Jump to content

Server randomly crashing and restarting.

Guest Sezgin

By Guest Sezgin
in Windows 2003 Server

 Share

Recommended Posts

Guest Sezgin

Guest Sezgin

Posted
Posted

Hi everyone,

 

One of our brand new HP Proliant ML350 servers is crashing and restarting

randomly. Memory Dump analysis output is below. Any help will be greatly

appreciated.

 

Regards,

 

Microsoft ® Windows Debugger Version 6.8.0004.0 X86

Copyright © Microsoft Corporation. All rights reserved.

 

 

Loading Dump File [D:\Symbols\MEMORY.DMP]

Kernel Summary Dump File: Only kernel address space is available

 

Symbol search path is: D:\Symbols

Executable search path is:

Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free

x86 compatible

Product: Server, suite: TerminalServer SingleUserTS

Built by: 3790.srv03_sp2_rtm.070216-1710

Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8

Debug session time: Fri May 2 02:37:16.578 2008 (GMT+3)

System Uptime: 7 days 0:04:54.644

Loading Kernel Symbols

.................................................................................................................

Loading User Symbols

 

Loading unloaded module list

.....

*******************************************************************************

*

*

* Bugcheck Analysis

*

*

*

*******************************************************************************

 

Use !analyze -v to get detailed debugging information.

 

BugCheck 24, {19033d, f78daa38, f78da734, 8089c9d3}

 

 

 

 

 

Probably caused by : Pool_Corruption ( nt!ExFreePool+f )

 

Followup: Pool_corruption

---------

 

1: kd> !analyze -v

*******************************************************************************

*

*

* Bugcheck Analysis

*

*

*

*******************************************************************************

 

NTFS_FILE_SYSTEM (24)

If you see NtfsExceptionFilter on the stack then the 2nd and 3rd

parameters are the exception record and context record. Do a .cxr

on the 3rd parameter and then kb to obtain a more informative stack

trace.

Arguments:

Arg1: 0019033d

Arg2: f78daa38

Arg3: f78da734

Arg4: 8089c9d3

 

Debugging Details:

------------------

 

 

 

 

 

 

EXCEPTION_RECORD: f78daa38 -- (.exr 0xfffffffff78daa38)

ExceptionAddress: 8089c9d3 (nt!ExFreePoolWithTag+0x000006a1)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000001

Parameter[1]: 00000000

Attempt to write to address 00000000

 

CONTEXT: f78da734 -- (.cxr 0xfffffffff78da734)

eax=eb4b2178 ebx=00000000 ecx=000001ff edx=00000000 esi=eb4b21c0 edi=89fb9090

eip=8089c9d3 esp=f78dab00 ebp=f78dab4c iopl=0 nv up ei ng nz ac pe cy

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297

nt!ExFreePoolWithTag+0x6a1:

8089c9d3 8913 mov dword ptr [ebx],edx

ds:0023:00000000=????????

Resetting default scope

 

PROCESS_NAME: System

 

CURRENT_IRQL: 0

 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced

memory at "0x%08lx". The memory could not be "%s".

 

WRITE_ADDRESS: 00000000

 

BUGCHECK_STR: 0x24

 

DEFAULT_BUCKET_ID: NULL_DEREFERENCE

 

LAST_CONTROL_TRANSFER: from 8089c26e to 8089c9d3

 

STACK_TEXT:

