Guest Snoopy Posted December 3, 2007 Posted December 3, 2007 Dear all, I have Windows 2003 R2 64bit SP2 server, that is experiencing Blue screen olmost every second week, which ends in automatic reboot. The event log that I'm getting is the folowing: Event Type: Error Event Source: System Error Event Category: (102) Event ID: 1003 Date: 11/30/2007 Time: 9:03:51 AM User: N/A Computer: xxxxxx Description: Error code 00000000000000d1, parameter1 0000000000000018, parameter2 0000000000000002, parameter3 0000000000000001, parameter4 fffffadef2622743. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 53 79 73 74 65 6d 20 45 System E 0008: 72 72 6f 72 20 20 45 72 rror Er 0010: 72 6f 72 20 63 6f 64 65 ror code 0018: 20 30 30 30 30 30 30 30 0000000 0020: 30 30 30 30 30 30 30 64 0000000d 0028: 31 20 20 50 61 72 61 6d 1 Param 0030: 65 74 65 72 73 20 30 30 eters 00 0038: 30 30 30 30 30 30 30 30 00000000 0040: 30 30 30 30 31 38 2c 20 000018, 0048: 30 30 30 30 30 30 30 30 00000000 0050: 30 30 30 30 30 30 30 32 00000002 0058: 2c 20 30 30 30 30 30 30 , 000000 0060: 30 30 30 30 30 30 30 30 00000000 0068: 30 31 2c 20 66 66 66 66 01, ffff 0070: 66 61 64 65 66 32 36 32 fadef262 0078: 32 37 34 33 2743 --------------------------------------------------- ---------------------------------------------------- I was able to open the MEMORY.DMP file with folowing information: Any idea waht it may be? Opened log file 'c:\debuglog.txt' 3: kd> .sympath srv*c:\symbols*htt://msdl.microsoft.com/download/symbols Symbol search path is: srv*c:\symbols*htt://msdl.microsoft.com/download/symbols 3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols 3: kd> .reload;!analyze -v;r;thread;lmnt;.logclose;q Loading Kernel Symbols .......................................................................................................................... Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 0000000000000018, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, value 0 = read operation, 1 = write operation Arg4: fffffadef2622743, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: 0000000000000018 CURRENT_IRQL: 2 FAULTING_IP: tcpip!IpDelayedInvalidateOffloadWorker+93 fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xD1 PROCESS_NAME: System TRAP_FRAME: fffffadef668db20 -- (.trap 0xfffffadef668db20) ..trap 0xfffffadef668db20 NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffadf05dd56c8 rbx=fffff800011cda18 rcx=fffffadef668dcd0 rdx=0000000000000000 rsi=0000000000000000 rdi=fffffadf06bc3ce8 rip=fffffadef2622743 rsp=fffffadef668dcb0 rbp=fffffadf029c1950 r8=fffffadef668dcd0 r9=0000000100000000 r10=0000000000000000 r11=fffffadef62bd450 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc tcpip!IpDelayedInvalidateOffloadWorker+0x93: fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax ds:0286:3d00=???????????????? ..trap Resetting default scope LAST_CONTROL_TRANSFER: from fffff8000102e5b4 to fffff8000102e890 STACK_TEXT: fffffade`f668d998 fffff800`0102e5b4 : 00000000`0000000a 00000000`00000018 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffffade`f668d9a0 fffff800`0102d547 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x74 fffffade`f668db20 fffffade`f2622743 : fffffadf`06bc3bf0 fffff800`0125e200 00000000`00000000 fffffade`f626c051 : nt!KiPageFault+0x207 fffffade`f668dcb0 fffff800`010375ca : fffffadf`029c1970 fffffade`f626c010 fffffadf`06bc3bf0 fffff800`011cda18 : tcpip!IpDelayedInvalidateOffloadWorker+0x93 fffffade`f668dd00 fffff800`0124a972 : fffffadf`06bc3bf0 00000000`00000080 fffffadf`06bc3bf0 fffffade`f62a3680 : nt!ExpWorkerThread+0x13b fffffade`f668dd70 fffff800`01020226 : fffffade`f629b180 fffffadf`06bc3bf0 fffffade`f62a3680 