Mini dump
Dear all,
I have installed windows 8 Pro on my HP Pavillion. The last couple of weeks I am confromted with minidumps. It appears that something is wrong with my ntosknrl.exe. I have made copies of the minidump reports. Are the drivers of the motherboard not updated. Can that be the problem= I have already re/installed or it is better to say repaired the Windows 8 Pro. That is not a full installation but a repair where the files are preserved. My computer is more than a year old. Any advice is welcome.
Bests
Thanks for your quick reply. I am afraid that I have to re-install windows 8. I shall keep you posted.
Similar Messages
-
Blue screen 109 error, mini dump attached, please help
Hi Experts,
I am frequently getting blue screen error in my laptop. Please help. The link to minidump file is given below. I am using Windows 7 ultimate operating system.
I have tried a lot of things to avoid this dump but it keep recurring.
https://onedrive.live.com/redir?resid=49561AD592663106!107&authkey=!AFI9kcFyy6ncfJ8&ithint=file%2c.dmp
regards,
AyazAA
This one DMP file was inconclusive please run driver verifier to find the underlying cause
Please run these tests to verify your memory and find which driver is causing the problem.
If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you don't
know what it is you probably are not overclocking.
Since it is more likely to be a driver please run verifier first.
1-Driver verifier (for complete directions see our wiki here)
2-Memtest. (You can read more about running memtest here)
Co-Authored by JMH3143
Wanikiya and Dyami--Team Zigzag -
Blue Screen shut down c : \ windows\ mini dump\112812-3072-01.dmp
HP pavillion6724y
Computer shuts down this error box comes after restart . It will run fine for a short time then do it again.
Problem event name Blue Screen
os version: 6.1.7601.2.1.0.768.3 locale ID: 1033 sevice pack 1_0
additional infoBCCodee1,BCP!: FFFFF800039CB560 BCP2:0000000000000002, BCP3:FFFFFA8004146480
I have tried recovery no help thereBest I can offer here is to follow some basic troubleshooting steps from our document here:
http://h10025.www1.hp.com/ewfrf/wc/documentSubCategory?tmp_rule=2144&tmp_task=solveCategory&cc=ca&dl...
also I'm assuming you meant a p6724y...
good luck
bill
I'm a HP employee -
Windows 8.1 Crashes with Dumps from desktop
I have experienced a number of crashes on a PC with Windows 8.1, and have analyzed the mini dumps and one full dump so far, and have seen a myriad of different crash results including IRQL_NOT_LESS_OR_EQUAL, KERNEL_DATA_INPAGE_ERROR, CRITICAL_PROCESS_DIED.
I've posted the raw dmp files, as well as txt files of the results from running them through the debugger here...
https://onedrive.live.com/redir?resid=F1640CE12DEBCE6B!130&authkey=!ABlrD4zyv8gT_SU&ithint=folder%2ctxt
I've ran memtest86 very thoroughly on the RAM with 0 errors, I've updated all of the drivers, ran chkdsk on the HDD, and cannot find any glaring errors, and the computer still seems to crash at random points in time with different applications running each
time. The computer is a custom build if the components matter, and each of the component can be found here...
http://pcpartpicker.com/p/zfmYqsTTD
There is a very specific problem. The HD. I would go the HD maker and download their HD checking utility and run it
Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Ken\Desktop\New folder\022015-12359-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Whitespace at start of path element
WARNING: Whitespace at end of path element
Error: Empty Path.
Symbol search path is:
SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.17630.amd64fre.winblue_r7.150109-2022
Machine Name:
Kernel base = 0xfffff800`5ba06000 PsLoadedModuleList = 0xfffff800`5bcdf250
Debug session time: Fri Feb 20 22:11:14.919 2015 (UTC - 5:00)
System Uptime: 0 days 23:53:22.598
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
* Bugcheck Analysis *
Use !analyze -v to get detailed debugging information.
BugCheck 7A, {fffff6fb400a1f28, ffffffffc000000e, 10d7b1880, fffff680143e5000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+1561f )
Followup: MachineOwner
3: kd> !analyze -v
* Bugcheck Analysis *
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fb400a1f28, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc000000e, error status (normally i/o status code)
Arg3: 000000010d7b1880, current process (virtual address for lock type 3, or PTE)
Arg4: fffff680143e5000, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)
Debugging Details:
ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.
DISK_HARDWARE_ERROR: There was error with disk hardware
BUGCHECK_STR: 0x7a_c000000e
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff8005bb7c4cf to fffff8005bb569a0
STACK_TEXT:
ffffd000`309d63e8 fffff800`5bb7c4cf : 00000000`0000007a fffff6fb`400a1f28 ffffffff`c000000e 00000001`0d7b1880 : nt!KeBugCheckEx
ffffd000`309d63f0 fffff800`5ba377f8 : 00000000`00000002 ffffd000`309d6558 ffffe001`d859cdd8 ffffd000`00000000 : nt! ?? ::FNODOBFM::`string'+0x1561f
ffffd000`309d64e0 fffff800`5ba70b7a : ffffe001`d859cdd8 ffffe001`d8385880 01000000`00000001 00000000`00000000 : nt!MiIssueHardFault+0x184
ffffd000`309d65a0 fffff800`5ba67941 : 01000000`00000001 00000000`00000080 fffff680`143e5000 00000000`00000080 : nt!MmAccessFault+0x5ba
ffffd000`309d6760 fffff800`5c0076f1 : ffffe001`d838eb00 00000028`00000000 ffffd000`00000000 00000000`00000004 : nt!MiCommitExistingVad+0x901
ffffd000`309d6890 fffff800`5bb621b3 : 00000028`6fd1e7a0 00000000`00044000 00000028`6f323878 00000000`00043ff0 : nt!NtAllocateVirtualMemory+0xfbd
ffffd000`309d6a90 00007ffb`db9b0f5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000028`6fd1d5e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`db9b0f5a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+1561f
fffff800`5bb7c4cf cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+1561f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 54b0c2f7
IMAGE_VERSION: 6.3.9600.17630
BUCKET_ID_FUNC_OFFSET: 1561f
FAILURE_BUCKET_ID: 0x7a_c000000e_nt!_??_::FNODOBFM::_string_
BUCKET_ID: 0x7a_c000000e_nt!_??_::FNODOBFM::_string_
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x7a_c000000e_nt!_??_::fnodobfm::_string_
FAILURE_ID_HASH: {5654bc57-9720-546c-de0e-76a002c66fe5}
Followup: MachineOwner
Wanikiya and Dyami--Team Zigzag -
Issue in getting exception pointer in VC++ CLR project for generating dump file.
Hi,
We are working on VC++ CLR (Windows Forms) application.
We are writing a code to generate Mini dump file (using MINIDUMPWRITEDUMP in dbghelp.dll) whenever application crashes.
The code available on internet for writing mini dump file in c# generates the mini dump but without Exception code and information, because _EXCEPTION_INFORMATION was set using Marshal::GetExceptionPointers() which returns 0. We called MINIDUMPWRITEDUMP
inside AppDomain::UnhandledExceptionEventHandler for this.
To get the valid exception pointer for mini dump we made following attempts with and without AppDomain::UnhandledExceptionEventHandler –
Used mixed (managed and unmanaged ) dll to add SetUnhandledExceptionFilter. Inside top level exception filter function added code to write mini dump. Inside main the handler is set on 1<sup>st</sup> line. But handler is not invoked
on any exception. This works fine with console C# project.
// inside dll
#pragma unmanaged
LONG WINAPI ABCExceptionFilter(__in struct _EXCEPTION_POINTERS *pExceptionInfo)
{ // code to write dump
#pragma managed
Namespacee SEHHandler {
public ref class SEHExpHandler
public:
static void AddHandler()
SetUnhandledExceptionFilter(ABCExceptionFilter);
// inside app main()
[STAThreadAttribute]
int main(array<System::String ^> ^args)
SEHHandler::SEHExpHandler::AddHandler();
//some code . . .
Application::Run(gcnew Form1());
//some code . . .
Used __try __except inside application main. The exception filter was written in other C++ dll and called inside __except ( expression ) using platform Invoke. But this throws the caught exception while trying to call handler.
// inside app class
[DllImport("SEHhandler.dll")]
extern int __stdcall se_handler(unsigned int code, IntPtr ep);
[STAThreadAttribute]
int main(array<System::String ^> ^args)
__try
{ //some code. . .
__except(se_handler(GetExceptionCode(),
(IntPtr)GetExceptionInformation()))
{ //some code. . .
// inside dll
__declspec(dllexport)
extern int WINAPI se_handler(unsigned int code,
struct _EXCEPTION_POINTERS* ep)
{ // code to write minidump
return EXCEPTION_EXECUTE_HANDLER;
Can anyone help us to get either of the code work. The aim is to write dump file with correct stack trace where exception was thrown.
Thanks in advance.
-- SumitHi,
Few days back we tried following sample program and we were able to get exception code and pointer for almost all types of exception catch inside __except statement.
1. Create sample VC++ > CLR > Windows form application.
2. Change Common language Runtime support to (/clr).
3. Set UnhandledExceptionMode to ThrowException in main.
4. Inside application cpp file add __try __except around Application::Run(gcnew Form1()).
5. Add new header file to write unmanaged function to be called inside __except statement to handle exception.
6. Created new Form1 and add few buttons to test different types of exceptions.
7. Exceptions will be catch in __except statement and exception pointers will be available to write mini dump.
Inside application main function use __try, __except block.
