Jump to content

Started Getting Lots of 1003 Events with Stop Errors - What is Cau

Guest Travis

By Guest Travis
in Windows 2003 Server

 Share

Recommended Posts

Guest Travis

Guest Travis

Posted
Posted

Error code 0000000a, parameter1 cc2c2b1c, parameter2 d0000002, parameter3

00000000, parameter4 8080f5b6.

 

Error code 0000000a, parameter1 00000005, parameter2 d0000002, parameter3

00000000, parameter4 8080f5db.

 

Error code 1000007e, parameter1 c0000005, parameter2 f7b9b93c, parameter3

b63b8c30, parameter4 b63b892c.

 

When these occur the server just reboots. I have looked at the minidumps

and those aren't telling me much. Please Help.

 

Travis

  • Replies 11
  • Created
  • Last Reply

Popular Days

Popular Days

Guest Travis

Guest Travis

Posted
Posted

RE: Started Getting Lots of 1003 Events with Stop Errors - What is Cau

 

Anyone? Please Help!

Guest Travis

Guest Travis

Posted
Posted

RE: Started Getting Lots of 1003 Events with Stop Errors - What is

 

RE: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Pretty Please!!! I need some help.

Guest John John

Guest John John

Posted
Posted

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

My guess is that the 0x0a and 0x7e errors are caused by bad driver(s) or

bad RAM. If you enable and run Driver Verifier you may find more

information. Disable the Automatically Reboot on failure option and

after you enable Verifier reboot the machine and see if it gives you a

BSOD and a driver file name. As for the Event ID 1003, what is the

source of the error?

 

John

 

Travis wrote:

> Pretty Please!!! I need some help.

>

Guest Travis

Guest Travis

Posted
Posted

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Thank you so much for responding!!

 

1. How do I run Driver Verifier.

2. The Source is System Error, Category is (102).

3. I am going to take the server down tonight if it makes it that far and

run some diags on the RAM and other hardware. I was thinking about doing a

chkdsk /f as well.

 

Any other ideas?

 

"John John" wrote:

> My guess is that the 0x0a and 0x7e errors are caused by bad driver(s) or

> bad RAM. If you enable and run Driver Verifier you may find more

> information. Disable the Automatically Reboot on failure option and

> after you enable Verifier reboot the machine and see if it gives you a

> BSOD and a driver file name. As for the Event ID 1003, what is the

> source of the error?

>

> John

>

> Travis wrote:

>

> > Pretty Please!!! I need some help.

> >

>

>

Guest Travis

Guest Travis

Posted
Posted

RE: Started Getting Lots of 1003 Events with Stop Errors - What is Cau

 

Here is a redout of one of the minidump files - different everytime though.

Iw ill psot the others too.

 

1: kd> !analyze -v

*******************************************************************************

*

*

* Bugcheck Analysis

*

*

*

*******************************************************************************

 

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: 808f8157, The address that the exception occurred at

Arg3: b4668bc0, Exception Record Address

Arg4: b46688bc, Context Record Address

 

Debugging Details:

------------------

 

 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"

referenced memory at "0x%08lx". The memory could not be "%s".

 

FAULTING_IP:

nt!RtlUpcaseUnicodeToOemN+709

808f8157 83782c14 cmp dword ptr [eax+2Ch],14h

 

EXCEPTION_RECORD: b4668bc0 -- (.exr 0xffffffffb4668bc0)

ExceptionAddress: 808f8157 (nt!RtlUpcaseUnicodeToOemN+0x00000709)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000000

Parameter[1]: 0000002c

Attempt to read from address 0000002c

 

CONTEXT: b46688bc -- (.cxr 0xffffffffb46688bc)

eax=00000000 ebx=e51606a8 ecx=00004b36 edx=000001c8 esi=000000c8 edi=86d90798

eip=808f8157 esp=b4668c88 ebp=b4668cd0 iopl=0 nv up ei pl nz na po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202

nt!RtlUpcaseUnicodeToOemN+0x709:

808f8157 83782c14 cmp dword ptr [eax+2Ch],14h

ds:0023:0000002c=00000000

Resetting default scope

 

CUSTOMER_CRASH_COUNT: 1

 

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced

memory at "0x%08lx". The memory could not be "%s".