fffff800`011b4dc0 : nt!PspSystemThreadStartup+0x3e fffffade`f668ddd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: tcpip!IpDelayedInvalidateOffloadWorker+93 fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: tcpip!IpDelayedInvalidateOffloadWorker+93 FOLLOWUP_NAME: MachineOwner MODULE_NAME: tcpip IMAGE_NAME: tcpip.sys DEBUG_FLR_IMAGE_TIMESTAMP: 45d699a3 FAILURE_BUCKET_ID: X64_0xD1_W_tcpip!IpDelayedInvalidateOffloadWorker+93 BUCKET_ID: X64_0xD1_W_tcpip!IpDelayedInvalidateOffloadWorker+93 Followup: MachineOwner --------- rax=fffffadef668daa0 rbx=fffffadf05e75200 rcx=000000000000000a rdx=0000000000000018 rsi=fffffadf05dd56a0 rdi=0000000000000000 rip=fffff8000102e890 rsp=fffffadef668d998 rbp=fffffadef668dba0 r8=0000000000000002 r9=0000000000000001 r10=fffffadef2622743 r11=fffffadef62bd450 r12=fffffadf029c1950 r13=0000000000000001 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286 nt!KeBugCheckEx: fffff800`0102e890 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffade`f668d9a0=000000000000000a ^ No runnable debuggees error in '.reload;!analyze -v;r;thread;lmnt;.logclose;q'
Guest William Mann Posted December 4, 2007 Posted December 4, 2007 RE: Blue Screnn of Deth Well, the line DRIVER_IRQL_NOT_LESS_OR_EQUAL suggests a problem in a driver, the question, which driver. Try updating your network card drivers, depending on the make/model of your server, I find these are the most likely to be wrong. Hope this helps Will "Snoopy" wrote: > Dear all, > > I have Windows 2003 R2 64bit SP2 server, that is experiencing Blue screen > olmost every second week, which ends in automatic reboot. The event log that > I'm getting is the folowing: > > Event Type: Error > Event Source: System Error > Event Category: (102) > Event ID: 1003 > Date: 11/30/2007 > Time: 9:03:51 AM > User: N/A > Computer: xxxxxx > Description: > Error code 00000000000000d1, parameter1 0000000000000018, parameter2 > 0000000000000002, parameter3 0000000000000001, parameter4 fffffadef2622743. > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. > Data: > 0000: 53 79 73 74 65 6d 20 45 System E > 0008: 72 72 6f 72 20 20 45 72 rror Er > 0010: 72 6f 72 20 63 6f 64 65 ror code > 0018: 20 30 30 30 30 30 30 30 0000000 > 0020: 30 30 30 30 30 30 30 64 0000000d > 0028: 31 20 20 50 61 72 61 6d 1 Param > 0030: 65 74 65 72 73 20 30 30 eters 00 > 0038: 30 30 30 30 30 30 30 30 00000000 > 0040: 30 30 30 30 31 38 2c 20 000018, > 0048: 30 30 30 30 30 30 30 30 00000000 > 0050: 30 30 30 30 30 30 30 32 00000002 > 0058: 2c 20 30 30 30 30 30 30 , 000000 > 0060: 30 30 30 30 30 30 30 30 00000000 > 0068: 30 31 2c 20 66 66 66 66 01, ffff > 0070: 66 61 64 65 66 32 36 32 fadef262 > 0078: 32 37 34 33 2743 > > --------------------------------------------------- > ---------------------------------------------------- > > I was able to open the MEMORY.DMP file with folowing information: > Any idea waht it may be? > > Opened log file 'c:\debuglog.txt' > 3: kd> .sympath srv*c:\symbols*htt://msdl.microsoft.com/download/symbols > Symbol search path is: > srv*c:\symbols*htt://msdl.microsoft.com/download/symbols > 3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols > Symbol search path is: > srv*c:\symbols*http://msdl.microsoft.com/download/symbols > 3: kd> .reload;!analyze -v;r;thread;lmnt;.logclose;q > Loading Kernel Symbols > ......................................................................................................................... > Loading User Symbols > > Loading unloaded module list > ....... > ******************************************************************************* > * > * > * Bugcheck Analysis > * > * > * > ******************************************************************************* > > DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) > An