#include "stdafx.h"
#include "Form1.h"
[STAThreadAttribute]
int main(array<System::String ^> ^args)
Application::SetUnhandledExceptionMode(UnhandledExceptionMode::ThrowException);
Application::EnableVisualStyles();
Application::SetCompatibleTextRenderingDefault(false);
__try{
// Create the main window and run it
Application::Run(gcnew Form1());
}__except(exception_filter(GetExceptionCode(), GetExceptionInformation())){
// write your code
return 0;
Add header file and write exception filter
#pragma once
#include <windows.h>
#include <stdio.h>
#include <string>
using namespace std;
#pragma comment(lib, "user32.lib")
int exception_filter(unsigned int code, struct _EXCEPTION_POINTERS* ep)
TCHAR buff[100];
wsprintf(buff, L"Inside exception_filter. Excp Pointer %p", (void*)ep);
::MessageBox(NULL,buff,L"Error",MB_OK);
// add code to write mini dump using MINIDUMPWRITEDUMP
return EXCEPTION_EXECUTE_HANDLER;
Thanks. -
BSOD about every 30 mins... HELP!
Recently reinstalled OS because my PC kept BSOD.. Googled some of the crashes and it said to re-install windows.. So I did.. Still happening. I can't figure out how to open the mini dump files nor do I know how to upload them for people to see.. Any help
would be very appreciated ...We do need the actual log file (called a DMP file) as they contain the only record of the sequence of events leading up to the crash, what drivers were
loaded, and what was responsible.
We prefer at least 2 DMP files to spot trends and confirm the cause.
Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
If you have any questions about the procedure please ask
If you are using Blue screen view, who crashed, or a similar application, don't. They are wrong at least as often as they are correct
Wanikiya and Dyami--Team Zigzag -
No memory dump files after BSOD
Hi. I'm experiencing BSOD problem for quite a long time. I really don't know anymore what could be the cause of this problem and i desperately need help about it. I don't know much about this, but I've been told to upload memory dump file so that experts
may determent what is the cause of my problem. But that is where another problem is. I'm not getting any new memory dump files after my PC crashes. It just stopped ''appearing''. I did everything on this site to enable mini dumps:
http://www.carrona.org/setmini.html
But I'm still not getting them... What should i do? Please help me.1. Start > type
%systemroot% which should show the Windows folder, click on it. Once inside that folder, ensure there is a Minidump folder created. If not, CTRL-SHIFT-N to make a New Folder and name it Minidump.
2. Windows key +
Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Performance > Settings > Advanced > Ensure there's a check-mark for 'Automatically manage paging file size for all drives'.
3. Windows key +
Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Startup and Recovery > Settings > System Failure > ensure there is a check mark next to 'Write an event to the system log'.
Ensure Small Memory Dump is selected and ensure the path is %systemroot%\Minidump.
4. Double check
that the WERS is ENABLED:
Start > Search > type services.msc > Under the name tab, find Windows Error Reporting Service > If the status of the service is not Started then right click it
and select Start. Also ensure that under Startup Type it is set to Automatic rather than Manual. You can do this by right clicking it, selecting properties, and under General selecting startup type to 'Automatic', and then click Apply.
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread. -
Troubleshooting ntoskrnl and ntkmlmp dumps.
I'm an IT consultant. I have two customers seeing BSODs either when they push the on/off button to put their computers to sleep or go to START>SHUTDOWN>SLEEP. One is a Dell Optiplex 3010 I3 with 4GB of RAM
and WD 250GB sata disk running Win7 Pro 64 bit. That’s the one I have dumps for. The second is a <st1:place u1:st="on"><st1:placename u1:st="on"><st1:place w:st="on"><st1:placename w:st="on">Lenovo</st1:placename></st1:place></st1:placename>
<st1:placename u1:st="on"><st1:placename w:st="on">Idea</st1:placename></st1:placename> <st1:placetype u1:st="on"><st1:placetype w:st="on">Center</st1:placetype></st1:placetype></st1:place>
desktop running Win7 Home Premium 64 bit. I put on the same suite of software for all my customers. It includes BitDefender Internet Security, Malwarebytes Anti-Malware Pro, Hard Disk Sentinel, Glary Utilities and Acronis True Image 2014.
Because I’m seeing this on two different desktop computers I doubt that it’s a hardware issue.
I’ve taken both memory kernel and mini-dumps, formatted with WHOCRASHED. The offending module is always either ntoskrnl and ntkrnlmp and that tells me nothing about what actual module caused the crash. I don’t want
a workaround. I want to know the offending program so I can get on the developers to fix it. I’ve put the output from WHOCRASHED down below.
This is recreate-able and I have the machine in house. Is there any tool, trap or dump that can show me what is really causing this problem?
Thanks,
Al
Crash Dump Analysis
Crash dump directory: C:\Windows\Minidump Crash dumps are enabled on your computer. crash dump file: C:\Windows\Minidump\060914-15522-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x75BC0) Bugcheck
code: 0xA (0xFFFFF8A0002F3D38, 0x2, 0x0, 0xFFFFF80002CD225B) Error: IRQL_NOT_LESS_OR_EQUAL file path: C:\Windows\system32\ntoskrnl.exe product: Microsoft® Windows® Operating description: NT Kernel & System Bug check description: This indicates that Microsoft
Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused
by another driver that cannot be identified at this time.
crash dump file: C:\Windows\memory.dmp This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0) Bugcheck code: 0xA (0xFFFFF8A0002F3D38, 0x2, 0x0, 0xFFFFF80002CD225B) Error: IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place
in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.
2 crash dumps have been found and analyzed. No offending third party drivers have been found. Connsider using WhoCrashed Professional which offers more detailed analysis using symbol resolution. Also configuring your system
to produce a full memory dump may help you.Hi Al,
Download Debugging Tools for Windows ( http://msdn.microsoft.com/en-gb/library/windows/hardware/ff551063%28v=vs.85%29.aspx )
Start WinDBG
Open the memory.dmp (Ctrl-D)
To get a quick automated analysis type the following commands:
.symfix
.reload
!analyze -v
Good luck!
Csaba
Csaba -
Usb 6501 unresponsive causing BSOD(Blue Screen Error)
There are a lot posts about the same issue but mine is a little peculiar so i decided to post it.
I am using two usb DAQ in the same pc(usb-6501, usb-6001), connected to the usb port on the back. The usb-6501 is used to obtain digital inputs from read switches, Sensors through an ssr. The usb-6001 is used to control 2 double valve solenoid, 1 dc motor, 2 indicator lamps. usb-6001 is also used to read analog values of current(using hall effect sensor) and voltage(using potentiometer).
At first i was facing problems with the usb-6001(the usb-6501 was working fine at this point) resetting during operation accompanied by BSOD. Then i learned it was due to my relay, which requires 30 mA of current to switch so i used the ULN2003a to interface the usb-6001 with the relays and after that the application was running perfectly for 4 days.
Now the usb-6501 is having the same problem and when i perform "Self Test" from NI MAX it shows "Error Code:50405" and i am able to reset the device from NI MAX only sometimes, other times i would have to unplug the USB device then plug it back in. As the application is used for an automated test rig the customer is frustrated by this problem. Once the card becomes unresponsive(or after the card is reset) BSOD occours.
I have checked all the device drivers and OS for any errors but they are fine. i have even tried changing the ram to solve the BSOD with no use.
System Details:
Windows 7 SP1
NI MAX 14.0
power saving is disabled
I have attached the latest mini dump files as they might help in finding out the reason behind this problem(File extensions changed for the purpouse of uploading).
I need to know: Is there any permanent solution for this problem? and what is the reason for this problem.
Attachments:
060115-12480-01.txt 315 KB
053015-12324-01.txt 315 KB
052615-17440-01.txt 315 KBAdditional info : i did an analysis of the dump files and this is the result
0: kd> !analyze -v
* Bugcheck Analysis *
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff88009fe10b1, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800657922e, address which referenced memory
Debugging Details:
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c30e8
fffff88009fe10b1
CURRENT_IRQL: 2
FAULTING_IP:
nifslk+822e
fffff880`0657922e 0fb650ff movzx edx,byte ptr [rax-1]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffff80000b9c6b0 -- (.trap 0xfffff80000b9c6b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88009fe10b2 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff80000b9c8e0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800657922e rsp=fffff80000b9c840 rbp=fffff88009fe10b1
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nifslk+0x822e:
fffff880`0657922e 0fb650ff movzx edx,byte ptr [rax-1] ds:c8e0:fffff880`09fe10b1=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003091be9 to fffff80003092640
STACK_TEXT:
fffff800`00b9c568 fffff800`03091be9 : 00000000`0000000a fffff880`09fe10b1 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c570 fffff800`03090860 : fffffa80`06adc250 fffffa80`05c3a060 fffffa80`06adc250 00000000`0000ffff : nt!KiBugCheckDispatch+0x69
fffff800`00b9c6b0 fffff880`0657922e : fffff880`05d47468 fffff880`01d91f90 00000000`00000000 fffff880`09fe0770 : nt!KiPageFault+0x260
fffff800`00b9c840 fffff880`05d47468 : fffff880`01d91f90 00000000`00000000 fffff880`09fe0770 fffff880`09fe17a0 : nifslk+0x822e
fffff800`00b9c848 fffff880`01d91f90 : 00000000`00000000 fffff880`09fe0770 fffff880`09fe17a0 fffff880`09fe10b1 : 0xfffff880`05d47468
fffff800`00b9c850 00000000`00000000 : fffff880`09fe0770 fffff880`09fe17a0 fffff880`09fe10b1 fffff800`00b9c8e0 : nipalk+0x75f90
STACK_COMMAND: kb
FOLLOWUP_IP:
nifslk+822e
fffff880`0657922e 0fb650ff movzx edx,byte ptr [rax-1]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nifslk+822e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nifslk
IMAGE_NAME: nifslk.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 51f2daeb
FAILURE_BUCKET_ID: X64_0xD1_nifslk+822e
BUCKET_ID: X64_0xD1_nifslk+822e
Can anyone help me with what this means? -
Im trying to setup the a720 with windows 8 and have this problems: When power off the computer have all time this BSOD : SESSION_HAS_VALID_POOL_ON_EXIT Touchscreen not work.
