Hello, We have been getting a lot of bluescreens on one of our servers, a Dell PowerEdge T310. Here's the latest from the event log: The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x0000000000000008, 0x0000000000000002, 0x0000000000000000, 0xfffff80001abac33). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080212-65177-01. We have the server set to create a kernel memory dump. Running that file through WinDbg reveals the info below. Thanks for your assistance, DJ --------------------- Kernel Summary Dump File: Only kernel address space is available Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: LanManNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`01a5f000 PsLoadedModuleList = 0xfffff800`01c9ce70 Debug session time: Thu Aug 2 16:11:03.478 2012 (UTC - 7:00) System Uptime: 4 days 12:09:40.008 Loading Kernel Symbols ............................................................... ................................................................ ..................... Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {8, 2, 0, fffff80001abac33} Probably caused by : ntkrnlmp.exe ( nt!CcFlushCache+103 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000008, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80001abac33, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: 0000000000000008 CURRENT_IRQL: 2 FAULTING_IP: nt!CcFlushCache+103 fffff800`01abac33 488b7808 mov rdi,qword ptr [rax+8] DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: System TRAP_FRAME: fffff8800216f8c0 -- (.trap 0xfffff8800216f8c0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffff80001c4a540 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80001abac33 rsp=fffff8800216fa50 rbp=fffff8800216fc58 r8=0000000000000000 r9=0000000000000000 r10=0000000000000001 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!CcFlushCache+0x103: fffff800`01abac33 488b7808 mov rdi,qword ptr [rax+8] ds:0180:0008=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80001aceb29 to fffff80001acf5c0 STACK_TEXT: fffff880`0216f778 fffff800`01aceb29 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffff880`0216f780 fffff800`01acd7a0 : fffffa80`0d3df770 fffff800`01c49e80 fffffa80`083cb7f0 fffff880`04b82500 : nt!KiBugCheckDispatch+0x69 fffff880`0216f8c0 fffff800`01abac33 : 00000000`00000000 fffffa80`0f0cfac0 fffffa80`06d1e750 fffffa80`0f0cfaf0 : nt!KiPageFault+0x260 fffff880`0216fa50 fffff800`01ac280b : 00000000`00000000 fffff800`00000001 00000000`00000001 fffffa80`06d0fb00 : nt!CcFlushCache+0x103 fffff880`0216fb50 fffff800`01ac33ec : fffff800`01cd6100 fffff880`0216fc58 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x1eb fffff880`0216fc00 fffff800`01adc7e1 : fffffa80`06d09230 fffff800`01ac3224 fffff800`01cd6160 00000000`00000002 : nt!CcWorkerThread+0x1c8 fffff880`0216fcb0 fffff800`01d6f6fa : 00000000`00000000 fffffa80`06d0fb60 00000000`00000080 fffffa80`06cecb30 : nt!ExpWorkerThread+0x111 fffff880`0216fd40 fffff800`01aadb46 : fffff880`01f3f180 fffffa80`06d0fb60 fffff880`01f4a0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`0216fd80 00000000`00000000 : fffff880`02170000 fffff880`0216a000 fffff880`0216ebb0 00000000`00000000 : nt!KiStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt!CcFlushCache+103 fffff800`01abac33 488b7808 mov rdi,qword ptr [rax+8] SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!CcFlushCache+103 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 FAILURE_BUCKET_ID: X64_0xA_nt!CcFlushCache+103 BUCKET_ID: X64_0xA_nt!CcFlushCache+103 Followup: MachineOwner --------- 0: kd> !thread THREAD fffffa8006d0fb60 Cid 0004.0024 Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0 Not impersonating DeviceMap fffff8a000008aa0 Owning Process fffffa8006cecb30 Image: System Attached Process N/A Image: N/A Wait Start TickCount 24960096 Ticks: 0 Context Switch Count 1286964 UserTime 00:00:00.000 KernelTime 00:00:19.578 Win32 Start Address nt!ExpWorkerThread (0xfffff80001adc6d0) Stack Init fffff8800216fdb0 Current fffff8800216ebb0 Base fffff88002170000 Limit fffff8800216a000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr : Args to Child : Call Site fffff880`0216f778 fffff800`01aceb29 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffff880`0216f780 fffff800`01acd7a0 : fffffa80`0d3df770 fffff800`01c49e80 fffffa80`083cb7f0 fffff880`04b82500 : nt!KiBugCheckDispatch+0x69 fffff880`0216f8c0 fffff800`01abac33 : 00000000`00000000 fffffa80`0f0cfac0 fffffa80`06d1e750 fffffa80`0f0cfaf0 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`0216f8c0) fffff880`0216fa50 fffff800`01ac280b : 00000000`00000000 fffff800`00000001 00000000`00000001 fffffa80`06d0fb00 : nt!CcFlushCache+0x103 fffff880`0216fb50 fffff800`01ac33ec : fffff800`01cd6100 fffff880`0216fc58 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x1eb fffff880`0216fc00 fffff800`01adc7e1 : fffffa80`06d09230 fffff800`01ac3224 fffff800`01cd6160 00000000`00000002 : nt!CcWorkerThread+0x1c8 fffff880`0216fcb0 fffff800`01d6f6fa : 00000000`00000000 fffffa80`06d0fb60 00000000`00000080 fffffa80`06cecb30 : nt!ExpWorkerThread+0x111 fffff880`0216fd40 fffff800`01aadb46 : fffff880`01f3f180 fffffa80`06d0fb60 fffff880`01f4a0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`0216fd80 00000000`00000000 : fffff880`02170000 fffff880`0216a000 fffff880`0216ebb0 00000000`00000000 : nt!KiStartSystemThread+0x16 0: kd> !process fffffa8006cecb30 0 PROCESS fffffa8006cecb30 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000 DirBase: 00187000 ObjectTable: fffff8a0000018b0 HandleCount: 902. Image: System

Hello, Seems it is this BSOD (ntkrnlmp.exe) might be occurred because of BAD memory(RAM). So I suggest you check RAM once and change it, if possible?Regards, Ravikumar P

Hello, Seems it is this BSOD (ntkrnlmp.exe) might be occurred because of BAD memory(RAM). So I suggest you check RAM once and change it, if possible?Regards, Ravikumar P

Hi, You may contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. To troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. Please be advised that contacting phone support will be a charged call. To obtain the phone numbers for specific technology request please take a look at the web site listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607 Regards,Arthur Li TechNet Community Support

Hi, You may contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. To troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. Please be advised that contacting phone support will be a charged call. To obtain the phone numbers for specific technology request please take a look at the web site listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607 Regards,Arthur Li TechNet Community Support