Trace a mapped_file in kernel dump back to a user/process

I am troubleshooting a paged pool consumption issue (MmSt and other tags related to ntfs.sys being top consumers) on a Windows2003 R2 SP2. I see from a kernel dump taken when server was unresponsive, using !memusage, around 80000 files listed as mapped_file
s, I presume these open files are causing this large pool allocations. In fact all those are old log files and should not be touched by any process for any purpose. Now we are not sure which user or process is opening these files, apart from some guess work
like AV, Backup, AppReports..etc but no conclusive evidence so far.
I would like to know if there is a way trace a mapped_file entry back to a user/process who opened those files from the kernel dump that I have?
Any help would be very much appreaciated, thanks in advance.

Hi,
I don't think
there is a way trace a mapped_file entry back to a user/process who opened those files from the kernel dump. If you want to perform debugging using kernel dump, please contact
Microsoft Customer Support Service (CSS).
To obtain the phone numbers for specific technology request, please refer to the website listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS
If you are outside the US, please refer to
http://support.microsoft.com for regional support phone numbers.
Regards

Similar Messages

Question about the Filter type for the trace provide "Microsoft-Windows-Kernel-File"

Hello all,
I have moved this question from the Windows
Server General Forum accorfing to the suggestion from Mr. Justin Gu
I have a question about the Filter function for the trace provider "Microsoft-Windows-Kernel-File".
I can find the Filter function with the following operation.
Mr. Justin Gu wrote:
> You create a Data Collector Set for the trace provider "Microsoft-Windows-Kernel-File" and finish completely, then you > can right click it and select Properties.
In the Properties dialog box, click Filter and
then select ‘Edit…’. You will be> able
to see the Filter type and Filter data in the Filter dialog box.
What
Kind of Filter can
I use in this Filter dialog box?
And, how can I set to exclude the some kind of datas?
Could you give me your suggestion?
Thank you.

What
Kind of Filter can
I use in this Filter dialog box?
And, how can I set to exclude the some kind of datas?
Could you give me your suggestion?
Thank you.
I'm looking for the same information.

ASR kernel dump error

Hello All,
After upgrading a Cisco ASR 1001 using sub packages from XE 03.07.00b.S too XE 03.09.01.S (following the instructions detailed in the Cisco documentation but without redundant OS/RP) the device is continually reboots with the following error:
%IOSXEBOOT-4-ABORT: (rp/0): Command ‘cp –r /rmp/sw/rp/0/0/rp_security/mount/3pa/etc/* /etc’ failed
%IOSXEBOOT-4-ABORT: (rp/0): Command ‘cp –r /rmp/sw/rp/0/0/rp_security/mount/3pa/etc/* /etc’ failed
Starting IOS XE Kernel dump from previous failure.
Expected completion time is less than 5 minutes.
System will automatically reboot within 5 minutes.
The original sub packages are still present on this devices bootflash:
As per the documentation II basically copied over the consolidated image, unpacked then copied to the root of bootflash: then used the issu loadversion rp 0 file command to upload rpaccess, rpios and rpcontrol packages. Then used issu commitversion and reloaded.

Hi ,
i have the same problem, new asr1001 router:
the router dont come up, only rebooting.
Initializing Hardware ...
Calculating the ROMMON CRC ... CRC is correct
System Bootstrap, Version 15.0(1r)S, RELEASE SOFTWARE
Copyright (c) 1994-2010 by cisco Systems, Inc.
Current image running: Boot ROM1
Last reset cause: Watchdog/ICH
ASR1000-1RU platform with 4194304 Kbytes of main memory
Warning: filesystem is not clean
Warning: filesystem is not clean
File size is 0x15af15c8
Located asr1001-universalk9.03.06.00.S.152-2.S.bin
Image size 363795912 inode num 12, bks cnt 88818 blk size 8*512
Boot image size = 363795912 (0x15af15c8) bytes
Package header rev 0 structure detected
Calculating SHA-1 hash...done
validate_package: SHA-1 hash:
        calculated 3778c900:adb6c5bf:ce04e6c5:2f1e51d8:9692e14d
        expected   3778c900:adb6c5bf:ce04e6c5:2f1e51d8:9692e14d
Image validated
%IOSXEBOOT-4-FILESYS_ERRORS_CORRECTED: (rp/0): bootflash 1 contained errors which were auto-corrected.
Starting IOS XE kernel dump from previous failure.
Expected completion time is less than 5 minutes.
System will automatically reboot within 5 minutes.
Initializing Hardware ...
Calculating the ROMMON CRC ... CRC is correct
System Bootstrap, Version 15.0(1r)S, RELEASE SOFTWARE
Copyright (c) 1994-2010 by cisco Systems, Inc.
Current image running: Boot ROM1
Last reset cause: Watchdog/ICH
ASR1000-1RU platform with 4194304 Kbytes of main memory
Warning: filesystem is not clean
Warning: filesystem is not clean
File size is 0x15af15c8
Located asr1001-universalk9.03.06.00.S.152-2.S.bin
Image size 363795912 inode num 12, bks cnt 88818 blk size 8*512
Boot image size = 363795912 (0x15af15c8) bytes
Package header rev 0 structure detected
Calculating SHA-1 hash...done
validate_package: SHA-1 hash:
        calculated 3778c900:adb6c5bf:ce04e6c5:2f1e51d8:9692e14d
        expected   3778c900:adb6c5bf:ce04e6c5:2f1e51d8:9692e14d
Image validated
%IOSXEBOOT-4-FILESYS_ERRORS_CORRECTED: (rp/0): bootflash 1 contained errors which were auto-corrected.
Starting IOS XE kernel dump from previous failure.
Expected completion time is less than 5 minutes.
System will automatically reboot within 5 minutes.
Initializing Hardware ...