If I run the windows 8 install, just for test, the touch is working, the problem is after install.
External hard disk not working when connect to any USB port, and unplug result in a system freeze.
Here my mini dump for error SESSION_HAS_VALID_POOL_ON_EXIT, I have the i5 model too and this not happen on that model:
Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com) Online Crash Dump Analysis Service See http://www.osronline.com for more information Windows 8 Kernel Version 9200 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 9200.16384.amd64fre.win8_rtm.120725-1247 Machine Name: Kernel base = 0xfffff800`60081000 PsLoadedModuleList = 0xfffff800`6034ba60 Debug session time: Wed Nov 28 17:08:03.203 2012 (UTC - 5:00) System Uptime: 0 days 0:00:13.897 ******************************************************************************* * * * Bugcheck Analysis * * * *******************************************************************************
SESSION_HAS_VALID_POOL_ON_EXIT (ab) Caused by a session driver not freeing its pool allocations prior to a session unload. This indicates a bug in win32k.sys, atmfd.dll, rdpdd.dll or a video driver. Arguments: Arg1: 0000000000000001, session ID Arg2: 00000000000000f0, number of paged pool bytes that are leaking Arg3: 0000000000000000, number of nonpaged pool bytes that are leaking Arg4: 0000000000000001, total number of paged and nonpaged allocations that are leaking. nonpaged allocations are in the upper half of this word, paged allocations are in the lower half of this word.
Debugging Details: ------------------
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xAB
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80060680506 to fffff800600fc040
STACK_TEXT: fffff880`05d059b8 fffff800`60680506 : 00000000`000000ab 00000000`00000001 00000000`000000f0 00000000`00000000 : nt!KeBugCheckEx fffff880`05d059c0 fffff800`603e8bb5 : fffff880`04983b40 00000000`00000000 fffff880`04983000 ffffffff`ffffffe6 : nt! ?? ::NNGAKEGL::`string'+0x36216 fffff880`05d05a10 fffff800`604a48b6 : 00000000`00000372 fffff880`04983000 fffffa80`090203c0 fffffa80`08fc4540 : nt!MiDereferenceSessionFinal+0xf1 fffff880`05d05a80 fffff800`604abe68 : fffff8a0`00142b00 00000000`00000000 00000000`00000001 00000000`00000001 : nt!MmCleanProcessAddressSpace+0x2be fffff880`05d05af0 fffff800`604ac55e : fffffa80`00000000 00000002`00000001 00000000`00000000 fffff8a0`00d0b8f0 : nt!PspExitThread+0x668 fffff880`05d05c10 fffff800`600e1dd6 : fffff800`60377180 00000000`00000080 fffffa80`090203c0 fffffa80`08fc4540 : nt!PspTerminateThreadByPointer+0x4e fffff880`05d05c60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP: nt! ?? ::NNGAKEGL::`string'+36216 fffff800`60680506 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+36216
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5010ac4b
FAILURE_BUCKET_ID: X64_0xAB_nt!_??_::NNGAKEGL::_string_+36216
BUCKET_ID: X64_0xAB_nt!_??_::NNGAKEGL::_string_+36216
Followup: MachineOwner ---------Ok, the problem is generated by NVIDIA VIDEO DRIVER!
Honesty I cant understand why LENOVO not choose for this machines a ivibridge CPU with HD4000 VIDEO, performance is similar, and Intel VIDEOS GPU, have 0 troubles, ATI AND NVIDIA always are very problematic.
Anyway the solution is simple:
1 Turn OFF windows update, or change to selective install.
This prevent win update install NVIDIA driver in automatic way.
2 Uninstall NVIDIA driver sand NVIDIA related stuff.
3 Restart the machine, NOT POWER OFF, just restart.
4 Now go to SYSTEM PROPERTIES > HARDWARE > DEVICE MANAGER
INSIDE DISPLAY ADPATER NOW SELECT DISABLE THE DEFAULT VGA DRIVER, NOR UNINSTALL CHOOSE DISABLE!
NOW RESTART.
After restart now touchscreen work correctly, and next time you power off the machine, not have that ugly error all time.
This not is a final solution is just a workaround until LENOVO/NVIDIA provide a final fix for this. -
Windows 8.1 kernel_data_inpage_error BSOD
Hey there, had a windows update last night when i logged off, did the usual update and shut down, and it carried on this morning when i switched my PC on.
Since then i have had 3 lock ups of sorts, everything stops responding but the mouse still moves, only way was to hold the power button down on my tower and restart that way.
I then had a BSOD with windows 8.1 kernel_data_inpage_error, iv done a ram check/test and all was fine, scanned/checked my C drive, all is fine, however, doing the /scannow it is saying found corrupt files but was unable to fix some, details in the
CBS log iv attached the log, any help please? :)
http://1drv.ms/1tp6fxb
I also looked for a mini dump file but i couldnt see/find the minid ump folderWe do need the actual log files (called a DMP files) as they contain the only record of the sequence of events leading up to the crash, what drivers
were loaded, and what was responsible.
Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
If you have any questions about the procedure please ask
If you are using Blue screen view, who crashed, or a similar application, don't. They are wrong at least as often as they are correct
Wanikiya and Dyami--Team Zigzag -
The report l runs very night and gets ended with error
Dear all,
I am facing a problem in solution manger. There is an report (Program/Command RDSMOPSOL_MONIREFRESH ) will runs very night and get ended with error and there is Run-time error "MESSAGE_TYPE_X".
Please suggest how to solve the problem.
Is this report is necessary for the system because it is not mention in the sap stand jobs.
SM37 log
Job started
Step 001 started (program RDSMOPSOL_MONIREFRESH, variant &0000000000875, user ID BASIS)
Opening and closing session started. Session SM2000000000065
Opening and closing the session was successful. Session: SM2000000000065
Opening and closing session started. Session SM2000000000005
ABAP/4 processor: MESSAGE_TYPE_X
Job cancelled
SM:CSA SESSION REFRESH
No. Program/Command Prog. type Spool list Parameter User Lang.
1 RDSMOPSOL_MONIREFRESH ABAP &0000000000876 BASIS EN
Sm21 log
00:00:50 DIA 00 000 SAPSYS EEA OPERATION MODES: Switch to operation mode Normal triggered
00:30:57 BTC 08 200 BASIS R68 Perform rollback
00:30:57 BTC 08 200 BASIS AB0 Run-time error "MESSAGE_TYPE_X" occurred
00:30:57 BTC 08 200 BASIS AB1 > Short dump "081112 003057 sapsm BASIS " generated
00:30:57 BTC 08 200 BASIS D01 Transaction Canceled 00 671 ( MESSAGE_TYPE_X 20081112003057sapsm BASIS 2001 )
00:30:57 BTC 08 200 BASIS R68 Perform rollback
00:30:57 BTC 08 200 BASIS AB0 Run-time error "MESSAGE_TYPE_X" occurred
Details
Recording at local and central time........................ 12.11.2008 00:30:57
Task................ 05312 . 08 B8 BTC background processor No. 08
User................ BASIS
Client.............. 200
Terminal............
Session............. 1
Transaction code....
Program name........
Problem class....... T Transaction Problem
Development class... SABP
Further details for this message type
Module name......... abdynpro
Line................ 1133
Error text.......... ab_jmess
Documentation for system log message AB 0 :
The specified runtime error has occurred in the system.
Parameter
a.. MESSAGE_TYPE_X
Technical details
File................ 000048
Position............ 0000253620
Entry type.......... l ( Error (Module, Row) )
Message ID.......... AB 0
Variable parts...... ab_jmess abdynpro1133
Time Ty. Nr Cl. User Tcod MNo Text Date : 12.11.08
00:30:57 BTC 08 200 BASIS AB1 > Short dump "081112 003057 sapsm BASIS " generated
etails
ecording at local and central time........................ 12.11.2008 00:30:57
ask................ 05312 . 08 B8 BTC background processor No. 08
ser................ BASIS
lient.............. 200
erminal............
ession............. 1
ransaction code....
rogram name........
roblem class....... K SAP Web AS Problem
evelopment class... SABP
BAP Mini dump
ate................ 20081112
ime................ 003057
ost................ sapsm
ser................ BASIS
ocumentation for system log message AB 1 :
A short dump was generated for the specified program termination.
You can analyze this short dump in the system log evaluation by
selecting this line or evaluating Table SNAP (Transaction ST22).
echnical details
ile................ 000048
osition............ 0000253800
ntry type.......... s ( ABAP Runtime Error )
essage ID.......... AB 1
ariable parts...... 081112003057sapsm BASIS
Time Ty. Nr Cl. User Tcod MNo Text Date : 12.11.08
00:30:57 BTC 08 200 BASIS D01 Transaction Canceled 00 671 ( MESSAGE_TYPE_X 20081112003057sapsm BASIS 2001 )
Details
Recording at local and central time........................ 12.11.2008 00:30:57
Task................ 05312 . 08 B8 BTC background processor No. 08
User................ BASIS
Client.............. 200
Terminal............
