Bug Check 0x27: RDR_FILE_SYSTEM on Windows Server 2008 R2 Failover Cluster
check if you have the following kb applied http://support.microsoft.com/kb/2584874
January 25th, 2012 7:56pm

Thanks to all! It seems that we found the source of the problem... The answer from FZB points to the right direction. Our Memory Dump analysis provides: It seems we had a problem with one of the involved modules at a smb2 filetransfer. Modules: mrxsmb mrxsmb20 rdbss Also suspicious seems the loaded driver bxnd60a.sys ; this is the driver for the network adapter. The following picture shows the connection between the involved modules and the network-stack http://support.microsoft.com/Library/Images/2473204.png We´re going to update the drivers and firmwares. Greetings! Karsten
Free Windows Admin Tool Kit Click here and download it now
February 4th, 2012 8:27am

Hi ! One of our Cluster Nodes had a problem found by a bug check and decided to reboot unexpectly! As it is a cluster, the SQL-Servers on it continued with working, but the causative problem has to be fixed. Here are some technical details: OS: Windows Server 2008 R2 (6.1.7600) Cluster: WSFC DB: SQL Server 2008 R2 (10.50.1600) Storage: Storage: HP EVA HBA: HP81Q The 4 nodes of this cluster have as fare as possible no unnecessary software on it and worked fine until this incident. What happened was Bug Check 0x27: RDR_FILE_SYSTEM <http://msdn.microsoft.com/en-us/library/windows/hardware/ff557446(v=vs.85).aspx> There were no Log-Entries regarding to this issue, before it happened. After the reboot, I analyzed the Memory Dump File with WinDebug. Result: Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\DATEN\.....\MEMORY.DMP] Kernel Summary Dump File: Only kernel address space is available Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;SRV*C:\WinDDK\7600.16385.1\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (12 procs) Free x64 Product: Server, suite: Enterprise TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`01e66000 PsLoadedModuleList = 0xfffff800`020a3e70 Debug session time: Thu Jan 19 15:02:22.295 2012 (UTC + 1:00) System Uptime: 89 days 2:57:34.176 Loading Kernel Symbols ............................................................... ................................................................ ...................... Loading User Symbols Loading unloaded module list .................................................. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 27, {baad0073, fffff8800e4188d8, fffff8800e418140, fffff88003668c3e} Probably caused by : rdbss.sys ( rdbss!RxLowIoWriteShellCompletion+2e ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* RDR_FILE_SYSTEM (27) If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined as follows: RDBSS_BUG_CHECK_CACHESUP = 0xca550000, RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000, RDBSS_BUG_CHECK_CLOSE = 0xc10e0000, RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000, Arguments: Arg1: 00000000baad0073 Arg2: fffff8800e4188d8 Arg3: fffff8800e418140 Arg4: fffff88003668c3e Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800e4188d8 -- (.exr 0xfffff8800e4188d8) ExceptionAddress: fffff88003668c3e (rdbss!RxLowIoWriteShellCompletion+0x000000000000002e) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000010 Attempt to read from address 0000000000000010 CONTEXT: fffff8800e418140 -- (.cxr 0xfffff8800e418140) rax=0000000000000000 rbx=00000000c000020c rcx=fffffa80a6be19c0 rdx=00000000c0000128 rsi=0000000000000001 rdi=fffffa80a6be19c0 rip=fffff88003668c3e rsp=fffff8800e418b10 rbp=fffffa80a7cefc80 r8=00000000c000020c r9=0000000000000000 r10=fffffa80a7cefc00 r11=00000000c000026e r12=fffff8800364c110 r13=0000000000000000 r14=fffffa80a6be1900 r15=0000000000000000 iopl=0 nv up ei ng nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282 rdbss!RxLowIoWriteShellCompletion+0x2e: fffff880`03668c3e 458b6710 mov r12d,dword ptr [r15+10h] ds:002b:00000000`00000010=???????? Resetting default scope PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000010 