BSOD on Server 2008R2
Hello,
We have been getting a lot of bluescreens on one of our servers, a Dell PowerEdge T310.
Here's the latest from the event log:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x0000000000000008, 0x0000000000000002, 0x0000000000000000, 0xfffff80001abac33). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080212-65177-01.
We have the server set to create a kernel memory dump. Running that file through WinDbg reveals the info below.
Thanks for your assistance,
DJ
---------------------
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`01a5f000 PsLoadedModuleList = 0xfffff800`01c9ce70
Debug session time: Thu Aug 2 16:11:03.478 2012 (UTC - 7:00)
System Uptime: 4 days 12:09:40.008
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*
*
* Bugcheck Analysis *
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {8, 2, 0, fffff80001abac33}
Probably caused by : ntkrnlmp.exe ( nt!CcFlushCache+103 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis *
*
*
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80001abac33, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: 0000000000000008
CURRENT_IRQL: 2
FAULTING_IP:
nt!CcFlushCache+103
fffff800`01abac33 488b7808 mov rdi,qword ptr [rax+8]
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff8800216f8c0 -- (.trap 0xfffff8800216f8c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff80001c4a540
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001abac33 rsp=fffff8800216fa50 rbp=fffff8800216fc58
r8=0000000000000000 r9=0000000000000000 r10=0000000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!CcFlushCache+0x103:
fffff800`01abac33 488b7808 mov rdi,qword ptr [rax+8] ds:0180:0008=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001aceb29 to fffff80001acf5c0
STACK_TEXT:
fffff880`0216f778 fffff800`01aceb29 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0216f780 fffff800`01acd7a0 : fffffa80`0d3df770 fffff800`01c49e80 fffffa80`083cb7f0 fffff880`04b82500 : nt!KiBugCheckDispatch+0x69
fffff880`0216f8c0 fffff800`01abac33 : 00000000`00000000 fffffa80`0f0cfac0 fffffa80`06d1e750 fffffa80`0f0cfaf0 : nt!KiPageFault+0x260
fffff880`0216fa50 fffff800`01ac280b : 00000000`00000000 fffff800`00000001 00000000`00000001 fffffa80`06d0fb00 : nt!CcFlushCache+0x103
fffff880`0216fb50 fffff800`01ac33ec : fffff800`01cd6100 fffff880`0216fc58 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x1eb
fffff880`0216fc00 fffff800`01adc7e1 : fffffa80`06d09230 fffff800`01ac3224 fffff800`01cd6160 00000000`00000002 : nt!CcWorkerThread+0x1c8
fffff880`0216fcb0 fffff800`01d6f6fa : 00000000`00000000 fffffa80`06d0fb60 00000000`00000080 fffffa80`06cecb30 : nt!ExpWorkerThread+0x111
fffff880`0216fd40 fffff800`01aadb46 : fffff880`01f3f180 fffffa80`06d0fb60 fffff880`01f4a0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0216fd80 00000000`00000000 : fffff880`02170000 fffff880`0216a000 fffff880`0216ebb0 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!CcFlushCache+103
fffff800`01abac33 488b7808 mov rdi,qword ptr [rax+8]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!CcFlushCache+103
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
FAILURE_BUCKET_ID: X64_0xA_nt!CcFlushCache+103
BUCKET_ID: X64_0xA_nt!CcFlushCache+103
Followup: MachineOwner
---------
0: kd> !thread
THREAD fffffa8006d0fb60 Cid 0004.0024 Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0
Not impersonating
DeviceMap fffff8a000008aa0
Owning Process fffffa8006cecb30 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 24960096 Ticks: 0
Context Switch Count 1286964
UserTime 00:00:00.000
KernelTime 00:00:19.578
Win32 Start Address nt!ExpWorkerThread (0xfffff80001adc6d0)
Stack Init fffff8800216fdb0 Current fffff8800216ebb0
Base fffff88002170000 Limit fffff8800216a000 Call 0
Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child
: Call Site
fffff880`0216f778 fffff800`01aceb29 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0216f780 fffff800`01acd7a0 : fffffa80`0d3df770 fffff800`01c49e80 fffffa80`083cb7f0 fffff880`04b82500 : nt!KiBugCheckDispatch+0x69
fffff880`0216f8c0 fffff800`01abac33 : 00000000`00000000 fffffa80`0f0cfac0 fffffa80`06d1e750 fffffa80`0f0cfaf0 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`0216f8c0)
fffff880`0216fa50 fffff800`01ac280b : 00000000`00000000 fffff800`00000001 00000000`00000001 fffffa80`06d0fb00 : nt!CcFlushCache+0x103
fffff880`0216fb50 fffff800`01ac33ec : fffff800`01cd6100 fffff880`0216fc58 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x1eb
fffff880`0216fc00 fffff800`01adc7e1 : fffffa80`06d09230 fffff800`01ac3224 fffff800`01cd6160 00000000`00000002 : nt!CcWorkerThread+0x1c8
fffff880`0216fcb0 fffff800`01d6f6fa : 00000000`00000000 fffffa80`06d0fb60 00000000`00000080 fffffa80`06cecb30 : nt!ExpWorkerThread+0x111
fffff880`0216fd40 fffff800`01aadb46 : fffff880`01f3f180 fffffa80`06d0fb60 fffff880`01f4a0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0216fd80 00000000`00000000 : fffff880`02170000 fffff880`0216a000 fffff880`0216ebb0 00000000`00000000 : nt!KiStartSystemThread+0x16
0: kd> !process fffffa8006cecb30 0
PROCESS fffffa8006cecb30
SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 00187000 ObjectTable: fffff8a0000018b0 HandleCount: 902.
Image: System
August 3rd, 2012 5:53pm
Hello,
Seems it is this BSOD (ntkrnlmp.exe) might be occurred because of BAD memory(RAM). So I
suggest you check RAM once and change it, if possible?Regards, Ravikumar P
Free Windows Admin Tool Kit Click here and download it now
August 3rd, 2012 11:01pm
Hello,
Seems it is this BSOD (ntkrnlmp.exe) might be occurred because of BAD memory(RAM). So I
suggest you check RAM once and change it, if possible?Regards, Ravikumar P
August 3rd, 2012 11:10pm
Hi,
You may contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. To troubleshoot this kind of kernel
crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. Please be advised that contacting phone support will be a charged call.
To obtain the phone numbers for specific technology request please take a look at the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
Regards,Arthur Li
TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
August 6th, 2012 10:13am
Hi,
You may contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. To troubleshoot this kind of kernel
crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. Please be advised that contacting phone support will be a charged call.
To obtain the phone numbers for specific technology request please take a look at the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
Regards,Arthur Li
TechNet Community Support
August 6th, 2012 10:13am