Session............. 1
Transaction code....
Program name........
Problem class....... K SAP Web AS Problem
Development class... SDYN
Module name.........
Location............
T100................ 00 671
Parameters..........
Documentation for system log message D0 1 :
The transaction has been terminated. This may be caused by a
termination message from the application (MESSAGE Axxx) or by an
error detected by the SAP System due to which it makes no sense to
proceed with the transaction. The actual reason for the termination
is indicated by the T100 message and the parameters.
Additional documentation for message 00 671
ABAP/4 processor: &
No documentation exists for message 00671
Parameter
a.. MESSAGE_TYPE_X
00:30:57 BTC 08 200 BASIS R68 Perform rollback
Details
Recording at local and central time........................ 12.11.2008 00:30:57
Task................ 05312 . 08 B8 BTC background processor No. 08
User................ BASIS
Client.............. 200
Terminal............
Session............. 1
Transaction code....
Program name........
Problem class....... W Warning
Development class... STSK
Further details for this message type
Module name......... thxxhead
Line................ 1240
Error text..........
Caller.............. ThIRoll
Reason/called....... roll ba
Documentation for system log message R6 8 :
An error has causes an SAP rollback. All database updates are reset.
Technical details
File................ 000048
Position............ 0000254520
Entry type.......... m ( Error (Function,Module,Row) )
Message ID.......... R6 8
Variable parts...... ThIRollroll bathxxhead1240
Regards,
ShivaHi karteek,
I have check there is Switch of operation mode but when I have checked the t-code sm63 there is no new mode are in normal mode.
There is one thing I want to ask dose this report (Program/Command RDSMOPSOL_MONIREFRESH ) run in your system or any one server because I have think there is some problem in job shued
and is also not mention in the sap stand jobs.
there is an error in sm21 in job.
BASIS SM36 EFK BP_CHECK_REPORT_VALUES: Invalid program values found. Reason:
BASIS SM36 EFC > Program RDSMOPSOL_MONIREFRESH has no variants, but a variant was specified
Is this SM37 log
Job started
Step 001 started (program RDSMOPSOL_MONIREFRESH, variant &0000000000875, user ID BASIS)
Opening and closing session started. Session SM2000000000065
Opening and closing the session was successful. Session: SM2000000000065
Opening and closing session started. Session SM2000000000005
ABAP/4 processor: MESSAGE_TYPE_X
Job cancelled
Sm21 log
SAPSYS EEA OPERATION MODES: Switch to operation mode Normal triggered
BASIS R68 Perform rollback
BASIS AB0 Run-time error "MESSAGE_TYPE_X" occurred
BASIS AB1 > Short dump "081111 003056 sapsm BASIS " generated
BASIS D01 Transaction Canceled 00 671 ( MESSAGE_TYPE_X 20081111003056sapsm BASIS 2001 )
BASIS R68 Perform rollback
BASIS R49 Communication error, CPIC return code 017, SAP return code 223
BASIS R64 > CPI-C function: CMINIT(SAP)
*BASIS SM36 EFK BP_CHECK_REPORT_VALUES: Invalid program values found. Reason:*
*BASIS SM36 EFC > Program RDSMOPSOL_MONIREFRESH has no variants, but a variant was*
specified
BASIS R68 Perform rollback
BASIS AB0 Run-time error "MESSAGE_TYPE_X" occurred
BASIS AB1 > Short dump "081111 220948 sapsm BASIS " generated
BASIS D01 Transaction Canceled 00 671 ( MESSAGE_TYPE_X 20081111220948sapsm BASIS 2001 )
Details Page 2 Line 6 System Log: Local Analysis of sapsm 1
Time Ty. Nr Cl. User Tcod MNo Text
00:00:51 DIA 00 000 SAPSYS EEA OPERATION MODES: Switch to operation mode Normal triggered
Details
Recording at local and central time........................ 13.11.2008 00:00:51
Task................ 04100 . 00 D0 Dialog work process No. 00
User................ SAPSYS
Client.............. 000
Terminal............
Session............. 1
Transaction code....
Program name........
Problem class....... S Operation Trace
Development class... SBTC
Sm63
Start/end time Name of the active operation mode
00.00 - 01.00 Normal
01.00 - 02.00 Normal
02.00 - 03.00 Normal
03.00 - 04.00 Normal
04.00 - 05.00 Normal
05.00 - 06.00 Normal
06.00 - 07.00 Normal
07.00 - 08.00 Normal
08.00 - 09.00 Normal
09.00 - 10.00 Normal
10.00 - 11.00 Normal
11.00 - 12.00 Normal
12.00 - 13.00 Normal
13.00 - 14.00 Normal
14.00 - 15.00 Normal
15.00 - 16.00 Normal
16.00 - 17.00 Normal
17.00 - 18.00 Normal
18.00 - 19.00 Normal
19.00 - 20.00 Normal
20.00 - 21.00 Normal
21.00 - 22.00 Normal
22.00 - 23.00 Normal
23.00 - 00.00 Normal
Regards, -
FireFox sometimes crashes when you open it. Not always.
I run Win7 64 bit and have been having intermittent problems where FireFox will crash maybe 5 or 6 times a day when I try to open it. Then other times FireFox opens just fine. I have the mini dump file that was generated as well as the the Event Viewer Errors that show up.
Hopefully these files will be helpful, but I am not sure how to include them in this question.See:
*http://www.mozilla.org/en-US/firefox/channel/
*http://nightly.mozilla.org/
Note that the Aurora (28.0a2) and Nightly (29.0a1) build are updated daily and can be unstable being alpha releases.<br />
You always need to install such a version alongside of the current release via a custom install and use a separate profile for each Firefox version.
Make sure not to start Firefox after the installation has finished and use the Profile Manager to create a new (separate) profile for each version.<br />
Do a custom install in a different program folder and use the Profile Manager to create a new profile for this version, so make sure not to start Firefox after the installation has finished.
* http://kb.mozillazine.org/Testing_pre-release_versions
* http://kb.mozillazine.org/Profile_Manager#Creating_a_new_profile
* http://kb.mozillazine.org/Shortcut_to_a_specific_profile -
Windows Server 2008 R2 SP1 - BSOD Stop Error 0x00000050 RDPWD.SYS
Hi all,
I have been struggling with a BSOD for the past 5 weeks and have scoured the web trying in vain to find someone else with the same issue.
Environment:
8 x 2008 R2 SP1 Windows Servers (8Gb RAM, 25Gb HDD) with Remote Desktop Services Roles installed, running as part of an RDS Farm. All Servers are VM Guests (hardware version 7) running on VMware vSphere v4.1.0-260247 Hosts (Dell
PowerEdge R710 - 128Gb RAM). Our vSphere 'farm' has 5 Hosts that connect to our EMC SAN via iSCSI with multipath routes.
Each RDS Server is load balanced via a Connection Broker, and each server has the same set of software / vm hardware installed. In a nutshell, each has Symantec Endpoint Protection v11.0.5002.333, Symantec Altiris v7.0, Microsoft Office 2007 as well as
other various software essential to these servers.
Symptoms:
Randomly throughout the day, one (or more) of the RDS Servers will crash with a BSOD more often than not with "caused by driver ntoskrnl.exe" sometimes with "cng.sys" and once with "ksecpkg.sys". So far in the 5 weeks I have had 90 crashes. Yesterday
all 8 of the RDS Servers crashed at some point throughout the day.
On a typical BSOD, it says:
The problem seems to be caused by the following file: ntoskrnl.exe
PAGE_FAULT_IN_NONPAGED_AREA
Technical Information:
*** STOP: 0x00000050 (0xfffffa800c153284, 0x0000000000000001, 0xfffff880053dc0c9, 0x0000000000000000)
*** ntoskrnl.exe - Address 0xfffff8000169ac40 base at 0xfffff8000161e000 DateStamp 0x4e02aaa3
Using BlueScreenView it says "caused by address: ntoskrnl.exe+7cc40" nearly every time.