MBP crashes Kernel dumps of doom!

I have not figured out the problem...I know when tge tinted screen comes up that asks me to restart I check to logs to send out to apple and it says its something to do with the airport? or my wireless? Is this issue common? I tohught it was time machine because I constantly hear my external drives turning on and off all the time...any clues as to why this could be happen? I know the software is buggy and all...
P.S. ive never had kernel dumps like this ever on this computer. I take care of it. Might I mention the damned disk utility to fix permissions does not work either?
Message was edited by: italidesgin

resolved on own.

Need to send a mail back to the user in Sender Mail adapter Scenario

Hi all,
I have a scenario where the user fills the Price form or the Article form (which is a Adobe Form).When the user clicks on the "submit" button,the form is converted into xml , gets attached to the mail and sent to PI.
Now the user sometimes attaches the pdf directly instead of submitting the form. This results in the mail being sent
with pdf as attachment.
Now my requirement is to send a mail back to the user asking them to send an xml instead of a pdf.
How can this be done ?
Kindly let me know friends.
Quick Response is appreciated.

hi Sanjay,
Have a look on Michal's blog, it's for JMS, but it works for others: [PI/XI: Quick tip: Preserving attributes of XI messages via MultipartHeaderBean|PI/XI: Quick tip: Preserving attributes of XI messages via MultipartHeaderBean]
Mickael

I want to open excel spread sheets make additions and export back to pc users. Is numbers suitable for this activity?

I want to open excel spread sheets make additions and export back to pc users. Is numbers suitable for this activity? I am using a MACBook Air

just read this in an other answer:
Pages can open docx files, Numbers can open xlsx files. Each can export to can export .doc or .xls to the newest Word or Excel format.respectvely, but not to the more recent .docx or .xlsx.
Translation is not perfect in either direction. Numbers and Excel handle some similar features (eg. pop-up menus vs data validation) differently, and the translator cannot translate from one implementation to the other.
If much of your work is going to be transferred between your machine and Windows machines running either MS Excel or MS Word, with editing taking place at both ends of the tunnel, then you'll probably be better off with Office, or one of the Office clones on the Mac end.

An error occurred while backing up the user's home folder

I have a user account that I'm trying to remove from a computer. I have updated to 10.5.2, and restarted a number of times and repaired permissions. There were 3 accounts on the machine I'm trying to remove, and the first 2 deleted just fine. However, this last one, the most important one, will not delete and save to a dmg file.
The error message is "an error occurred while backing up the user's home folder" shortly after beginning the process.
log file shows:
/08 12:52:49 AM authexec[266] executing /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-hel per
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] 2008-02-28 00:53:13.213 writeconfig[209:10b] DILDiskImageCreate: internal error - missing kDIHLCreateImageComponentsKey in return dictionary
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] 2008-02-28 00:53:13.230 writeconfig[209:10b] DIHLDiskImageCreate failed: 999 (options:{
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] "create-content-spec" = {
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] "iff-spec" = {
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] "any-owners" = 1;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] "copy-uid" = 501;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] "no-cross-dev-nodes" = 1;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] scrub = 1;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] "skip-unreadable" = 1;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] url = file://localhost/Users/woneal/;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] };
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] "nbi-spec" = {
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] filesystem = "HFS+";
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] layout = SPUD;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] };
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] };
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] "create-target-spec" = {
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] "image-type" = UDIF;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] overwrite = 1;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] url = file://localhost/Users/Deleted%20Users/woneal.dmg;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] };
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] "suppress-uiagent" = 1;
2/28/08 12:53:13 AM [0x0-0xe00e].com.apple.systempreferences[197] })
any ideas?

This is the correct steps to solve this problem:
1. Cancel the update (with the backing up error, of course)
2. Do a manual backup
3. Do a manual restore (your password to unlock your backup file is your AppleID password, not your IPhone keypad password)
4. Now Update your phone. This time the backup should work.
5. After it is updated, it will automatically restore, if you choose to restore not to set up a new phone.
And yes, copy all your photos manually. Your backup probabally won't include photos.
If this still doesn't work, try to stop your anti-virus software.

