 f772e080 sym_hi sym_hi.sys Thu Oct 04 09:48:12 2001 (3BBBA3BC)
    f772f000 f7737000 cpqcissm cpqcissm.sys Sat Dec 07 14:37:01 2002 (3DF16CDD)
    f7787000 f778f000 RDPCDD RDPCDD.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
    f77d7000 f77dc560 Cdralw2k Cdralw2k.SYS Wed Dec 18 07:32:44 2002 (3DFF89EC)
    f77e7000 f77ee000 dxgthk dxgthk.sys Tue Mar 25 18:05:52 2003 (3E7FFFD0)
    f7827000 f782b200 usbohci usbohci.sys Tue Mar 25 18:10:41 2003 (3E8000F1)
    f7837000 f783f000 Fs_Rec Fs_Rec.SYS Tue Mar 25 18:08:36 2003 (3E800074)
    f783f000 f7846000 Null Null.SYS Tue Mar 25 18:03:05 2003 (3E7FFF29)
    f7847000 f784e000 Beep Beep.SYS Tue Mar 25 18:03:04 2003 (3E7FFF28)
    f784f000 f7857000 OPRGHDLR OPRGHDLR.SYS Tue Mar 25 18:16:25 2003 (3E800249)
    f7857000 f785f000 audstub audstub.sys Tue Mar 25 18:09:12 2003 (3E800098)
    f787f000 f7887000 mnmdd mnmdd.SYS Tue Mar 25 18:07:53 2003 (3E800049)
    f7897000 f7899800 compbatt compbatt.sys Tue Mar 25 18:16:28 2003 (3E80024C)
    f789b000 f789e880 BATTC BATTC.SYS Tue Mar 25 18:16:20 2003 (3E800244)
    f789f000 f78a2f80 symc810 symc810.sys Sat Dec 09 04:40:59 2000 (3A311D2B)
    f78a3000 f78a6460 cpqarry2 cpqarry2.sys Tue Nov 06 08:47:33 2001 (3BE708F5)
    f79f5000 f79f6b80 hpdat hpdat.sys Fri Jan 24 05:49:39 2003 (3E303943)
    f7a3f000 f7a40580 USBD USBD.SYS Tue Mar 25 18:10:39 2003 (3E8000EF)
    f7b72000 f7b73000 swenum swenum.sys Thu Dec 05 04:10:07 2002 (3DEE36EF)

    Unloaded modules:
    f3b04000 f3b0d000 dump_scsipor
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f2db1000 f2dd9000 dump_LsiCsb6
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f300a000 f3013000 dump_scsipor
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f2db1000 f2dd9000 dump_LsiCsb6
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f79bd000 f79bf000 cqdetect.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f7aaf000 f7ab0000 MemRWNT.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f782f000 f7837000 Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    Closing open log file c:\debuglog.txt

    Regards,
    Jason
     
  13. 2005/01/12
    JoeHobart

    JoeHobart Inactive Alumni

    Joined:
    2004/05/19
    Messages:
    919
    Likes Received:
    1
    Same thing, different dump
     
  14. 2005/01/12
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    So the Classpnp/tdi doesn't mean anything it's only the stack references?

    Regards,
    Jason
     
  15. 2005/01/12
    JoeHobart

    JoeHobart Inactive Alumni

    Joined:
    2004/05/19
    Messages:
    919
    Likes Received:
    1
    its just a victim, has nothing to do with it.

    yes, that list of function calls is called a 'stack'.
     
  16. 2005/01/12
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    Alright thanks Joe, I will update if it crashes with anything alternate.

    Regards,
    Jason
     
  17. 2005/01/19
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    Crashed twice yesterday with the 8E bug check first, I wasn't able to get the dump data of that though.

    However got a 24 bug check, which is the following:
    0x00000024 (0x00190329, 0xF78C1F70, 0xF78C1BC0, 0x804EE997)

    Below is the dump:

    It still refers to the same two culprits it seems, however it is a new bug check and I figured it may have some different data.

    Regards,
    Jason
     
    Last edited: 2005/01/19
  18. 2005/01/19
    BenMcDonald[MS]

    BenMcDonald[MS] Inactive

    Joined:
    2004/12/14
    Messages:
    228
    Likes Received:
    0
    This is the same thing. There is no additional information dumps are going to tell us until you enable the guarding i referenced above in post #7.
     
  19. 2005/01/19
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    Yeah, I will hopefully be able to do that sometime soon, I just don't want to implement it while I am not there at the actual site.

    Regards,
    Jason
     
  20. 2005/01/20
    Rothgar

    Rothgar Inactive Thread Starter

    Joined:
    2005/01/09
    Messages:
    31
    Likes Received:
    0
    Thought I'd post this last bugcheck I got today. It is the 8E:
    0x0000008E (0xC00000005, 0x804EE997, 0xF3DA9ABC, 0x00000000)

    Perhaps it has new data, looks to reference back to the same information though. It will add information I guess to anyone new that it shows as multiple bug checks.

    I should be able to play with the server after today, we are moving the content to another box and will change the login maps to that machine.

    Below is the dump data:


    Regards,
    Jason
     
    Last edited: 2005/01/20
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.