I have analysed as best I could using Microsoft WinDbg, and this is the output of a typical mini-dump file:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [\\hqrds01\c$\Windows\Minidump\030112-19359-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows (x64)\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: Server, suite: TerminalServer
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01609000 PsLoadedModuleList = 0xfffff800`0184e670
Debug session time: Thu Mar 1 09:14:00.921 2012 (UTC + 0:00)
System Uptime: 0 days 21:31:41.950
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
* Bugcheck Analysis
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa800be83284, 1, fffff8800576f0c9, 0}
Could not read faulting driver name
Probably caused by : RDPWD.SYS ( RDPWD!memcpy+1d9 )
Followup: MachineOwner
1: kd> !analyze -v
* Bugcheck Analysis
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800be83284, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff8800576f0c9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800018b8100
fffffa800be83284
FAULTING_IP:
RDPWD!memcpy+1d9
fffff880`0576f0c9 668901 mov word ptr [rcx],ax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800bf70a80 -- (.trap 0xfffff8800bf70a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000023d rbx=0000000000000000 rcx=fffffa800be83284
rdx=ffffffffffe7e63b rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800576f0c9 rsp=fffff8800bf70c18 rbp=0000000000000001
r8=000000000000001c r9=fffff8a0033401e8 r10=fffff8a0033401e8
r11=fffffa800be83268 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
RDPWD!memcpy+0x1d9:
fffff880`0576f0c9 668901 mov word ptr [rcx],ax ds:0c40:fffffa80`0be83284=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800016319fc to fffff80001685c40
STACK_TEXT:
fffff880`0bf70918 fffff800`016319fc : 00000000`00000050 fffffa80`0be83284 00000000`00000001 fffff880`0bf70a80 : nt!KeBugCheckEx
fffff880`0bf70920 fffff800`01683d6e : 00000000`00000001 fffffa80`0be83284 00000000`00000000 fffff8a0`0be85820 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0bf70a80 fffff880`0576f0c9 : fffff880`057547cf 00000000`00000000 00000000`00000022 00000000`00000002 : nt!KiPageFault+0x16e
fffff880`0bf70c18 fffff880`057547cf : 00000000`00000000 00000000`00000022 00000000`00000002 fffff880`0576c99d : RDPWD!memcpy+0x1d9
fffff880`0bf70c20 fffff880`0576c9fc : fffff8a0`0f938010 00000000`00000022 00000000`00000019 00000000`00000002 : RDPWD!SM_MCSSendDataCallback+0x303
fffff880`0bf70c60 fffff880`0576b354 : fffff880`0bf70da0 fffff8a0`033401e8 00000000`00000000 fffff880`0576abfd : RDPWD!HandleAllSendDataPDUs+0x188
fffff880`0bf70d10 fffff880`0576af64 : 00000000`00000031 fffffa80`0bd01895 00000006`0000001f fffff880`05739079 : RDPWD!RecognizeMCSFrame+0x28
fffff880`0bf70d50 fffff880`029ba1f8 : fffff8a0`03345000 fffffa80`0bae6e80 fffffa80`0a5c0e60 fffff880`05737e00 : RDPWD!MCSIcaRawInputWorker+0x3d4
fffff880`0bf70df0 fffff880`057378d0 : 00000000`00000000 fffff880`0bf70f10 fffff880`0bf70f08 00000000`00000000 : termdd!IcaRawInput+0x50
fffff880`0bf70e20 fffff880`05736d85 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`0bf70e50 fffff880`057367c2 : fffffa80`088e8a28 fffffa80`00000000 00000000`00000031 fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`0bf70ef0 fffff880`029ba1f8 : fffff880`009b8180 00000000`00000001 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`0bf70f60 fffff880`0572c4c5 : fffffa80`088e8a10 fffffa80`0bd01658 00000000`00000000 fffffa80`088e8a10 : termdd!IcaRawInput+0x50
fffff880`0bf70f90 fffff880`029baf3e : fffffa80`0bd01620 fffffa80`0c100420 fffffa80`0bd4b450 fffffa80`0973b9b0 : tdtcp!TdInputThread+0x465
fffff880`0bf71810 fffff880`029b9ae3 : fffffa80`09d902b0 fffffa80`0973b9b0 fffffa80`093d8520 fffffa80`0bd4b450 : termdd!IcaDriverThread+0x5a
fffff880`0bf71840 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
STACK_COMMAND: kb
FOLLOWUP_IP:
RDPWD!memcpy+1d9
fffff880`0576f0c9 668901 mov word ptr [rcx],ax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: RDPWD!memcpy+1d9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPWD
IMAGE_NAME: RDPWD.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7ab45
FAILURE_BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
Followup: MachineOwner
The RDS servers are set to reboot automatically, and after a period of 5 minutes or so, the users can reconnect and log back in. On a typical day each server will have around 10 people RDP'd in to them.
The Users connecting to the RDS Servers included XP laptops/desktops and IGEL UD-120-LX Thin Terminals. The XPs have SP3 installed and are fully patched via Symantec Altiris.
Things I have tried:
- Analyse the dump-files (as per above).
- I have tracked each user logging on to the RDS Farm (via batch scripts) and tried to determine if this is caused by the same individual(s) but it appears random.
- Check to see if the crashing Virtual Machine is running on a specific host, but it has happened on all Hosts.
- Check to see if there was anything specific that happened on the day that the crashes started. There were about 5 new poeple introduced to the RDS Farm at that time, but there were using (a) client machines that had been used previously elsewhere with
no issues, (b) software that had been used previously, (c) in a remote location that had previous users using RDS, (d) have not been logged on to a RDS Server when it has crashed.
- Updated Windows Server 2008 R2 SP1 to the latest patches (as of Feb 2012).
- Turned on Verifier (using recommended settings), and then analysed dump-files with the same reference to rdpwd.sys.
- Fixed the Memory Resource Reservation in vSphere to the full 8Gb for all these RDS Servers (so that the memory is not shared at all).
- Ran MEMTEST on a VM Guest with the full 8Gb RAM, on a couple of the ESX Hosts.
- Changed the VMTools Video Driver to the SVGA II driver from the Standard VGA Driver.
- Ran a full AV Scan (using SEP).
- Isolated the Printer Drivers using the Printer Management MMC.
- Ran sfc /scannow of all RDS Servers and rebooted.
The mini-dump file mentioned above is here:https://skydrive.live.com/redir.aspx?cid=48f471f287af2349&resid=48F471F287AF2349!105&parid=48F471F287AF2349!103
I hope someone can help, as what hair I have left (from pulling it out) is turning grey!
Andy* Bugcheck Analysis
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800c153284, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff880053dc0c9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800018cd100
fffffa800c153284
FAULTING_IP:
RDPWD!memcpy+1d9
fffff880`053dc0c9 668901 mov word ptr [rcx],ax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800aa48a80 -- (.trap 0xfffff8800aa48a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000001ff rbx=0000000000000000 rcx=fffffa800c153284
rdx=ffffffffffee6b8b rsi=0000000000000000 rdi=0000000000000000
rip=fffff880053dc0c9 rsp=fffff8800aa48c18 rbp=0000000000000001
r8=000000000000001c r9=fffff8a0123923a8 r10=fffff8a0123923a8
r11=fffffa800c153268 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
RDPWD!memcpy+0x1d9:
fffff880`053dc0c9 668901 mov word ptr [rcx],ax ds:8c40:fffffa80`0c153284=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800016469fc to fffff8000169ac40
STACK_TEXT:
fffff880`0aa48918 fffff800`016469fc : 00000000`00000050 fffffa80`0c153284 00000000`00000001 fffff880`0aa48a80 : nt!KeBugCheckEx
fffff880`0aa48920 fffff800`01698d6e : 00000000`00000001 fffffa80`0c153284 00000000`00000000 fffff8a0`10919830 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0aa48a80 fffff880`053dc0c9 : fffff880`053c17cf 00000000`00000000 00000000`00000022 00000000`00000002 : nt!KiPageFault+0x16e
fffff880`0aa48c18 fffff880`053c17cf : 00000000`00000000 00000000`00000022 00000000`00000002 fffff880`053d999d : RDPWD!memcpy+0x1d9
fffff880`0aa48c20 fffff880`053d99fc : fffff8a0`10cf30d0 00000000`00000022 00000000`00000019 00000000`00000002 : RDPWD!SM_MCSSendDataCallback+0x303
fffff880`0aa48c60 fffff880`053d8354 : fffff880`0aa48da0 fffff8a0`123923a8 00000000`00000000 fffff880`053d7bfd : RDPWD!HandleAllSendDataPDUs+0x188
fffff880`0aa48d10 fffff880`053d7f64 : 00000000`00000031 fffffa80`0c039de5 00000006`0000001f fffff880`053a6079 : RDPWD!RecognizeMCSFrame+0x28
fffff880`0aa48d50 fffff880`012c01f8 : fffff8a0`12393000 fffffa80`0bb7aa60 fffffa80`0b81e9c0 fffff880`053a4e00 : RDPWD!MCSIcaRawInputWorker+0x3d4
fffff880`0aa48df0 fffff880`053a48d0 : 00000000`00000000 fffff880`0aa48f10 fffff880`0aa48f08 fffffa80`0c039ba8 : termdd!IcaRawInput+0x50
fffff880`0aa48e20 fffff880`053a3d85 : fffff880`01716890 fffffa80`0c0327e8 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`0aa48e50 fffff880`053a37c2 : fffffa80`0c16e598 fffffa80`00000000 00000000`00000031 fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`0aa48ef0 fffff880`012c01f8 : fffff880`009b8180 00000000`00000001 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`0aa48f60 fffff880`052994c5 : fffffa80`0c16e580 fffffa80`0c039ba8 00000000`00000000 fffffa80`0c16e580 : termdd!IcaRawInput+0x50
fffff880`0aa48f90 fffff880`012c0f3e : fffffa80`0c039b70 fffffa80`0acccf20 fffffa80`0a95c450 fffffa80`0abf9620 : tdtcp!TdInputThread+0x465
fffff880`0aa49810 fffff880`012bfae3 : fffffa80`0c0a6560 fffffa80`0abf9620 fffffa80`087eee80 fffffa80`0a95c450 : termdd!IcaDriverThread+0x5a
fffff880`0aa49840 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
STACK_COMMAND: kb
FOLLOWUP_IP:
RDPWD!memcpy+1d9
fffff880`053dc0c9 668901 mov word ptr [rcx],ax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: RDPWD!memcpy+1d9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPWD
IMAGE_NAME: RDPWD.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7ab45
FAILURE_BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
Followup: MachineOwner
Bug Check Code 0x50:http://msdn.microsoft.com/en-us/library/windows/hardware/ff559023%28v=vs.85%29.aspx
Please start by that:
Update all possible drivers
Uninstall all unused programs
Disable all security softwares you have
Run chkdsk /r /f and sfc /scannow
Run memtest86+ to check if all is okay with your RAM. If an error was detected then replace the faulty RAM or contact your manufacturer Technical Support
If this does not help then upload MEMORY.DMP file (You can zip it and divide it using 7-ZIP) using Microsoft Skydrive and post a link here.
