SCCM client subcomponent vappcollector crashing several pc's
This week we have had several reports of pc's getting a BSOD upon login. PC's were receiving STOP 0x00000001 errors (APC_INDEX_MISMATCH (1)).
After checking the minidumps they all show the vAppCollector as being the culprit. Disabling the SMS Agent Host Service stops the crashes. We are in the process of troubleshooting the issue but i wanted to see if anyone else out there has come across this.
We recently upgraded to R3. Thanks in advance for any input.
Our clients are all Win7 32 bit SP1
Heres one of the minidumps:
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\softwareDump\062911-19593-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16792.x86fre.win7_gdr.110408-1633
Machine Name:
Kernel base = 0x82a0c000 PsLoadedModuleList = 0x82b54810
Debug session time: Wed Jun 29 11:44:19.335 2011 (UTC - 4:00)
System Uptime: 0 days 0:03:40.501
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1, {82c55513, 0, ffe4, 0}
Probably caused by : ntkrpamp.exe ( nt!NtQueryInformationProcess+0 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them. A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 82c55513, address of system function (system call)
Arg2: 00000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 0000ffe4, Thread->KernelApcDisable
Arg4: 00000000, Previous KernelApcDisable
Debugging Details:
------------------
FAULTING_IP:
nt!NtQueryInformationProcess+0
82c55513 68c4020000 push 2C4h
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1
PROCESS_NAME: VAppCollector.
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 77626344 to 82a4f7a3
STACK_TEXT:
9e40fd34 77626344 badb0d00 0024f548 00000000 nt!KiServiceExit2+0x17a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0024f560 00000000 00000000 00000000 00000000 0x77626344
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!NtQueryInformationProcess+0
82c55513 68c4020000 push 2C4h
SYMBOL_NAME: nt!NtQueryInformationProcess+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4d9fd915
FAILURE_BUCKET_ID: 0x1_SysCallNum_ea_nt!NtQueryInformationProcess+0
BUCKET_ID: 0x1_SysCallNum_ea_nt!NtQueryInformationProcess+0
Followup: MachineOwner
---------
June 30th, 2011 11:55am
To Follow up, we found the cause of the issue, it appears to be isolated.
The dozen or so PC's all had corrupted App-V Clients.
Boot into safe mode>disable sms agent host service>uninstall app-v client>restart sms agent host>reboot>re-deploy app-v client
Free Windows Admin Tool Kit Click here and download it now
June 30th, 2011 3:07pm