attempt was made to access a pageable (or completely invalid) address at an > interrupt request level (IRQL) that is too high. This is usually > caused by drivers using improper addresses. > If kernel debugger is available get stack backtrace. > Arguments: > Arg1: 0000000000000018, memory referenced > Arg2: 0000000000000002, IRQL > Arg3: 0000000000000001, value 0 = read operation, 1 = write operation > Arg4: fffffadef2622743, address which referenced memory > > Debugging Details: > ------------------ > > > > > > > WRITE_ADDRESS: 0000000000000018 > > CURRENT_IRQL: 2 > > FAULTING_IP: > tcpip!IpDelayedInvalidateOffloadWorker+93 > fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax > > DEFAULT_BUCKET_ID: DRIVER_FAULT > > BUGCHECK_STR: 0xD1 > > PROCESS_NAME: System > > TRAP_FRAME: fffffadef668db20 -- (.trap 0xfffffadef668db20) > .trap 0xfffffadef668db20 > NOTE: The trap frame does not contain all registers. > Some register values may be zeroed or incorrect. > rax=fffffadf05dd56c8 rbx=fffff800011cda18 rcx=fffffadef668dcd0 > rdx=0000000000000000 rsi=0000000000000000 rdi=fffffadf06bc3ce8 > rip=fffffadef2622743 rsp=fffffadef668dcb0 rbp=fffffadf029c1950 > r8=fffffadef668dcd0 r9=0000000100000000 r10=0000000000000000 > r11=fffffadef62bd450 r12=0000000000000000 r13=0000000000000000 > r14=0000000000000000 r15=0000000000000000 > iopl=0 nv up ei pl zr na po nc > tcpip!IpDelayedInvalidateOffloadWorker+0x93: > fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax > ds:0286:3d00=???????????????? > .trap > Resetting default scope > > LAST_CONTROL_TRANSFER: from fffff8000102e5b4 to fffff8000102e890 > > STACK_TEXT: > fffffade`f668d998 fffff800`0102e5b4 : 00000000`0000000a 00000000`00000018 > 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx > fffffade`f668d9a0 fffff800`0102d547 : 00000000`00000000 00000000`00000000 > 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x74 > fffffade`f668db20 fffffade`f2622743 : fffffadf`06bc3bf0 fffff800`0125e200 > 00000000`00000000 fffffade`f626c051 : nt!KiPageFault+0x207 > fffffade`f668dcb0 fffff800`010375ca : fffffadf`029c1970 fffffade`f626c010 > fffffadf`06bc3bf0 fffff800`011cda18 : > tcpip!IpDelayedInvalidateOffloadWorker+0x93 > fffffade`f668dd00 fffff800`0124a972 : fffffadf`06bc3bf0 00000000`00000080 > fffffadf`06bc3bf0 fffffade`f62a3680 : nt!ExpWorkerThread+0x13b > fffffade`f668dd70 fffff800`01020226 : fffffade`f629b180 fffffadf`06bc3bf0 > fffffade`f62a3680 fffff800`011b4dc0 : nt!PspSystemThreadStartup+0x3e > fffffade`f668ddd0 00000000`00000000 : 00000000`00000000 00000000`00000000 > 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 > > > STACK_COMMAND: kb > > FOLLOWUP_IP: > tcpip!IpDelayedInvalidateOffloadWorker+93 > fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax > > SYMBOL_STACK_INDEX: 3 > > SYMBOL_NAME: tcpip!IpDelayedInvalidateOffloadWorker+93 > > FOLLOWUP_NAME: MachineOwner > > MODULE_NAME: tcpip > > IMAGE_NAME: tcpip.sys > > DEBUG_FLR_IMAGE_TIMESTAMP: 45d699a3 > > FAILURE_BUCKET_ID: X64_0xD1_W_tcpip!IpDelayedInvalidateOffloadWorker+93 > > BUCKET_ID: X64_0xD1_W_tcpip!IpDelayedInvalidateOffloadWorker+93 > > Followup: MachineOwner > --------- > > rax=fffffadef668daa0 rbx=fffffadf05e75200 rcx=000000000000000a > rdx=0000000000000018 rsi=fffffadf05dd56a0 rdi=0000000000000000 > rip=fffff8000102e890 rsp=fffffadef668d998 rbp=fffffadef668dba0 > r8=0000000000000002 r9=0000000000000001 r10=fffffadef2622743 > r11=fffffadef62bd450 r12=fffffadf029c1950 r13=0000000000000001 > r14=0000000000000000 r15=0000000000000000 > iopl=0 nv up ei ng nz na po nc > cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286 > nt!KeBugCheckEx: > fffff800`0102e890 48894c2408 mov qword ptr [rsp+8],rcx > ss:0018:fffffade`f668d9a0=000000000000000a > ^ No runnable debuggees error in > '.reload;!analyze -v;r;thread;lmnt;.logclose;q' > > > >