You can also contact Microsoft CSS for assistance.
This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner 2010 / 2011
Microsoft
Certified Professional
Microsoft
Certified Systems Administrator: Security
Microsoft
Certified Systems Engineer: Security
Microsoft
Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft
Certified IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer -
BSOD on Server 2012 running dfs namespace and dfs replication roles with deduplication
Hello,
I have recently setup 2 dfsn & dfsr servers, both 2012 one physical the other virtual.
The idea is to have one server as primary and the other as a failover \ DR.
The primary server is virtual and connects via mpio \ iscsi to a dell san, using the provided dell DSM Drivers.
The secondary server is physical with local disk for storage.
I copy files to a namespace setup to always prefer the primary server, these files are then replicated across to the secondary.
I have also turned on deduplication on both servers to get the most out of the available storage.
This has been working well for 6 months or so, there have however been 2-3 occasions where the primary virtual server has crashed and blue screened causing the DFSR database to undergo a full consistency check.
The bug check errors i have managed to extract from the Memory.dmp and mini dump are as follows:
* Bugcheck Analysis
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: fffffa80379a3070, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: ffffffffffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object?s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: dfsrs.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre
LAST_CONTROL_TRANSFER: from fffff800999ee0d7 to fffff8009985a440
STACK_TEXT:
fffff880`0bf3fb48 fffff800`999ee0d7 : 00000000`00000018 00000000`00000000 fffffa80`379a3070 00000000`00000002 : nt!KeBugCheckEx
fffff880`0bf3fb50 fffff800`99c33529 : fffffa80`379a3070 fffff8a0`0244adc0 00000000`000017e4 0000001b`930b60d8 : nt! ?? ::FNODOBFM::`string'+0x38605
fffff880`0bf3fb90 fffff800`99859453 : fffffa80`4063db00 fffffa80`4063db00 fffff880`0bf3fcc0 00000000`00000001 : nt!NtClose+0x239
fffff880`0bf3fc40 000007ff`5e8d2cda : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000001b`9069f398 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007ff`5e8d2cda
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+38605
fffff800`999ee0d7 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+38605
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 51a966cd
IMAGE_VERSION: 6.2.9200.16628
BUCKET_ID_FUNC_OFFSET: 38605
FAILURE_BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!_??_::FNODOBFM::_string_
BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!_??_::FNODOBFM::_string_
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x18_over_dereference_nt!_??_::fnodobfm::_string_
FAILURE_ID_HASH: {eaf19261-0688-f327-a17d-6f7960ac4ebd}
Followup: MachineOwner
rax=0000000000000000 rbx=ffffffffffffffff rcx=0000000000000018
rdx=0000000000000000 rsi=fffffa80379a3070 rdi=00000000fffc000c
rip=fffff8009985a440 rsp=fffff8800bf3fb48 rbp=fffffa80379a3040
r8=fffffa80379a3070 r9=0000000000000002 r10=fffffa8030d89190
r11=fffffa804063db00 r12=00000000000017e4 r13=0000000000000000
r14=fffff8a00a548f90 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
nt!KeBugCheckEx:
fffff800`9985a440 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff880`0bf3fb50=0000000000000018
Child-SP RetAddr : Args to Child
: Call Site
fffff880`0bf3fb48 fffff800`999ee0d7 : 00000000`00000018 00000000`00000000 fffffa80`379a3070 00000000`00000002 : nt!KeBugCheckEx
fffff880`0bf3fb50 fffff800`99c33529 : fffffa80`379a3070 fffff8a0`0244adc0 00000000`000017e4 0000001b`930b60d8 : nt! ?? ::FNODOBFM::`string'+0x38605
fffff880`0bf3fb90 fffff800`99859453 : fffffa80`4063db00 fffffa80`4063db00 fffff880`0bf3fcc0 00000000`00000001 : nt!NtClose+0x239
fffff880`0bf3fc40 000007ff`5e8d2cda : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0bf3fc40)
0000001b`9069f398 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007ff`5e8d2cda
start end module name
fffff800`987b1000 fffff800`987ba000 kd kd.dll Thu Jul 26 03:30:34 2012 (5010ABCA)
fffff800`99800000 fffff800`99f4c000 nt ntkrnlmp.exe Sat Jun 01 04:13:17 2013 (51A966CD)
fffff800`99f4c000 fffff800`99fb8000 hal hal.dll Wed Oct 24 04:03:21 2012 (50875A79)
fffff880`00a00000 fffff880`00a34000 ataport ataport.SYS Thu Jul 26 03:29:04 2012 (5010AB70)
fffff880`00a34000 fffff880`00a51000 lsi_sas lsi_sas.sys Fri May 11 20:40:21 2012 (4FAD6B25)
fffff880`00a51000 fffff880`00a5e000 serenum serenum.sys Thu Jul 26 03:30:13 2012 (5010ABB5)
fffff880`00a5e000 fffff880`00a6c000 fdc fdc.sys Thu Jul 26 03:30:15 2012 (5010ABB7)
fffff880`00a7b000 fffff880`00adb000 volmgrx volmgrx.sys Thu Jul 26 03:29:59 2012 (5010ABA7)
fffff880`00adb000 fffff880`00ae4000 intelide intelide.sys Thu Jul 26 03:29:52 2012 (5010ABA0)
fffff880`00ae4000 fffff880`00af3000 PCIIDEX PCIIDEX.SYS Thu Jul 26 03:29:09 2012 (5010AB75)
fffff880`00af3000 fffff880`00b56000 md3dsm md3dsm.sys Wed Aug 22 22:14:46 2012 (50354BC6)
fffff880`00b56000 fffff880`00b87000 msdsm msdsm.sys Sat Oct 05 04:32:09 2013 (524F8839)
fffff880`00b87000 fffff880`00ba0000 vmci vmci.sys Tue May 01 02:14:27 2012 (4F9F38F3)
fffff880`00ba0000 fffff880`00bb5000 vsock vsock.sys Fri Aug 30 20:25:34 2013 (5220F1AE)
fffff880`00bb5000 fffff880`00bcf000 mountmgr mountmgr.sys Thu Jul 26 03:29:33 2012 (5010AB8D)
fffff880`00bcf000 fffff880`00bd9000 atapi atapi.sys Thu Jul 26 03:30:33 2012 (5010ABC9)
fffff880`00bd9000 fffff880`00bf0000 vmxnet3n61x64 vmxnet3n61x64.sys Fri Sep 27 10:40:11 2013 (5245527B)
fffff880`00bf0000 fffff880`00bfa000 pnpmem pnpmem.sys Thu Jul 26 03:30:11 2012 (5010ABB3)
fffff880`00c40000 fffff880`00c9f000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Thu Jul 26 03:30:12 2012 (5010ABB4)
fffff880`00c9f000 fffff880`00cfb000 CLFS CLFS.SYS Thu Jul 26 03:29:39 2012 (5010AB93)
fffff880`00cfb000 fffff880`00d1e000 tm tm.sys Thu Jul 26 03:29:01 2012 (5010AB6D)
fffff880`00d1e000 fffff880`00d33000 PSHED PSHED.dll Thu Jul 26 05:53:53 2012 (5010CD61)
fffff880`00d33000 fffff880`00d3d000 BOOTVID BOOTVID.dll Thu Jul 26 03:30:22 2012 (5010ABBE)
fffff880`00d3d000 fffff880`00dbc000 CI CI.dll Thu Mar 28 03:30:42 2013 (5153B962)
fffff880`00dbc000 fffff880`00de1000 rasl2tp rasl2tp.sys Thu Jul 26 03:23:16 2012 (5010AA14)
fffff880`00e00000 fffff880`00e49000 spaceport spaceport.sys Sat Oct 05 04:32:08 2013 (524F8838)
fffff880`00e49000 fffff880`00e61000 volmgr volmgr.sys Thu Jul 26 03:29:22 2012 (5010AB82)
fffff880`00e61000 fffff880`00ea9000 vm3dmp vm3dmp.sys Wed Oct 09 05:25:53 2013 (5254DAD1)
fffff880`00eb5000 fffff880`00f41000 cng cng.sys Thu Oct 11 06:17:34 2012 (5076566E)
fffff880`00f41000 fffff880`00f5b000 raspppoe raspppoe.sys Thu Jul 26 03:24:55 2012 (5010AA77)
fffff880`00f5c000 fffff880`00f99000 mpio mpio.sys Sat Sep 28 04:37:24 2013 (52464EF4)
fffff880`00f99000 fffff880`00fd3000 md3utm md3utm.sys Wed Aug 22 22:14:56 2012 (50354BD0)