f78dab4c 8089c26e 89fbb150 00000000 f78dab68 nt!ExFreePoolWithTag+0x6a1

f78dab5c f71eb9e8 eb4b21c8 f78dab90 f721ccfd nt!ExFreePool+0xf

f78dab68 f721ccfd f72050a0 eb4b21c8 f16d19c0

Ntfs!ExFreeToNPagedLookasideList+0x1e

f78dab90 f71e5212 86609bb8 f78dabbc f78dabc6 Ntfs!NtfsDeleteFcb+0x205

f78dabe0 f721a1f9 86609bb8 89535100 eb4b21c8 Ntfs!NtfsTeardownFromLcb+0x1e2

f78dac38 f71e7137 86609bb8 eb4b2290 eb4b2418 Ntfs!NtfsTeardownStructures+0x12c

f78dac64 f72270a9 86609bb8 eb4b2290 eb4b2418

Ntfs!NtfsDecrementCloseCounts+0xa9

f78dacec f72211d8 86609bb8 eb4b2290 eb4b21c8 Ntfs!NtfsCommonClose+0x3a1

f78dad80 8082db08 00000000 00000000 89ecd3f0 Ntfs!NtfsFspClose+0xe2

f78dadac 80920833 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb

f78daddc 8083fe9f 8082da4b 00000000 00000000 nt!PspSystemThreadStartup+0x2e

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

 

 

FOLLOWUP_IP:

nt!ExFreePool+f

8089c26e 5d pop ebp

 

SYMBOL_STACK_INDEX: 1

 

SYMBOL_NAME: nt!ExFreePool+f

 

FOLLOWUP_NAME: Pool_corruption

 

IMAGE_NAME: Pool_Corruption

 

DEBUG_FLR_IMAGE_TIMESTAMP: 0

 

MODULE_NAME: Pool_Corruption

 

STACK_COMMAND: .cxr 0xfffffffff78da734 ; kb

 

FAILURE_BUCKET_ID: 0x24_VRF_nt!ExFreePool+f

 

BUCKET_ID: 0x24_VRF_nt!ExFreePool+f

 

Followup: Pool_corruption

---------

 

1: kd> .exr 0xfffffffff78daa38

ExceptionAddress: 8089c9d3 (nt!ExFreePoolWithTag+0x000006a1)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000001

Parameter[1]: 00000000

Attempt to write to address 00000000

  • Replies 1
  • Created
  • Last Reply

Popular Days

Popular Days

Guest William Mann

Guest William Mann

Posted
Posted

RE: Server randomly crashing and restarting.

 

What does eventvwr have to say on the issue? I'm guessing this is either a

memory or disk error. Try booting the server off a memtest86+ cd, or use your

smartstart CD to test the server.

 

HTH

 

"Sezgin" wrote:

> Hi everyone,

>

> One of our brand new HP Proliant ML350 servers is crashing and restarting

> randomly. Memory Dump analysis output is below. Any help will be greatly

> appreciated.

>

> Regards,

>

> Microsoft ® Windows Debugger Version 6.8.0004.0 X86

> Copyright © Microsoft Corporation. All rights reserved.

>

>

> Loading Dump File [D:\Symbols\MEMORY.DMP]

> Kernel Summary Dump File: Only kernel address space is available

>

> Symbol search path is: D:\Symbols

> Executable search path is:

> Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free

> x86 compatible

> Product: Server, suite: TerminalServer SingleUserTS

> Built by: 3790.srv03_sp2_rtm.070216-1710

> Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8

> Debug session time: Fri May 2 02:37:16.578 2008 (GMT+3)

> System Uptime: 7 days 0:04:54.644

> Loading Kernel Symbols

> ................................................................................................................

> Loading User Symbols

>

> Loading unloaded module list

> ....

> *******************************************************************************

> *

> *

> * Bugcheck Analysis

> *

> *

> *

> *******************************************************************************

>

> Use !analyze -v to get detailed debugging information.

>

> BugCheck 24, {19033d, f78daa38, f78da734, 8089c9d3}

>

>

>

>

>

> Probably caused by : Pool_Corruption ( nt!ExFreePool+f )

>

> Followup: Pool_corruption

> ---------

>

> 1: kd> !analyze -v

> *******************************************************************************

> *

> *

> * Bugcheck Analysis

> *

> *

> *

> *******************************************************************************

>

> NTFS_FILE_SYSTEM (24)

> If you see NtfsExceptionFilter on the stack then the 2nd and 3rd

> parameters are the exception record and context record. Do a .cxr

> on the 3rd parameter and then kb to obtain a more informative stack

> trace.

> Arguments:

> Arg1: 0019033d

> Arg2: f78daa38

> Arg3: f78da734

> Arg4: 8089c9d3

>

> Debugging Details:

> ------------------

>

>

>

>

>

>

> EXCEPTION_RECORD: f78daa38 -- (.exr 0xfffffffff78daa38)

> ExceptionAddress: 8089c9d3 (nt!ExFreePoolWithTag+0x000006a1)

> ExceptionCode: c0000005 (Access violation)

> ExceptionFlags: 00000000

> NumberParameters: 2

> Parameter[0]: 00000001

> Parameter[1]: 00000000

> Attempt to write to address 00000000

>

> CONTEXT: f78da734 -- (.cxr 0xfffffffff78da734)

> eax=eb4b2178 ebx=00000000 ecx=000001ff edx=00000000 esi=eb4b21c0 edi=89fb9090

> eip=8089c9d3 esp=f78dab00 ebp=f78dab4c iopl=0 nv up ei ng nz ac pe cy

> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297

> nt!ExFreePoolWithTag+0x6a1:

> 8089c9d3 8913 mov dword ptr [ebx],edx

> ds:0023:00000000=????????

> Resetting default scope

>

> PROCESS_NAME: System

>

> CURRENT_IRQL: 0

>

> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced

> memory at "0x%08lx". The memory could not be "%s".

>

> WRITE_ADDRESS: 00000000

>

> BUGCHECK_STR: 0x24

>

> DEFAULT_BUCKET_ID: NULL_DEREFERENCE

>

> LAST_CONTROL_TRANSFER: from 8089c26e to 8089c9d3

>

> STACK_TEXT:

> f78dab4c 8089c26e 89fbb150 00000000 f78dab68 nt!ExFreePoolWithTag+0x6a1

> f78dab5c f71eb9e8 eb4b21c8 f78dab90 f721ccfd nt!ExFreePool+0xf

> f78dab68 f721ccfd f72050a0 eb4b21c8 f16d19c0

> Ntfs!ExFreeToNPagedLookasideList+0x1e

> f78dab90 f71e5212 86609bb8 f78dabbc f78dabc6 Ntfs!NtfsDeleteFcb+0x205

> f78dabe0 f721a1f9 86609bb8 89535100 eb4b21c8 Ntfs!NtfsTeardownFromLcb+0x1e2

> f78dac38 f71e7137 86609bb8 eb4b2290 eb4b2418 Ntfs!NtfsTeardownStructures+0x12c

> f78dac64 f72270a9 86609bb8 eb4b2290 eb4b2418

> Ntfs!NtfsDecrementCloseCounts+0xa9

> f78dacec f72211d8 86609bb8 eb4b2290 eb4b21c8 Ntfs!NtfsCommonClose+0x3a1

> f78dad80 8082db08 00000000 00000000 89ecd3f0 Ntfs!NtfsFspClose+0xe2

> f78dadac 80920833 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb

> f78daddc 8083fe9f 8082da4b 00000000 00000000 nt!PspSystemThreadStartup+0x2e

> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

>

>

> FOLLOWUP_IP:

> nt!ExFreePool+f

> 8089c26e 5d pop ebp

>

> SYMBOL_STACK_INDEX: 1

>

> SYMBOL_NAME: nt!ExFreePool+f

>

> FOLLOWUP_NAME: Pool_corruption

>

> IMAGE_NAME: Pool_Corruption

>

> DEBUG_FLR_IMAGE_TIMESTAMP: 0

>

> MODULE_NAME: Pool_Corruption

>

> STACK_COMMAND: .cxr 0xfffffffff78da734 ; kb

>

> FAILURE_BUCKET_ID: 0x24_VRF_nt!ExFreePool+f

>

> BUCKET_ID: 0x24_VRF_nt!ExFreePool+f

>

> Followup: Pool_corruption

> ---------

>

> 1: kd> .exr 0xfffffffff78daa38

> ExceptionAddress: 8089c9d3 (nt!ExFreePoolWithTag+0x000006a1)

> ExceptionCode: c0000005 (Access violation)

> ExceptionFlags: 00000000

> NumberParameters: 2

> Parameter[0]: 00000001

> Parameter[1]: 00000000

> Attempt to write to address 00000000

>

 Share
Go to topic listing
×
×
  • Create New...