 

READ_ADDRESS: 0000002c

 

BUGCHECK_STR: 0x7E

 

EXCEPTION_STR: 0x0

 

LAST_CONTROL_TRANSFER: from 808ea1b0 to 808f8157

 

STACK_TEXT:

b4668cd0 808ea1b0 86d90798 00000001 00000001 nt!RtlUpcaseUnicodeToOemN+0x709

b4668d04 8080fca9 86d90798 b4668d3c 808a3ff0 nt!PspQueryQuotaLimits+0x5c

b4668d40 808127a2 86cc7b98 808ae5c0 8a393298 nt!CcExtendVacbArray+0x9

b4668d80 8088043d 8a393298 00000000 86cc7b98 nt!FsRtlFastCheckLockForRead+0x3a

b4668dac 80949b7c 8a393298 00000000 00000000 nt!VerifierIrqlData+0x3d

b4668ddc 8088e062 80880352 80000000 00000000 nt!CmpPrefetchHiveFile+0x4e

b4668e84 00000000 00000000 00000000 00000000 nt!IoReadPartitionTable+0x1f2

 

 

FOLLOWUP_IP:

nt!RtlUpcaseUnicodeToOemN+709

808f8157 83782c14 cmp dword ptr [eax+2Ch],14h

 

SYMBOL_STACK_INDEX: 0

 

SYMBOL_NAME: nt!RtlUpcaseUnicodeToOemN+709

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: nt

 

IMAGE_NAME: ntkrnlpa.exe

 

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

 

STACK_COMMAND: .cxr 0xffffffffb46688bc ; kb

 

FAILURE_BUCKET_ID: 0x7E_nt!RtlUpcaseUnicodeToOemN+709

 

BUCKET_ID: 0x7E_nt!RtlUpcaseUnicodeToOemN+709

 

Followup: MachineOwner

---------

Guest Mathieu CHATEAU

Guest Mathieu CHATEAU

Posted
Posted

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Hello,

 

How to Use Driver Verifier to Troubleshoot Windows Drivers

http://support.microsoft.com/kb/244617/en-us

 

Download:

http://www.microsoft.com/whdc/DevTools/tools/DrvVerifier.mspx

 

 

--

Cordialement,

Mathieu CHATEAU

English blog: http://lordoftheping.blogspot.com

French blog: http://www.lotp.fr

 

 

"Travis" <Travis@discussions.microsoft.com> wrote in message

news:46FE9750-678A-497E-8A80-1CD3AF821CCE@microsoft.com...

> Thank you so much for responding!!

>

> 1. How do I run Driver Verifier.

> 2. The Source is System Error, Category is (102).

> 3. I am going to take the server down tonight if it makes it that far and

> run some diags on the RAM and other hardware. I was thinking about doing

> a

> chkdsk /f as well.

>

> Any other ideas?

>

> "John John" wrote:

>

>> My guess is that the 0x0a and 0x7e errors are caused by bad driver(s) or

>> bad RAM. If you enable and run Driver Verifier you may find more

>> information. Disable the Automatically Reboot on failure option and

>> after you enable Verifier reboot the machine and see if it gives you a

>> BSOD and a driver file name. As for the Event ID 1003, what is the

>> source of the error?

>>

>> John

>>

>> Travis wrote:

>>

>> > Pretty Please!!! I need some help.

>> >

>>

>>

Guest Travis

Guest Travis

Posted
Posted

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Here's another:

0: kd> !analyze -v

*******************************************************************************

*

*

* Bugcheck Analysis

*

*

*

*******************************************************************************

 

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: cc2c2b1c, memory referenced

Arg2: d0000002, IRQL

Arg3: 00000000, bitfield :

bit 0 : value 0 = read operation, 1 = write operation

bit 3 : value 0 = not an execute operation, 1 = execute operation (only on

chips which support this level of status)

Arg4: 8080f5b6, address which referenced memory

 

Debugging Details:

------------------

 

 

READ_ADDRESS: cc2c2b1c

 

CURRENT_IRQL: d0000002

 

FAULTING_IP:

nt!CcGetBcbListHeadLargeOffset+13c

8080f5b6 ?? ???

 

CUSTOMER_CRASH_COUNT: 3

 

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

 

BUGCHECK_STR: 0xA

 

LAST_CONTROL_TRANSFER: from 8080f5b6 to 8088c963

 

STACK_TEXT:

f78dac1c 8080f5b6 badb0d00 00000000 87b58bf8 nt!FsRtlNotifyCleanup+0x47

f78dacfc 8080fc56 8864a224 00000000 00000001

nt!CcGetBcbListHeadLargeOffset+0x13c

f78dad40 808127a2 8a394660 808ae5c0 8a3880b0 nt!CcReferenceFileOffset+0x5c

f78dad80 8088043d 8a3880b0 00000000 8a394660 nt!FsRtlFastCheckLockForRead+0x3a

f78dadac 80949b7c 8a3880b0 00000000 00000000 nt!VerifierIrqlData+0x3d

f78daddc 8088e062 80880352 00000000 00000000 nt!CmpPrefetchHiveFile+0x4e

f78dae84 00000000 00000000 00000000 00000000 nt!IoReadPartitionTable+0x1f2

 

 

STACK_COMMAND: kb

 

FOLLOWUP_IP:

nt!CcGetBcbListHeadLargeOffset+13c

8080f5b6 ?? ???