fffff880`00fd3000 fffff880`00fef000 intelppm intelppm.sys Tue Nov 06 03:55:02 2012 (50988A16)
fffff880`01000000 fffff880`0106d000 ACPI ACPI.sys Thu Sep 20 07:09:16 2012 (505AB30C)
fffff880`01075000 fffff880`010d8000 msrpc msrpc.sys Thu Jul 26 03:28:37 2012 (5010AB55)
fffff880`010d8000 fffff880`0119a000 Wdf01000 Wdf01000.sys Sat Jun 22 04:13:05 2013 (51C51641)
fffff880`0119a000 fffff880`011aa000 WDFLDR WDFLDR.SYS Sat Jun 22 04:14:38 2013 (51C5169E)
fffff880`011aa000 fffff880`011c1000 acpiex acpiex.sys Thu Jul 26 03:25:57 2012 (5010AAB5)
fffff880`011c1000 fffff880`011cc000 WppRecorder WppRecorder.sys Thu Jul 26 03:29:07 2012 (5010AB73)
fffff880`011cc000 fffff880`011d6000 WMILIB WMILIB.SYS Thu Jul 26 03:30:04 2012 (5010ABAC)
fffff880`011d6000 fffff880`011f7000 raspptp raspptp.sys Thu Jul 26 03:23:13 2012 (5010AA11)
fffff880`01400000 fffff880`0140d000 vdrvroot vdrvroot.sys Thu Jul 26 03:27:29 2012 (5010AB11)
fffff880`0140d000 fffff880`01424000 pdc pdc.sys Fri Mar 01 04:58:34 2013 (5130357A)
fffff880`01424000 fffff880`0143e000 partmgr partmgr.sys Wed Jan 09 04:01:42 2013 (50ECEBA6)
fffff880`01444000 fffff880`0153f000 NDIS NDIS.SYS Sat Jun 15 06:11:35 2013 (51BBF787)
fffff880`0153f000 fffff880`015ae000 NETIO NETIO.SYS Thu Oct 11 06:16:20 2012 (50765624)
fffff880`015ae000 fffff880`015b8000 msisadrv msisadrv.sys Thu Jul 26 03:28:02 2012 (5010AB32)
fffff880`015b8000 fffff880`015f5000 pci pci.sys Thu Jul 26 03:27:43 2012 (5010AB1F)
fffff880`01800000 fffff880`01816000 datascrn datascrn.sys Thu Jul 26 03:29:13 2012 (5010AB79)
fffff880`01816000 fffff880`01824000 cbafilt cbafilt.sys Thu Jul 26 03:29:05 2012 (5010AB71)
fffff880`01824000 fffff880`0186c000 msiscsi msiscsi.sys Mon Feb 03 16:23:09 2014 (52EFC26D)
fffff880`0186c000 fffff880`01877000 kdnic kdnic.sys Thu Jul 26 03:27:41 2012 (5010AB1D)
fffff880`01877000 fffff880`01889000 umbus umbus.sys Thu Jul 26 03:27:39 2012 (5010AB1B)
fffff880`01889000 fffff880`018a9000 i8042prt i8042prt.sys Thu Jul 26 03:28:50 2012 (5010AB62)
fffff880`018a9000 fffff880`018b8000 kbdclass kbdclass.sys Thu Jul 26 03:28:47 2012 (5010AB5F)
fffff880`018b8000 fffff880`018c7000 mouclass mouclass.sys Thu Jul 26 03:28:47 2012 (5010AB5F)
fffff880`018c7000 fffff880`018e5000 parport parport.sys Thu Jul 26 03:29:53 2012 (5010ABA1)
fffff880`018e5000 fffff880`018fd000 serial serial.sys Thu Jul 26 03:30:01 2012 (5010ABA9)
fffff880`018fd000 fffff880`01952000 storport storport.sys Mon Feb 03 16:23:24 2014 (52EFC27C)
fffff880`01952000 fffff880`019b2000 fltmgr fltmgr.sys Thu Jul 26 03:30:09 2012 (5010ABB1)
fffff880`019b2000 fffff880`019e0000 quota quota.sys Thu Jul 26 03:29:14 2012 (5010AB7A)
fffff880`019e0000 fffff880`019f4000 dfsrro dfsrro.sys Thu Jul 26 03:29:13 2012 (5010AB79)
fffff880`019f4000 fffff880`01a00000 BATTC BATTC.SYS Thu Oct 11 06:19:58 2012 (507656FE)
fffff880`01a00000 fffff880`01a2c000 tunnel tunnel.sys Thu Jul 26 03:23:04 2012 (5010AA08)
fffff880`01a2c000 fffff880`01a3b000 CompositeBus CompositeBus.sys Thu Jul 26 03:28:03 2012 (5010AB33)
fffff880`01a3b000 fffff880`01a45000 vmgencounter vmgencounter.sys Thu Jul 26 03:27:58 2012 (5010AB2E)
fffff880`01a45000 fffff880`01c2a000 Ntfs Ntfs.sys Sun Jan 26 23:28:35 2014 (52E59A23)
fffff880`01c2a000 fffff880`01c45000 ksecdd ksecdd.sys Thu Sep 20 07:09:16 2012 (505AB30C)
fffff880`01c45000 fffff880`01c56000 pcw pcw.sys Thu Jul 26 03:28:44 2012 (5010AB5C)
fffff880`01c56000 fffff880`01c60000 Fs_Rec Fs_Rec.sys Thu Jul 26 03:30:08 2012 (5010ABB0)
fffff880`01c60000 fffff880`01c8f000 ksecpkg ksecpkg.sys Thu Oct 11 06:16:46 2012 (5076563E)
fffff880`01c8f000 fffff880`01cc0000 cdrom cdrom.sys Thu Jul 26 03:26:36 2012 (5010AADC)
fffff880`01cc0000 fffff880`01d2b000 dedup dedup.sys Sat Oct 05 04:31:38 2013 (524F881A)
fffff880`01d2b000 fffff880`01d3a000 vmrawdsk vmrawdsk.sys Sun Dec 15 03:36:38 2013 (52AD23C6)
fffff880`01d3a000 fffff880`01d47000 BasicRender BasicRender.sys Thu Jul 26 03:28:51 2012 (5010AB63)
fffff880`01d47000 fffff880`01d53000 mssmbios mssmbios.sys Thu Jul 26 03:29:19 2012 (5010AB7F)
fffff880`01d53000 fffff880`01d64000 discache discache.sys Thu Jul 26 03:28:23 2012 (5010AB47)
fffff880`01d64000 fffff880`01d85000 dfsc dfsc.sys Wed Jan 15 23:42:58 2014 (52D71D02)
fffff880`01d85000 fffff880`01d91000 ndistapi ndistapi.sys Thu Sep 20 07:09:19 2012 (505AB30F)
fffff880`01d91000 fffff880`01dc0000 ndiswan ndiswan.sys Thu Jul 26 03:23:13 2012 (5010AA11)
fffff880`01dc0000 fffff880`01dde000 rassstp rassstp.sys Thu Jul 26 03:23:59 2012 (5010AA3F)
fffff880`01dde000 fffff880`01df6000 AgileVpn AgileVpn.sys Thu Jul 26 03:23:11 2012 (5010AA0F)
fffff880`01df6000 fffff880`01dfc400 CmBatt CmBatt.sys Thu Jul 26 03:29:20 2012 (5010AB80)
fffff880`01e00000 fffff880`01e54000 CLASSPNP CLASSPNP.SYS Sat Jun 29 04:07:45 2013 (51CE4F81)
fffff880`01e54000 fffff880`01e68000 crashdmp crashdmp.sys Fri Aug 30 04:11:28 2013 (52200D60)
fffff880`01e75000 fffff880`01e7e000 Null Null.SYS Thu Jul 26 03:30:16 2012 (5010ABB8)
fffff880`01e81000 fffff880`020ba000 tcpip tcpip.sys Wed Jan 22 04:28:22 2014 (52DF48E6)
fffff880`020ba000 fffff880`02122000 fwpkclnt fwpkclnt.sys Fri Mar 01 04:55:54 2013 (513034DA)
fffff880`02122000 fffff880`0213d000 wfplwfs wfplwfs.sys Thu Oct 10 04:32:19 2013 (52561FC3)
fffff880`0213d000 fffff880`02191000 volsnap volsnap.sys Sat Jun 01 04:10:22 2013 (51A9661E)
fffff880`02191000 fffff880`021a8000 mup mup.sys Thu Jul 26 03:30:00 2012 (5010ABA8)
fffff880`021a8000 fffff880`021b4000 npsvctrig npsvctrig.sys Thu Jul 26 03:27:33 2012 (5010AB15)
fffff880`021b4000 fffff880`021d0000 disk disk.sys Sat Oct 12 07:31:15 2013 (5258ECB3)
fffff880`021ed000 fffff880`021ff000 dfs dfs.sys Thu Jul 26 03:28:21 2012 (5010AB45)
fffff880`03800000 fffff880`03863000 mrxsmb mrxsmb.sys Tue Feb 05 22:29:08 2013 (511187B4)
fffff880`0389c000 fffff880`038eb000 ks ks.sys Sat Feb 02 07:25:50 2013 (510CBF7E)
fffff880`038eb000 fffff880`038f6000 rdpbus rdpbus.sys Thu Jul 26 03:28:19 2012 (5010AB43)
fffff880`038f6000 fffff880`0390a000 NDProxy NDProxy.SYS Tue Apr 09 03:33:41 2013 (51637E05)
fffff880`0390a000 fffff880`03915000 flpydisk flpydisk.sys Thu Jul 26 03:30:15 2012 (5010ABB7)
fffff880`03915000 fffff880`03922000 dump_diskdump dump_diskdump.sys Thu Jul 26 03:29:58 2012 (5010ABA6)
fffff880`03922000 fffff880`0393f000 dump_LSI_SAS dump_LSI_SAS.sys Fri May 11 20:40:21 2012 (4FAD6B25)
fffff880`0393f000 fffff880`03947000 HIDPARSE HIDPARSE.SYS Sat Jun 29 04:08:18 2013 (51CE4FA2)
fffff880`03947000 fffff880`03955000 monitor monitor.sys Fri Mar 01 04:56:18 2013 (513034F2)
fffff880`03955000 fffff880`0397d000 luafv luafv.sys Thu Jul 26 03:29:13 2012 (5010AB79)
fffff880`0397d000 fffff880`03991000 lltdio lltdio.sys Thu Jul 26 03:24:02 2012 (5010AA42)
fffff880`03991000 fffff880`039a9000 rspndr rspndr.sys Thu Jul 26 03:24:06 2012 (5010AA46)
fffff880`039a9000 fffff880`039c9000 bowser bowser.sys Thu Jul 26 03:28:01 2012 (5010AB31)
fffff880`039c9000 fffff880`039e0000 mpsdrv mpsdrv.sys Thu Oct 31 03:42:19 2013 (5271D19B)
fffff880`03c00000 fffff880`03c73000 rdbss rdbss.sys Sat May 04 05:47:00 2013 (518492C4)
fffff880`03c73000 fffff880`03c8d000 wanarp wanarp.sys Tue Apr 09 03:31:00 2013 (51637D64)
