Bug Check 0x27: RDR_FILE_SYSTEM on Windows Server 2008 R2 Failover Cluster
check if you have the following kb applied
http://support.microsoft.com/kb/2584874
January 25th, 2012 7:56pm
Thanks to all!
It seems that we found the source of the problem...
The answer from FZB points to the right direction.
Our Memory Dump analysis provides:
It seems we had a problem with one of the involved modules at a smb2 filetransfer.
Modules:
mrxsmb
mrxsmb20
rdbss
Also suspicious seems the loaded driver bxnd60a.sys ; this is the driver for the network adapter.
The following picture shows the connection between the involved modules and the network-stack http://support.microsoft.com/Library/Images/2473204.png
We´re going to update the drivers and firmwares.
Greetings!
Karsten
Free Windows Admin Tool Kit Click here and download it now
February 4th, 2012 8:27am
Hi !
One of our Cluster Nodes had a problem found by a
bug check and decided to reboot unexpectly!
As it is a cluster, the SQL-Servers on it continued with working, but the causative problem has to be fixed.
Here are some technical details:
OS:
Windows Server 2008 R2 (6.1.7600)
Cluster:
WSFC
DB:
SQL Server 2008 R2 (10.50.1600)
Storage:
Storage: HP EVA
HBA:
HP81Q
The 4 nodes of this cluster have as fare as possible no unnecessary software on it and worked fine until this incident.
What happened was
Bug Check 0x27: RDR_FILE_SYSTEM <http://msdn.microsoft.com/en-us/library/windows/hardware/ff557446(v=vs.85).aspx>
There were no Log-Entries regarding to this issue, before it happened.
After the reboot, I analyzed the Memory Dump File with WinDebug.
Result:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\DATEN\.....\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;SRV*C:\WinDDK\7600.16385.1\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (12 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`01e66000 PsLoadedModuleList = 0xfffff800`020a3e70
Debug session time: Thu Jan 19 15:02:22.295 2012 (UTC + 1:00)
System Uptime: 89 days 2:57:34.176
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 27, {baad0073, fffff8800e4188d8, fffff8800e418140, fffff88003668c3e}
Probably caused by : rdbss.sys ( rdbss!RxLowIoWriteShellCompletion+2e )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: 00000000baad0073
Arg2: fffff8800e4188d8
Arg3: fffff8800e418140
Arg4: fffff88003668c3e
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800e4188d8 -- (.exr 0xfffff8800e4188d8)
ExceptionAddress: fffff88003668c3e (rdbss!RxLowIoWriteShellCompletion+0x000000000000002e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000010
Attempt to read from address 0000000000000010
CONTEXT: fffff8800e418140 -- (.cxr 0xfffff8800e418140)
rax=0000000000000000 rbx=00000000c000020c rcx=fffffa80a6be19c0
rdx=00000000c0000128 rsi=0000000000000001 rdi=fffffa80a6be19c0
rip=fffff88003668c3e rsp=fffff8800e418b10 rbp=fffffa80a7cefc80
r8=00000000c000020c r9=0000000000000000 r10=fffffa80a7cefc00
r11=00000000c000026e r12=fffff8800364c110 r13=0000000000000000
r14=fffffa80a6be1900 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
rdbss!RxLowIoWriteShellCompletion+0x2e:
fffff880`03668c3e 458b6710 mov r12d,dword ptr [r15+10h] ds:002b:00000000`00000010=????????