Guest Snoopy Posted December 5, 2007 Posted December 5, 2007 RE: Blue Screnn of Deth Thanks William, We finaly solved the problem by opening a ticked at Microsoft by sending this memory dump to them. They corected the problem by appliing the folowing command. Netsh int ip set chimney DISABLED ------------------------------ "William Mann" wrote: > Well, the line DRIVER_IRQL_NOT_LESS_OR_EQUAL > > suggests a problem in a driver, the question, which driver. Try updating > your network card drivers, depending on the make/model of your server, I find > these are the most likely to be wrong. > > Hope this helps > > Will > > "Snoopy" wrote: > > > Dear all, > > > > I have Windows 2003 R2 64bit SP2 server, that is experiencing Blue screen > > olmost every second week, which ends in automatic reboot. The event log that > > I'm getting is the folowing: > > > > Event Type: Error > > Event Source: System Error > > Event Category: (102) > > Event ID: 1003 > > Date: 11/30/2007 > > Time: 9:03:51 AM > > User: N/A > > Computer: xxxxxx > > Description: > > Error code 00000000000000d1, parameter1 0000000000000018, parameter2 > > 0000000000000002, parameter3 0000000000000001, parameter4 fffffadef2622743. > > > > For more information, see Help and Support Center at > > http://go.microsoft.com/fwlink/events.asp. > > Data: > > 0000: 53 79 73 74 65 6d 20 45 System E > > 0008: 72 72 6f 72 20 20 45 72 rror Er > > 0010: 72 6f 72 20 63 6f 64 65 ror code > > 0018: 20 30 30 30 30 30 30 30 0000000 > > 0020: 30 30 30 30 30 30 30 64 0000000d > > 0028: 31 20 20 50 61 72 61 6d 1 Param > > 0030: 65 74 65 72 73 20 30 30 eters 00 > > 0038: 30 30 30 30 30 30 30 30 00000000 > > 0040: 30 30 30 30 31 38 2c 20 000018, > > 0048: 30 30 30 30 30 30 30 30 00000000 > > 0050: 30 30 30 30 30 30 30 32 00000002 > > 0058: 2c 20 30 30 30 30 30 30 , 000000 > > 0060: 30 30 30 30 30 30 30 30 00000000 > > 0068: 30 31 2c 20 66 66 66 66 01, ffff > > 0070: 66 61 64 65 66 32 36 32 fadef262 > > 0078: 32 37 34 33 2743 > > > > --------------------------------------------------- > > ---------------------------------------------------- > > > > I was able to open the MEMORY.DMP file with folowing information: > > Any idea waht it may be? > > > > Opened log file 'c:\debuglog.txt' > > 3: kd> .sympath srv*c:\symbols*htt://msdl.microsoft.com/download/symbols > > Symbol search path is: > > srv*c:\symbols*htt://msdl.microsoft.com/download/symbols > > 3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols > > Symbol search path is: > > srv*c:\symbols*http://msdl.microsoft.com/download/symbols > > 3: kd> .reload;!analyze -v;r;thread;lmnt;.logclose;q > > Loading Kernel Symbols > > ......................................................................................................................... > > Loading User Symbols > > > > Loading unloaded module list > > ....... > > ******************************************************************************* > > * > > * > > * Bugcheck Analysis > > * > > * > > * > > ******************************************************************************* > > > > DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) > > An attempt was made to access a pageable (or completely invalid) address at an > > interrupt request level (IRQL) that is too high. This is usually > > caused by drivers using improper addresses. > > If kernel debugger is available get stack backtrace. > > Arguments: > > Arg1: 0000000000000018, memory referenced > > Arg2: 0000000000000002, IRQL > > Arg3: 