Hey guys I need some assistance in translating this memory dump please. About once a month I have issues where my Windows Server 2008 R3 just halts. I have setup to automatically restart on system failure but this doesent happen either. The server is colocated so the only solution is a remote reboot. I have a game server application that runs as a monitoring service that customers access via a http browser. The http application controls the service via ASP.NET 1.1. In the memory dump I see my game panel service "TCAdminService" as being the process responsible for the crash. I have 3 questions that would be great if I can get answered: 1. Im hoping someone can take a more granular look into these logs and possibly have a solution for me. 2. Due to the fact the system did not automatically restart on failure could it be possible it was not BSOD but just a halt and if so can a halt generate a memory dump ? 3. Are there any other solutions to automatically restart on BSOD/halt ? has anyone ever heard of an APC (remote reboot device) doing healthchecks and recycling power to the box automatically if ping fails more than x number of times ? thanks so much and here is the mem dump: Microsoft (R) Windows Debugger Version 6.11.0001.402 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidump\021811-32136-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: srv*C:\Windows\Symbols*http://msdl.microsoft.com/download/symbols Executable search path is: C:\Windows\SysWOW64 Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: Server, suite: Enterprise TerminalServer SingleUserTS Built by: 7600.16695.amd64fre.win7_gdr.101026-1503 Machine Name: Kernel base = 0xfffff800`01a59000 PsLoadedModuleList = 0xfffff800`01c96e50 Debug session time: Fri Feb 18 19:00:13.260 2011 (GMT-5) System Uptime: 8 days 7:18:57.535 Loading Kernel Symbols ............................................................... ................................................................ ..... Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck F4, {3, fffffa8007817060, fffffa8007817340, fffff80001dd22d0} Probably caused by : _ Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 0000000000000003, Process Arg2: fffffa8007817060, Terminating object Arg3: fffffa8007817340, Process image file name Arg4: fffff80001dd22d0, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: fffffa8007817060 IMAGE_NAME: _ DEBUG_FLR_IMAGE_TIMESTAMP: 0 MODULE_NAME: _ FAULTING_MODULE: 0000000000000000 PROCESS_NAME: TCAdminService BUGCHECK_STR: 0xF4_TCAdminService CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80001e55f62 to fffff80001ac9740 STACK_TEXT: fffff880`06f80b08 fffff800`01e55f62 : 00000000`000000f4 00000000`00000003 fffffa80`07817060 fffffa80`07817340 : nt!KeBugCheckEx fffff880`06f80b10 fffff800`01dfda23 : ffffffff`ffffffff fffffa80`091ad060 fffffa80`07817060 fffffa80`0785d1e0 : nt!PspCatchCriticalBreak+0x92 fffff880`06f80b50 fffff800`01d8590c : ffffffff`ffffffff 00000000`00000001 fffffa80`07817060 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17666 fffff880`06f80ba0 fffff800`01ac8993 : fffffa80`07817060 fffff880`ffffffff 00000000`00541230 fffffa80`091ad060 : nt!NtTerminateProcess+0x20c fffff880`06f80c20 00000000`77bdf97a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0331e808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bdf97a STACK_COMMAND: kb FOLLOWUP_NAME: MachineOwner FAILURE_BUCKET_ID: X64_0xF4_TCAdminService_IMAGE__ BUCKET_ID: X64_0xF4_TCAdminService_IMAGE__ Followup: MachineOwner --------- 3: kd> !process fffffa8007817060 3 GetPointerFromAddress: unable to read from fffff80001d01000 PROCESS fffffa8007817060 SessionId: none Cid: 01a8 Peb: 7fffffde000 ParentCid: 01a0 DirBase: 214a25000 ObjectTable: fffff8a001ee8010 HandleCount: <Data Not Accessible> Image: csrss.exe VadRoot fffffa8007abf780 Vads 158 Clone 0 Private 551. Modified 6972. Locked 0. DeviceMap fffff8a000008b30 Token fffff8a001f52780 ReadMemory error: Cannot get nt!KeMaximumIncrement value. fffff78000000000: Unable to get shared data ElapsedTime 00:00:00.000 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1987, 50, 345) (7948KB, 200KB, 1380KB) PeakWorkingSetSize 8937 VirtualSize 121 Mb PeakVirtualSize 124 Mb PageFaultCount 92023 MemoryPriority BACKGROUND BasePriority 13 CommitCharge 726 *** Error in reading nt!_ETHREAD @ fffffa8007827b60

Hi, Please understand that to troubleshoot the blue screen issues, we usually need to perform debugging. However, in this forum, we do not provide debugging support. If you would like to perform debugging, please contact Microsoft Customer Support Service (CSS). To obtain the phone numbers for specific technology request, please refer to the website listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS If you are outside the US, please refer to http://support.microsoft.com for regional support phone numbers. Tim Quan

Thanks for the reply Tim. Last time I had a question regarding BSOD you guys allowed me to upload the crash dump for analysis via this forum, I believe the mod was Arthur Li, he opened a workspace for me.

But he did not analyze the dump files for you, did he?

No he didnt. That support link is not very useful either.