|
Question : Microsoft, Server 2003, SP2 Bugcheck 0x0000000a Problem
|
|
Hi,
One of the servers that I support (only support hardware and OS only) has been rebooting with bugcheck errors for the past 3 months. I haven't got too much experience with this so was hoping somebody could point me in the right direction as to the cause - hardware/os/software etc. I have included the 2 bugchecks that we have been getting. The error logs then give a "the previous system shutdown was unexpected" error:
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [c:\memory.dmp]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: srv*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: g:\i386
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Tue Dec 4 18:55:00.756 2007 (GMT+0)
System Uptime: 1 days 21:10:58.175
Loading Kernel Symbols
.........................................................................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {80002, d000001b, 0, 8083d6c4}
Probably caused by : ntkrnlmp.exe ( nt!KiTimerExpiration+2b5 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00080002, memory referenced
Arg2: d000001b, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8083d6c4, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: 00080002
CURRENT_IRQL: 1b
FAULTING_IP:
nt!KiTimerExpiration+2b5
8083d6c4 8a4102 mov al,byte ptr [ecx+2]
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR: 0xA
PROCESS_NAME: Idle
TRAP_FRAME: 808a3488 -- (.trap 0xffffffff808a3488)
ErrCode = 00000000
eax=88ee9660 ebx=00000000 ecx=00080000 edx=00000000 esi=88ee9658 edi=88ee9660
eip=8083d6c4 esp=808a34fc ebp=808a35a8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!KiTimerExpiration+0x2b5:
8083d6c4 8a4102 mov al,byte ptr [ecx+2] ds:0023:00080002=??
Resetting default scope
LAST_CONTROL_TRANSFER: from 8083d6c4 to 80836de5
STACK_TEXT:
808a3488 8083d6c4 badb0d00 00000000 ba7bbd30 nt!KiTrap0E+0x2a7
808a35a8 8083d47c 00000000 00000000 029ed88b nt!KiTimerExpiration+0x2b5
808a3600 80839b2f 00000000 0000000e 00000000 nt!KiRetireDpcList+0x65
808a3604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x37
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTimerExpiration+2b5
8083d6c4 8a4102 mov al,byte ptr [ecx+2]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiTimerExpiration+2b5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 45ec14ca
FAILURE_BUCKET_ID: 0xA_nt!KiTimerExpiration+2b5
BUCKET_ID: 0xA_nt!KiTimerExpiration+2b5
Followup: MachineOwner
-----------------------------------------------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [c:\minidump\Mini102207-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: g:\i386
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Tue Oct 23 01:09:25.536 2007 (GMT+0)
System Uptime: 6 days 14:41:08.457
Loading Kernel Symbols
.........................................................................................................
Loading User Symbols
Loading unloaded module list
...............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 80000, b6cabbc8, 0}
Probably caused by : Beep.SYS ( Beep!BeepCleanup+a2 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 00080000, The address that the exception occurred at
Arg3: b6cabbc8, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
+80000
00080000 ?? ???
TRAP_FRAME: b6cabbc8 -- (.trap 0xffffffffb6cabbc8)
ErrCode = 00000000
eax=00080000 ebx=80842aa6 ecx=808b9300 edx=00000000 esi=00000000 edi=8084951e
eip=00080000 esp=b6cabc3c ebp=b6cabc48 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
00080000 ?? ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
BUGCHECK_STR: 0x8E
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 80a7b6ba to 00080000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b6cabc38 80a7b6ba 00000000 80a8444c b6cabc68 0x80000
b6cabc48 b9c430f6 00000000 8a4cd1c8 8a33bf38 hal!HalpAcquireCmosSpinLock+0x32
b6cabc68 80840153 895ea948 877a7528 877a7528 Beep!BeepCleanup+0xa2
b6cabc7c 8092ec0a 8a4cd1b0 8a76f730 8a4cd1c8 nt!IofCallDriver+0x45
b6cabcac 8092b6af 892c4258 895ea948 00000003 nt!IopCloseFile+0x2ae
b6cabcdc 8092b852 892c4258 00000001 8a76f730 nt!ObpDecrementHandleCount+0xcc
b6cabd04 8092b776 e174f500 8a4cd1c8 00000320 nt!ObpCloseHandleTableEntry+0x131
b6cabd48 8092b7c1 00000320 00000001 b6cabd64 nt!ObpCloseHandle+0x82
b6cabd58 80833bdf 00000320 0110ff48 7c8285ec nt!NtClose+0x1b
b6cabd58 7c8285ec 00000320 0110ff48 7c8285ec nt!KiFastCallEntry+0xfc
0110ff48 00000000 00000000 00000000 00000000 0x7c8285ec
STACK_COMMAND: kb
FOLLOWUP_IP:
Beep!BeepCleanup+a2
b9c430f6 5f pop edi
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Beep!BeepCleanup+a2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Beep
IMAGE_NAME: Beep.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 3e7fff28
FAILURE_BUCKET_ID: 0x8E_Beep!BeepCleanup+a2
BUCKET_ID: 0x8E_Beep!BeepCleanup+a2
Followup: MachineOwner
-----------------------------------------------------------------------------------------------
Basically we provide the hardware plus operating system to another company which then installs their software which they then sell on. There are 8 of these machines at the customer site and only this one has developed the fault. The customer has full access so I don't know what they might have put on the machine. If somebody could give me an idea of where to start looking that would be great.
Thanks
|
|
|
Answer : Microsoft, Server 2003, SP2 Bugcheck 0x0000000a Problem
|
|
I've seen cases where the AntiVirus could be the cause... Have the customer disabled the antivirus service before doing anything else.
The first bugchecks
0xA - IRQL_NOT_LESS_OR_EQUAL. Usually seen after the installation of faulty device drivers, system services, or the BIOS.
Microsoft has a pretty decent run through of steps to take: http://msdn2.microsoft.com/en-us/library/ms793589.aspx
As for the second trace...
0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED. Within this BugCheck you also recieved a 0xC0000005 - STATUS_ACCESS_VIOLATION (as per the first ARG in the bugcheck).
Microsoft article: http://msdn2.microsoft.com/en-us/library/ms794023.aspx
When you put these 2 together I believe you're looking at a memory issue. You might want to run a diagnostic against the memory currently in the system, or simply swap memory out from another machine to test.
If you prefer to test the memory, I would recommend the following site (it's free!): http://www.memtest.org/
|
|
|
|
|