 

SYMBOL_STACK_INDEX: 1

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: nt

 

IMAGE_NAME: ntkrnlpa.exe

 

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

 

SYMBOL_NAME: nt!CcGetBcbListHeadLargeOffset+13c

 

FAILURE_BUCKET_ID: 0xA_nt!CcGetBcbListHeadLargeOffset+13c

 

BUCKET_ID: 0xA_nt!CcGetBcbListHeadLargeOffset+13c

 

Followup: MachineOwner

---------

Guest Travis

Guest Travis

Posted
Posted

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

And another - all of these are within yesterday and today:

0: kd> !analyze -v

*******************************************************************************

*

*

* Bugcheck Analysis

*

*

*

*******************************************************************************

 

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 00000005, memory referenced

Arg2: d0000002, IRQL

Arg3: 00000000, bitfield :

bit 0 : value 0 = read operation, 1 = write operation

bit 3 : value 0 = not an execute operation, 1 = execute operation (only on

chips which support this level of status)

Arg4: 8080f5db, address which referenced memory

 

Debugging Details:

------------------

 

 

READ_ADDRESS: 00000005

 

CURRENT_IRQL: d0000002

 

FAULTING_IP:

nt!CcGetVacbLargeOffset+1d

8080f5db ?? ???

 

CUSTOMER_CRASH_COUNT: 2

 

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

 

BUGCHECK_STR: 0xA

 

LAST_CONTROL_TRANSFER: from 8080f5db to 8088c963

 

STACK_TEXT:

f78d2c1c 8080f5db badb0d00 00000000 8a1bb7a0 nt!FsRtlNotifyCleanup+0x47

f78d2cfc 8080fc56 899cee2c 00000000 00000001 nt!CcGetVacbLargeOffset+0x1d

f78d2d40 808127a2 8a394b40 808ae5c0 8a3911e0 nt!CcReferenceFileOffset+0x5c

f78d2d80 8088043d 8a3911e0 00000000 8a394b40 nt!FsRtlFastCheckLockForRead+0x3a

f78d2dac 80949b7c 8a3911e0 00000000 00000000 nt!VerifierIrqlData+0x3d

f78d2ddc 8088e062 80880352 00000000 00000000 nt!CmpPrefetchHiveFile+0x4e

f78d2e84 00000000 00000000 00000000 00000000 nt!IoReadPartitionTable+0x1f2

 

 

STACK_COMMAND: kb

 

FOLLOWUP_IP:

nt!CcGetVacbLargeOffset+1d

8080f5db ?? ???

 

SYMBOL_STACK_INDEX: 1

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: nt

 

IMAGE_NAME: ntkrnlpa.exe

 

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

 

SYMBOL_NAME: nt!CcGetVacbLargeOffset+1d

 

FAILURE_BUCKET_ID: 0xA_nt!CcGetVacbLargeOffset+1d

 

BUCKET_ID: 0xA_nt!CcGetVacbLargeOffset+1d

 

Followup: MachineOwner

---------

Guest Travis

Guest Travis

Posted
Posted

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Excellent - I will give this a go when I take the machein down later today.

Guest Travis

Guest Travis

Posted
Posted

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Alos, I too thought of remving the checkmark so it doesn't auto-reboot.

Hopefully that will make it so I see the BSOD nest time it happens.

Guest John John

Guest John John

Posted
Posted

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

Re: Started Getting Lots of 1003 Events with Stop Errors - What is

 

http://msdn2.microsoft.com/en-us/library/ms792872.aspx

 

If you get a BSOD when you reboot gather the BSOD information, then you

will have to use the Last Known Good or Safe Mode boot to gain access to

the machine again, where you can then disable Verifier.

 

As for the Event 1003 see if you can find anything in here:

http://www.eventid.net/display.asp?eventid=1003&eventno=1274&source=System&phase=1

 

John

 

Travis wrote:

> Thank you so much for responding!!

>

> 1. How do I run Driver Verifier.

> 2. The Source is System Error, Category is (102).

> 3. I am going to take the server down tonight if it makes it that far and

> run some diags on the RAM and other hardware. I was thinking about doing a

> chkdsk /f as well.

>

> Any other ideas?

>

> "John John" wrote:

>

>

>>My guess is that the 0x0a and 0x7e errors are caused by bad driver(s) or

>>bad RAM. If you enable and run Driver Verifier you may find more

>>information. Disable the Automatically Reboot on failure option and

>>after you enable Verifier reboot the machine and see if it gives you a

>>BSOD and a driver file name. As for the Event ID 1003, what is the

>>source of the error?

>>

>>John

>>

>>Travis wrote:

>>

>>

>>>Pretty Please!!! I need some help.

>>>

>>

>>

 Share
Go to topic listing
×
×
  • Create New...