Short Dump created while modifying a process chain

Hi guys ,
Iam getting a short dump while trying to modify a process chain and it is taking me too short dump where the message is PROCESS HAS NO PREDECESSOR but even when Iam trying to DETAILED VIEW it is taking me too short dump
Can anyone help me out of this issue

Hi ,
I have removed the existing start process and I have checked but there is no Use the same short dump is created again
Please suggest me some usefull solution .

HT201328 I have paid Bell to unlock my old iphone4 and they have said it is now unlocked. Can I skip the back up and restore process and just buy another carriers sim card from my daugther Kodoo plan, install it and active the iphone4 on itunes account in

I have paid Bell to unlock my old iphone4 and they have said it is now unlocked. Can I skip the back up and restore process and just buy another carriers sim card from my daugther Kodoo plan, install it and active the iphone4 on itunes account in her name?
thanks
Dave

The process is as follows:
Backup the phone, Erase it, connect to iTunes for the unlock process, then your iProfile can be restored.
You can go ahead and get the SIM, bout you have to Erase the phone and connect to iTunes before it will be unlocked.

Freezes when I try to log in and goes back to the user menu screen every time.

A few weeks ago I was on Google Chrome and it froze up a little bit. The bell rang for me to go to my next class so I shut my MacBook Pro and was on my way. Later, I opened my laptop to see Chrome still frozen on my screen even though I have it set to require a password after the laptop has been in sleep mode.
I restarted my MacBook and tried logging in. I got the beachball spinny wheel cursor thing, the screen froze for a few seconds, and it went back to the user login screen. I have tried safe booting it, restarting it many times, and many other things but this problem is still happening and I cannot log into my main account.
I had that main account account and a guest account so I logged into the guest, set it as an administrative account, and have been using that account ever since. I've also uninstalled and reinstalled Chrome. It sucked but hasn't been too big of a problem because I have just been spotlight searching files whenever I need them.
Now another problem is coming up. My iTunes. I cannot access my normal iTunes library from this guest account. I want to put some new songs on my iPhone but can't.
Does anybody know how I may be able to fix the logging in issue to my main account?
Does anybody know how I can get my normal iTunes transfered to this new account, even though I can't log into my old account?

Try:
The Complete Guide to FaceTime: Set-up, Use, and Troubleshooting Problems

My husband and I have done the recent update and we now share contacts and safari bookmarks. How do I go back to individual users?

My husband and I have done the recent update and we now share contacts and safari bookmarks. How do I go back to individual users?

LLL2012 wrote:
Yes it is the same and it is greed out so it can't be changed there.
Go to Settings\Mail, Contacts, Calendars\Add Account (select iCloud)
You can create a new account here ("Get a Free Apple ID" at the bottom) or switch it to another existing account you may have (separate from your Husbands).
Once you tie your phone into the separate account you can go back and delete your Husbands on your phone.

Does back ground jobs work process go to private mode or not

Hi Experts,
Can any one tell me
Does back ground jobs work process go to private mode or not
Thanks and Regards
Dan !!

Hi Dan,
I do not think background work processes would go into PRIV mode.
the orginal information was remove by Admin because provided by Cut and Paste from SAP Online Help.
you will find it <a href="http://help.sap.com/saphelp_47x200/helpdata/en/7a/caa6f3bfdb11d188b30000e83539c3/frameset.htm">here</a>
The distribution, participation in distributing or otherwise sending of this material is against the law. The material you are requesting is copyrighted material and available ONLY to customers of SAP. If you need such documents from the SAP Service Marketplace then you must have "S" user ID and login yourself to retrieve this material. If you do not have a "S" user ID then you should contact your own internal company groups responsible and request one or request them to retrieve the document for you.
By participating and sending such documents you are at risk for legal action and a removal of your account here on SDN and BPX.
DO NOT send material via email such as this! Further actions will result in officials within your company and your SAP Sales Account being notified and could result in legal action against you as an individual.

HT4889 I just transferred data using migration assistant from a macbook prop to a macbook. I am trying to log back into the user that was on the pro but is now on the macbook with the same password as before, and it says my password is incorrect.

I just transferred data using migration assistant from a macbook pro to a macbook. I am trying to log back into the user that was on the pro but is now on the macbook with the same password as before, and it says my password is incorrect?

Suggest you try the password for the Macbook, not the previous one.

How to Trace user process

Environment.
SunOS CSF-1 5.10 Generic_138888-03 sun4u sparc SUNW,Sun-Fire-V245
Can anyone help me that I need to trace one application process -?
The Issue is every day one of the user process is killing automatically two or three times.
Kindly help........
Best regards,
Muneer.

A starting point is /usr/dem/dtrace/sig.d.

Cisco 2504 Local radius configuration, is their any ways for backing up the user db? In case the WLC dies

Cisco 2504 Local radius configuration, is their any ways for backing up the user db? In case the WLC dies

Please find the guide to keep the backup:-
http://www.cisco.com/en/US/partner/docs/wireless/controller/7.0/configuration/guide/c70mfw.html#wp1063850

Trace a mapped_file in kernel dump back to a user/process

Similar Messages

Maybe you are looking for