0000000000000001, value 0 = read operation, 1 = write operation > > Arg4: fffffadef2622743, address which referenced memory > > > > Debugging Details: > > ------------------ > > > > > > > > > > > > > > WRITE_ADDRESS: 0000000000000018 > > > > CURRENT_IRQL: 2 > > > > FAULTING_IP: > > tcpip!IpDelayedInvalidateOffloadWorker+93 > > fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax > > > > DEFAULT_BUCKET_ID: DRIVER_FAULT > > > > BUGCHECK_STR: 0xD1 > > > > PROCESS_NAME: System > > > > TRAP_FRAME: fffffadef668db20 -- (.trap 0xfffffadef668db20) > > .trap 0xfffffadef668db20 > > NOTE: The trap frame does not contain all registers. > > Some register values may be zeroed or incorrect. > > rax=fffffadf05dd56c8 rbx=fffff800011cda18 rcx=fffffadef668dcd0 > > rdx=0000000000000000 rsi=0000000000000000 rdi=fffffadf06bc3ce8 > > rip=fffffadef2622743 rsp=fffffadef668dcb0 rbp=fffffadf029c1950 > > r8=fffffadef668dcd0 r9=0000000100000000 r10=0000000000000000 > > r11=fffffadef62bd450 r12=0000000000000000 r13=0000000000000000 > > r14=0000000000000000 r15=0000000000000000 > > iopl=0 nv up ei pl zr na po nc > > tcpip!IpDelayedInvalidateOffloadWorker+0x93: > > fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax > > ds:0286:3d00=???????????????? > > .trap > > Resetting default scope > > > > LAST_CONTROL_TRANSFER: from fffff8000102e5b4 to fffff8000102e890 > > > > STACK_TEXT: > > fffffade`f668d998 fffff800`0102e5b4 : 00000000`0000000a 00000000`00000018 > > 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx > > fffffade`f668d9a0 fffff800`0102d547 : 00000000`00000000 00000000`00000000 > > 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x74 > > fffffade`f668db20 fffffade`f2622743 : fffffadf`06bc3bf0 fffff800`0125e200 > > 00000000`00000000 fffffade`f626c051 : nt!KiPageFault+0x207 > > fffffade`f668dcb0 fffff800`010375ca : fffffadf`029c1970 fffffade`f626c010 > > fffffadf`06bc3bf0 fffff800`011cda18 : > > tcpip!IpDelayedInvalidateOffloadWorker+0x93 > > fffffade`f668dd00 fffff800`0124a972 : fffffadf`06bc3bf0 00000000`00000080 > > fffffadf`06bc3bf0 fffffade`f62a3680 : nt!ExpWorkerThread+0x13b > > fffffade`f668dd70 fffff800`01020226 : fffffade`f629b180 fffffadf`06bc3bf0 > > fffffade`f62a3680 fffff800`011b4dc0 : nt!PspSystemThreadStartup+0x3e > > fffffade`f668ddd0 00000000`00000000 : 00000000`00000000 00000000`00000000 > > 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 > > > > > > STACK_COMMAND: kb > > > > FOLLOWUP_IP: > > tcpip!IpDelayedInvalidateOffloadWorker+93 > > fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax > > > > SYMBOL_STACK_INDEX: 3 > > > > SYMBOL_NAME: tcpip!IpDelayedInvalidateOffloadWorker+93 > > > > FOLLOWUP_NAME: MachineOwner > > > > MODULE_NAME: tcpip > > > > IMAGE_NAME: tcpip.sys > > > > DEBUG_FLR_IMAGE_TIMESTAMP: 45d699a3 > > > > FAILURE_BUCKET_ID: X64_0xD1_W_tcpip!IpDelayedInvalidateOffloadWorker+93 > > > > BUCKET_ID: X64_0xD1_W_tcpip!IpDelayedInvalidateOffloadWorker+93 > > > > Followup: MachineOwner > > --------- > > > > rax=fffffadef668daa0 rbx=fffffadf05e75200 rcx=000000000000000a > > rdx=0000000000000018 rsi=fffffadf05dd56a0 rdi=0000000000000000 > > rip=fffff8000102e890 rsp=fffffadef668d998 rbp=fffffadef668dba0 > > r8=0000000000000002 r9=0000000000000001 r10=fffffadef2622743 > > r11=fffffadef62bd450 r12=fffffadf029c1950 r13=0000000000000001 > > r14=0000000000000000 r15=0000000000000000 > > iopl=0 nv up ei ng nz na po nc > > cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286 > > nt!KeBugCheckEx: > > fffff800`0102e890 48894c2408 mov qword ptr [rsp+8],rcx > > ss:0018:fffffade`f668d9a0=000000000000000a > > ^ No runnable debuggees error in > > '.reload;!analyze -v;r;thread;lmnt;.logclose;q' > > > > > > > >
Recommended Posts