Windows NAS restart daily around smae time

[Guest Ian Zahn]

We have a HP DL100G2 with windows 2003 Storage Server installed on it with

SP2 and latest Service Release. It runs Backupexec 11d and is our file

server. It keeps restarting around 1.35am each morning. I am not sure why.

Here is the debug report, Any help muchly appreciated.

BugCheck 1000007E, {c0000005, 0, f5dd28e8, f5dd25e4}

 

 

 

Probably caused by : Pool_Corruption ( nt!ExFreePool+17 )

 

Followup: Pool_corruption

---------

 

1: kd> !analyze -v

*******************************************************************************

*

*

* Bugcheck Analysis

*

*

*

*******************************************************************************

 

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: 00000000, The address that the exception occurred at

Arg3: f5dd28e8, Exception Record Address

Arg4: f5dd25e4, Context Record Address

 

Debugging Details:

------------------

 

 

 

 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"

referenced memory at "0x%08lx". The memory could not be "%s".

 

FAULTING_IP:

+0

00000000 0000 add byte ptr [eax],al

 

EXCEPTION_RECORD: f5dd28e8 -- (.exr 0xfffffffff5dd28e8)

ExceptionAddress: 00000000

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000008

Parameter[1]: 00000000

Attempt to execute non-executable address 00000000

 

CONTEXT: f5dd25e4 -- (.cxr 0xfffffffff5dd25e4)

eax=00000000 ebx=00000000 ecx=808f9f65 edx=7ea30001 esi=82d404e8 edi=00000001

eip=00000000 esp=f5dd29b0 ebp=f5dd29f0 iopl=0 nv up ei ng nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286

00000000 0000 add byte ptr [eax],al

ds:0023:00000000=00

Resetting default scope

 

CUSTOMER_CRASH_COUNT: 1

 

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

 

CURRENT_IRQL: 0

 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced

memory at "0x%08lx". The memory could not be "%s".

 

WRITE_ADDRESS: 00000000

 

FAILED_INSTRUCTION_ADDRESS:

+0

00000000 0000 add byte ptr [eax],al

 

BUGCHECK_STR: 0x7E

 

EXCEPTION_STR: 0x0

 

LAST_CONTROL_TRANSFER: from 80892b77 to 00000000

 

STACK_TEXT:

WARNING: Frame IP not in any known module. Following frames may be wrong.

f5dd29ac 80892b77 80938540 e37410d0 00000000 0x0

f5dd29f0 f5387f8c 80013138 00000007 e3741e70 nt!ExFreePool+0x17

f5dd2b68 f53a1318 e3741000 80013138 fb2de778

nfssvr!NfsGetOpenFileAttributes2+0x676

f5dd2cf8 f539fcfa e3741000 00000002 fb2de008 nfssvr!NfsSetAttr+0xe2a

f5dd2d50 f53aee9d 86407e68 00000000 fb2de044 nfssvr!NfsInPacketInternal+0x970

f5dd2d64 f5ca42fc 86407e68 00000000 fb2de044 nfssvr!NfsInPacket+0x19

f5dd2dac 80949b7c 00000007 00000000 00000000 rpcxdr!RxWorkThread+0x308

f5dd2ddc 8088e062 f5ca3ff4 00000007 00000000 nt!PspSystemThreadStartup+0x2e

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

 

 

FOLLOWUP_IP:

nt!ExFreePool+17

80892b77 cc int 3

 

SYMBOL_STACK_INDEX: 1

 

SYMBOL_NAME: nt!ExFreePool+17

 

FOLLOWUP_NAME: Pool_corruption

 

IMAGE_NAME: Pool_Corruption

 

DEBUG_FLR_IMAGE_TIMESTAMP: 0

 

MODULE_NAME: Pool_Corruption

 

STACK_COMMAND: .cxr 0xfffffffff5dd25e4 ; kb

 

FAILURE_BUCKET_ID: 0x7E_NULL_IP_nt!ExFreePool+17

 

BUCKET_ID: 0x7E_NULL_IP_nt!ExFreePool+17