Resetting default scope
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000010
READ_ADDRESS: 0000000000000010
FOLLOWUP_IP:
rdbss!RxLowIoWriteShellCompletion+2e
fffff880`03668c3e 458b6710 mov r12d,dword ptr [r15+10h]
FAULTING_IP:
rdbss!RxLowIoWriteShellCompletion+2e
fffff880`03668c3e 458b6710 mov r12d,dword ptr [r15+10h]
BUGCHECK_STR: 0x27
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff88003633f77 to fffff88003668c3e
STACK_TEXT:
fffff880`0e418b10 fffff880`03633f77 : 00000000`c000020c fffffa80`a7cefc80 00000000`00000001 fffff880`0ab51740 : rdbss!RxLowIoWriteShellCompletion+0x2e
fffff880`0e418b80 fffff880`03638382 : 00000000`c000020c 00000000`00000000 fffffa80`a6be19c0 00000000`00000000 : rdbss!RxLowIoCompletionTail+0x7f
fffff880`0e418bc0 fffff880`0abdcbca : 00000000`c000020c 00000000`00000000 00000000`00000000 fffff880`0364d8f8 : rdbss!RxLowIoCompletion+0x82
fffff880`0e418c00 fffff880`0ab53bb8 : fffff880`0364d4a8 00000000`00000080 fffff880`0364c110 fffffa80`a7cefc00 : mrxsmb20!Smb2Write_Finalize+0x132
fffff880`0e418c50 fffff880`036321b1 : fffff880`0364d4a8 fffff880`0364d4a8 00000000`00000001 fffffa80`a7cefcc0 : mrxsmb!SmbCepFinalizeExchange+0x44
fffff880`0e418c80 fffff800`021766fa : fffff880`0364d4a8 fffff880`0364d8f8 00000000`00000000 00000000`00000000 : rdbss!RxpWorkerThreadDispatcher+0x1a1
fffff880`0e418d40 fffff800`01eb4b46 : fffff800`02050e80 fffffa80`a6e31b60 fffff800`0205ec40 00000000`00000246 : nt!PspSystemThreadStartup+0x5a
fffff880`0e418d80 00000000`00000000 : fffff880`0e419000 fffff880`0e413000 fffff880`0e418980 00000000`00000000 : nt!KiStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: rdbss!RxLowIoWriteShellCompletion+2e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: rdbss
IMAGE_NAME: rdbss.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc219
STACK_COMMAND: .cxr 0xfffff8800e418140 ; kb
FAILURE_BUCKET_ID: X64_0x27_rdbss!RxLowIoWriteShellCompletion+2e
BUCKET_ID: X64_0x27_rdbss!RxLowIoWriteShellCompletion+2e
Followup: MachineOwner
---------
0: kd> .exr 0xfffff8800e4188d8
ExceptionAddress: fffff88003668c3e (rdbss!RxLowIoWriteShellCompletion+0x000000000000002e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000010
Attempt to read from address 0000000000000010
0: kd> .cxr 0xfffff8800e418140
rax=0000000000000000 rbx=00000000c000020c rcx=fffffa80a6be19c0
rdx=00000000c0000128 rsi=0000000000000001 rdi=fffffa80a6be19c0
rip=fffff88003668c3e rsp=fffff8800e418b10 rbp=fffffa80a7cefc80
r8=00000000c000020c r9=0000000000000000 r10=fffffa80a7cefc00
r11=00000000c000026e r12=fffff8800364c110 r13=0000000000000000
r14=fffffa80a6be1900 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
rdbss!RxLowIoWriteShellCompletion+0x2e:
fffff880`03668c3e 458b6710 mov r12d,dword ptr [r15+10h] ds:002b:00000000`00000010=????????
Do you have an idea, what causes this problem?
How can we fix it?
Many thanks in advance!
Greetings,
Karsten Mueller
February 4th, 2012 11:12am
SYMBOL_NAME: rdbss!RxLowIoWriteShellCompletion+2e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: rdbss
IMAGE_NAME: rdbss.sys -
this is windows Driver
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc219
----------------------------------------------
Hi Karsten,
Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error.
If ur using (SCSI) adapters,check for the driver updates and check the device manager for any driver issues/updates.
I found this one :http://support.microsoft.com/kb/956246 this link has a hotfix download for Vista :For all supported 64-bit versions of
Windows Server 2008 and of Windows Vista
I would suggest u post this thread link in :
http://social.technet.microsoft.com/Forums/en-US/winserverClustering/threads for Solution.
Gopi Kiran |Facebook| This posting is provided AS IS with no warranties,and confers no rights.
Free Windows Admin Tool Kit Click here and download it now
February 4th, 2012 11:55am
check if you have the following kb applied
http://support.microsoft.com/kb/2584874
February 4th, 2012 11:58am