READ_ADDRESS: 0000000000000010 FOLLOWUP_IP: rdbss!RxLowIoWriteShellCompletion+2e fffff880`03668c3e 458b6710 mov r12d,dword ptr [r15+10h] FAULTING_IP: rdbss!RxLowIoWriteShellCompletion+2e fffff880`03668c3e 458b6710 mov r12d,dword ptr [r15+10h] BUGCHECK_STR: 0x27 DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE LAST_CONTROL_TRANSFER: from fffff88003633f77 to fffff88003668c3e STACK_TEXT: fffff880`0e418b10 fffff880`03633f77 : 00000000`c000020c fffffa80`a7cefc80 00000000`00000001 fffff880`0ab51740 : rdbss!RxLowIoWriteShellCompletion+0x2e fffff880`0e418b80 fffff880`03638382 : 00000000`c000020c 00000000`00000000 fffffa80`a6be19c0 00000000`00000000 : rdbss!RxLowIoCompletionTail+0x7f fffff880`0e418bc0 fffff880`0abdcbca : 00000000`c000020c 00000000`00000000 00000000`00000000 fffff880`0364d8f8 : rdbss!RxLowIoCompletion+0x82 fffff880`0e418c00 fffff880`0ab53bb8 : fffff880`0364d4a8 00000000`00000080 fffff880`0364c110 fffffa80`a7cefc00 : mrxsmb20!Smb2Write_Finalize+0x132 fffff880`0e418c50 fffff880`036321b1 : fffff880`0364d4a8 fffff880`0364d4a8 00000000`00000001 fffffa80`a7cefcc0 : mrxsmb!SmbCepFinalizeExchange+0x44 fffff880`0e418c80 fffff800`021766fa : fffff880`0364d4a8 fffff880`0364d8f8 00000000`00000000 00000000`00000000 : rdbss!RxpWorkerThreadDispatcher+0x1a1 fffff880`0e418d40 fffff800`01eb4b46 : fffff800`02050e80 fffffa80`a6e31b60 fffff800`0205ec40 00000000`00000246 : nt!PspSystemThreadStartup+0x5a fffff880`0e418d80 00000000`00000000 : fffff880`0e419000 fffff880`0e413000 fffff880`0e418980 00000000`00000000 : nt!KiStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: rdbss!RxLowIoWriteShellCompletion+2e FOLLOWUP_NAME: MachineOwner MODULE_NAME: rdbss IMAGE_NAME: rdbss.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc219 STACK_COMMAND: .cxr 0xfffff8800e418140 ; kb FAILURE_BUCKET_ID: X64_0x27_rdbss!RxLowIoWriteShellCompletion+2e BUCKET_ID: X64_0x27_rdbss!RxLowIoWriteShellCompletion+2e Followup: MachineOwner --------- 0: kd> .exr 0xfffff8800e4188d8 ExceptionAddress: fffff88003668c3e (rdbss!RxLowIoWriteShellCompletion+0x000000000000002e) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000010 Attempt to read from address 0000000000000010 0: kd> .cxr 0xfffff8800e418140 rax=0000000000000000 rbx=00000000c000020c rcx=fffffa80a6be19c0 rdx=00000000c0000128 rsi=0000000000000001 rdi=fffffa80a6be19c0 rip=fffff88003668c3e rsp=fffff8800e418b10 rbp=fffffa80a7cefc80 r8=00000000c000020c r9=0000000000000000 r10=fffffa80a7cefc00 r11=00000000c000026e r12=fffff8800364c110 r13=0000000000000000 r14=fffffa80a6be1900 r15=0000000000000000 iopl=0 nv up ei ng nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282 rdbss!RxLowIoWriteShellCompletion+0x2e: fffff880`03668c3e 458b6710 mov r12d,dword ptr [r15+10h] ds:002b:00000000`00000010=???????? Do you have an idea, what causes this problem? How can we fix it? Many thanks in advance! Greetings, Karsten Mueller
February 4th, 2012 11:12am

SYMBOL_NAME: rdbss!RxLowIoWriteShellCompletion+2e FOLLOWUP_NAME: MachineOwner MODULE_NAME: rdbss IMAGE_NAME: rdbss.sys - this is windows Driver DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc219 ---------------------------------------------- Hi Karsten, Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error. If ur using (SCSI) adapters,check for the driver updates and check the device manager for any driver issues/updates. I found this one :http://support.microsoft.com/kb/956246 this link has a hotfix download for Vista :For all supported 64-bit versions of Windows Server 2008 and of Windows Vista I would suggest u post this thread link in : http://social.technet.microsoft.com/Forums/en-US/winserverClustering/threads for Solution. Gopi Kiran |Facebook| This posting is provided AS IS with no warranties,and confers no rights.
Free Windows Admin Tool Kit Click here and download it now
February 4th, 2012 11:55am

check if you have the following kb applied http://support.microsoft.com/kb/2584874
February 4th, 2012 11:58am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics