Windows Server 2008 SP2 bluescreen, help me to decrypt the windbg rapport
i got bluescreen 5 times week on windows 2008 sp2 server :
stuff installed on :
arcserv 12.0 sp2 (old backup software) using sql server 2005.
motorola scanner software (dunno how works communicates sap). know uses 3 services 1 using wmi.
here debug :
microsoft (r) windows debugger version 6.12.0002.633 x86
copyright (c) microsoft corporation. rights reserved.
loading dump file [c:\windows\minidump\mini032514-01.dmp]
mini kernel dump file: registers , stack trace available
symbol search path is: srv*c:\websymb*http://msdl.microsoft.com/download/symbols
executable search path is:
windows server 2008/windows vista kernel version 6002 (service pack 2) mp (24 procs) free x86 compatible
product: server, suite: enterprise terminalserver singleuserts
built by: 6002.18881.x86fre.vistasp2_gdr.130707-1535
machine name:
kernel base = 0x81e4e000 psloadedmodulelist = 0x81f65c70
debug session time: tue mar 25 18:35:35.191 2014 (utc + 1:00)
system uptime: 5 days 0:44:48.497
loading kernel symbols
...............................................................
................................................................
..................
loading user symbols
loading unloaded module list
.........
*******************************************************************************
* *
* bugcheck analysis *
* *
*******************************************************************************
use !analyze -v detailed debugging information.
bugcheck 50, {a17f2268, 0, 81fca2bf, 0}
caused : ntkrpamp.exe ( nt!cmpcheckkey+61b )
followup: machineowner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* bugcheck analysis *
* *
*******************************************************************************
page_fault_in_nonpaged_area (50)
invalid system memory referenced. this cannot protected try-except,
must protected probe. typically address plain bad or it
pointing @ freed memory.
arguments:
arg1: a17f2268, memory referenced.
arg2: 00000000, value 0 = read operation, 1 = write operation.
arg3: 81fca2bf, if non-zero, instruction address referenced bad memory
address.
arg4: 00000000, (reserved)
debugging details:
------------------
read_address: getpointerfromaddress: unable read 81f85874
unable read misystemvatype memory @ 81f65420
a17f2268
faulting_ip:
nt!cmpcheckkey+61b
81fca2bf 394724 cmp dword ptr [edi+24h],eax
mm_internal_code: 0
customer_crash_count: 1
default_bucket_id: driver_fault_server_minidump
bugcheck_str: 0x50
process_name: system
current_irql: 0
trap_frame: 939e79ec -- (.trap 0xffffffff939e79ec)
errcode = 00000000
eax=00000000 ebx=956e47dc ecx=899a2615 edx=00000035 esi=ae9fb090 edi=a17f2244
eip=81fca2bf esp=939e7a60 ebp=939e7a8c iopl=0 nv ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!cmpcheckkey+0x61b:
81fca2bf 394724 cmp dword ptr [edi+24h],eax ds:0023:a17f2268=????????
resetting default scope
last_control_transfer: from 81e9bde4 81ee6292
stack_text:
939e79d4 81e9bde4 00000000 a17f2268 00000000 nt!mmaccessfault+0x10b
939e79d4 81fca2bf 00000000 a17f2268 00000000 nt!kitrap0e+0xdc
939e7a8c 81fd081a 01000001 00a71240 009c3f70 nt!cmpcheckkey+0x61b
939e7abc 81fd0e48 ae9fb090 01000001 00000006 nt!cmpcheckregistry2+0x8c
939e7b04 81fcb86e 01000001 939e7c60 800044dc nt!cmcheckregistry+0xf5
939e7b60 81fcdfdd 939e7bb4 00000005 00000000 nt!cmpinitializehive+0x4c1
939e7bd8 81fd027d 939e7c60 00000000 939e7c4c nt!cmpinithivefromfile+0x19e
939e7c18 81fc64c5 939e7c60 00000000 939e7c7b nt!cmpcmdhiveopen+0x36
939e7d14 81fc66fa 00000002 81f465a0 00000002 nt!cmpflushbackuphive+0x2fd
939e7d38 820a5cbd 81f5013c 8a456d78 81ef3d4a nt!cmpsyncbackuphives+0x90
939e7d44 81ef3d4a 00000000 00000000 8a456d78 nt!cmpperiodicbackupflushworker+0x32
939e7d7c 8202401c 00000000 1a045bd5 00000000 nt!expworkerthread+0xfd
939e7dc0 81e8ceee 81ef3c4d 00000001 00000000 nt!pspsystemthreadstartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!kithreadstartup+0x16
stack_command: kb
followup_ip:
nt!cmpcheckkey+61b
81fca2bf 394724 cmp dword ptr [edi+24h],eax
symbol_stack_index: 2
symbol_name: nt!cmpcheckkey+61b
followup_name: machineowner
module_name: nt
image_name: ntkrpamp.exe
debug_flr_image_timestamp: 51da1840
failure_bucket_id: 0x50_nt!cmpcheckkey+61b
bucket_id: 0x50_nt!cmpcheckkey+61b
followup: machineowner
---------
and here 2 warning got on event :
event id 5612 source : wmi (in applications). didn't find correct that
windows management instrumentation arrêté wmiprvse.exe, car un quota atteint une valeur d’avertissement. quota : handlecount valeur : 4122 valeur maximale : 4096 wmiprvse pid : 4292
event id 2012 source : srv
le serveur rencontré une erreur réseau lors de la transmission ou la réception de données. des erreurs occasionnelles sont attendues mais en trop grand nombre cela indique une erreur possible de la configuration réseau. le code de statut de l'erreur est contenu dans les données renvoyées (formaté sous word) et peut vous donner des indications sur l'origine du problème.
sorry french on thoses error message os in french.
if got clue me on issue.
hi,
this forum not best place dump file analyzing. it‘s suggested contact microsoft customer support
services (css) dedicated support professional can on issue.
to obtain phone numbers specific technology request, please refer website listed below:
http://support.microsoft.com/default.aspx?scid=fh;en-us;phonenumbers¡¯
if outside us, please refer http://support.microsoft.com regional support phone numbers.
thanks understanding.
Windows Server > Windows Server General Forum
Comments
Post a Comment