fffff880`03c8d000 fffff880`03c9b000 nsiproxy nsiproxy.sys Thu Jul 26 03:25:00 2012 (5010AA7C)
fffff880`03c9b000 fffff880`03ca3000 vmmouse vmmouse.sys Mon Jun 04 10:34:25 2012 (4FCC8121)
fffff880`03ca3000 fffff880`03e0c000 dxgkrnl dxgkrnl.sys Thu Sep 19 04:16:23 2013 (523A6C87)
fffff880`03e0c000 fffff880`03e1d000 watchdog watchdog.sys Thu Jul 26 03:29:05 2012 (5010AB71)
fffff880`03e1d000 fffff880`03e6b000 dxgmms1 dxgmms1.sys Wed Jan 09 03:58:58 2013 (50ECEB02)
fffff880`03e6b000 fffff880`03e7c000 BasicDisplay BasicDisplay.sys Thu Jul 26 03:29:08 2012 (5010AB74)
fffff880`03e7c000 fffff880`03e8e000 Npfs Npfs.SYS Thu Jul 26 03:30:26 2012 (5010ABC2)
fffff880`03e8e000 fffff880`03e9a000 Msfs Msfs.SYS Thu Jul 26 03:30:24 2012 (5010ABC0)
fffff880`03e9a000 fffff880`03ebc000 tdx tdx.sys Thu Jul 26 03:24:58 2012 (5010AA7A)
fffff880`03ebc000 fffff880`03eca000 TDI TDI.SYS Thu Jul 26 03:27:59 2012 (5010AB2F)
fffff880`03eca000 fffff880`03ed6000 ws2ifsl ws2ifsl.sys Thu Sep 20 07:09:50 2012 (505AB32E)
fffff880`03ed6000 fffff880`03f2e000 netbt netbt.sys Thu Jul 26 03:24:26 2012 (5010AA5A)
fffff880`03f2e000 fffff880`03fc4000 afd afd.sys Wed Sep 04 04:11:20 2013 (5226A4D8)
fffff880`03fc4000 fffff880`03fee000 pacer pacer.sys Thu Jul 26 03:23:05 2012 (5010AA09)
fffff880`03fee000 fffff880`03ffe000 netbios netbios.sys Thu Jul 26 03:28:19 2012 (5010AB43)
fffff880`03ffe000 fffff880`03fff480 swenum swenum.sys Thu Jul 26 03:28:53 2012 (5010AB65)
fffff880`0ac00000 fffff880`0acdf000 HTTP HTTP.sys Fri Mar 15 00:17:15 2013 (5142688B)
fffff880`0acdf000 fffff880`0ace7000 vmmemctl vmmemctl.sys Sun Dec 15 03:36:24 2013 (52AD23B8)
fffff880`0acf8000 fffff880`0ad43000 mrxsmb10 mrxsmb10.sys Thu Jul 26 03:23:06 2012 (5010AA0A)
fffff880`0ad43000 fffff880`0ad7e000 mrxsmb20 mrxsmb20.sys Tue Feb 05 22:28:36 2013 (51118794)
fffff880`0b200000 fffff880`0b20d000 condrv condrv.sys Thu Jul 26 03:30:08 2012 (5010ABB0)
fffff880`0b20d000 fffff880`0b2ae000 srv2 srv2.sys Tue Apr 09 03:33:02 2013 (51637DDE)
fffff880`0b2cd000 fffff880`0b399000 peauth peauth.sys Tue Apr 09 03:32:01 2013 (51637DA1)
fffff880`0b399000 fffff880`0b3a4000 secdrv secdrv.SYS Wed Sep 13 14:18:38 2006 (4508052E)
fffff880`0b3a4000 fffff880`0b3e8000 srvnet srvnet.sys Tue Apr 09 03:31:13 2013 (51637D71)
fffff880`0b3e8000 fffff880`0b3fa000 tcpipreg tcpipreg.sys Thu Jul 26 03:23:13 2012 (5010AA11)
fffff880`0b4e3000 fffff880`0b570000 srv srv.sys Thu Jul 26 03:25:28 2012 (5010AA98)
fffff880`0b570000 fffff880`0b57b000 rdpvideominiport rdpvideominiport.sys Fri Oct 12 06:48:28 2012 (5077AF2C)
fffff880`0b57b000 fffff880`0b5ac000 rdpdr rdpdr.sys Thu Jul 26 03:25:18 2012 (5010AA8E)
fffff880`0b5ac000 fffff880`0b5b9000 terminpt terminpt.sys Thu Jul 26 03:28:53 2012 (5010AB65)
fffff960`00118000 fffff960`00508000 win32k win32k.sys Sat Feb 08 04:34:05 2014 (52F5B3BD)
fffff960`006cb000 fffff960`006d4000 TSDDD TSDDD.dll Thu Jul 26 03:30:25 2012 (5010ABC1)
fffff960`00879000 fffff960`008af000 cdd cdd.dll Thu Jul 26 05:49:37 2012 (5010CC61)
fffff960`00a21000 fffff960`00a60000 RDPUDD RDPUDD.dll Fri Oct 12 06:50:01 2012 (5077AF89)
Unloaded modules:
fffff880`01e68000 fffff880`01e75000 dump_storport.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
fffff880`021d0000 fffff880`021ed000 dump_LSI_SAS.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001D000
fffff880`021a8000 fffff880`021b4000 hwpolicy.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff880`00f41000 fffff880`00f5c000 sacdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001B000
fffff880`00c33000 fffff880`00c40000 ApiSetSchema.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
I have searched for others having a similar problem but have not managed to find much.
The memory dump at the time of the crash does seem to hint at a problem with DFSR.exe.
The setup seems to be running fine again now and is going through its consistency checks, it is just a major inconvenience and will only get worse as the DFS becomes busier and approaches capacity.
The plan was to put this setup into production however with the unpredictability of blue screen reboots I cannot see this happening until I can find a fix or work around.
I have yet to see this problem occur on the other (physical) server, this is pretty much identical in configuration apart from its storage access.
My thoughts are a possible bug in the DFSR component or a bug in the DSM Drivers used for the iSCSI SAN connection or maybe a combination of the two.
Any help, thoughts or suggestions greatly appreciated
ThanksHi,
Please install the current version of Dfssvc.exe Dfsc.sys Dfsrs.exe for Windows Server 2012.
List of currently available hotfixes for Distributed File System (DFS) technologies in Windows Server 2012 and Windows Server 2012 R2
http://support.microsoft.com/kb/2951262
The issue may be due to the DFSRoot folder has lost NTFS permission. Some reasons why DFS root lose ACLs Links are listed in the article below:
How to implement Windows Server 2003 Access-based Enumeration in a DFS environment
http://support.microsoft.com/kb/907458/en-us
You could use dfsutil to set NTFS permission: dfsutil property ACL \\DFS-namespace
Using the Windows Server 2008 DFSUTIL.EXE command line to manage DFS-Namespaces
http://blogs.technet.com/b/josebda/archive/2009/05/01/using-the-windows-server-2008-dfsutil-exe-command-line-to-manage-dfs-namespaces.aspx
To narrow down the issue, you could remove the DFS role to check if the issue related to the dfs namespace and dfs replication roles.
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.
Maybe you are looking for
-
Installed the latest update and now Finder refuses to start/crashes
Hey guys, I just installed the latest 10.4.11 update or whatever, along with Quicktime, iTunes, etc., and now when I log in to any account, Finder refuses to start. If it does start, it crashes. I've googled around and all I could find was that I sho
-
Digidesign does it again - 7.3 upgrade
Hey guys, I know this is the Logic forum, so before everyone jumps on me for posting about ProTools, read on. As both a ProTools and Logic user, I appreciate the versatility that I get from the use of both systems. One thing that has always made Logi
-
Hi...I am new to BW..Can any one of you please send me the detailed configuartion documents for R/3 and BW side. Like how exactly we should start a project from intial stage configuaration in R/3 side and BW side..Please send me some kind of PPT / s
-
Best sequence setting for Sony HXR-NX5U (1920x1080)? Also, why use Sony Content Browser?
Hello, I'm using Premiere CS 5.0 and I am hoping to find a sequence setting that doesn't require me to render footage from my new camera, a Sony HXR-NX5U. Can anyone help me out? Also, does anyone use Sony's Content Browser? If so, why? It seems
-
Red-eye Edits are not Adequate
I have some time on my hands right now so I thought I would start to go through my 13,000 photos and start to group and edit my libraries. I think the last time I did this was with iphoto 4ish. But I am finding that the red eye fix is not adequate fo