Re: WBEM/WMI crashing. A lot. And I mean a lot
- From: "Gabriel GHIZILA [MSFT]" <gghizila@xxxxxxxxxxxxxxxxxxxx>
- Date: Tue, 16 Aug 2005 00:19:50 -0700
I think you have to try to figure out what changed on the machine, something
you might have installed or something installed by your IT department etc.
It may be many things at first sight
- hardware failure - you could check in the logs for some other errors than
the one you mention. Just make event log larger so you can get as much as
possible. It might me some error on the disk or memory error. Check using
tools available from your hardware provider or chkdsk respectivelly.
- The disk may have a corrupted image of cimwin32.dll or other dlls - You
could try to compare files on your computer to a different one or to your
installation disk.
- you can try to use debugger or tlist.exe to see what else is loaded
(non-system) in the crashing wmiprvse. These are available at
http://www.microsoft.com/whdc/devtools/debugging/default.mspx
- Also you can run appverifier package on wmiprvse and enable pageheap to
catch possible heap corruptions right where they happen. The package is
available at
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/appvrfr.mspx.
You might try to make debugger attach when wmiprvse starts (that is a little
bit more complex if you don't know it yet, the debugger does not show up so
you need to make it as a server and connect "remotelly" from the same
machine)
--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm.
"Dr Pizza" <DrPizza@xxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:xn0e5vp9j2q012w000@xxxxxxxxxxxxxxxxxxxxxxx
> Like, once or twice a minute. I've rebuilt the repository (including
> clearing it completely; removing the autorepair stuff, reregistering
> all the libraries, recompiling all the mofs) to no avail. I've also
> tried removing all the mofs except the cimwin32.mof and cimwin32.mfl.
>
> Windows 2003 SP1.
>
> Doing a "tasklist.exe" stands about a 50% chance of crashing it:
>
> [C:\WINDOWS\system32\wbem]tasklist.exe
> ERROR: The remote procedure call failed.
>
>
> The WMI MMC also has a similar chance of not being able to display the
> properties properly, with the same error (RPC failure). The event log
> notes:
>
> Faulting application wmiprvse.exe, version 5.2.3790.1830, faulting
> module ntdll.dll, version 5.2.3790.1830, fault address 0x00012009.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Something is crashing it automatically, too, though I'm not sure what;
> I'm seeing a crash every minute or so. A stack trace says that:
>
> ChildEBP RetAddr Args to Child
> 0091ea00 7c81e85e 00000000 007ec000 0091ea2c
> ntdll!RtlpCoalesceFreeBlocks+0x128 (FPO: [Non-Fpo])
> 0091ea38 7c81e4ef 01030000 00010008 00010000 ntdll!RtlpExtendHeap+0x2bc
> (FPO: [Non-Fpo])
> 0091ec64 77bbd08c 00030000 00000000 00010000
> ntdll!RtlAllocateHeap+0x645 (FPO: [Non-Fpo])
> 0091ec84 5db6eb8c 00010000 77bbcefb 0091ece8 msvcrt!malloc+0x6c (FPO:
> [Non-Fpo])
> 0091ec94 5dac8a4f 00010000 007d0658 0091ed50 cimwin32!operator
> new[]+0xe (FPO: [Non-Fpo])
> 0091ece8 5dac9f7f 007d05f0 0091ed50 007d05f0
> cimwin32!Process::GetProcessBlocks+0x70 (FPO: [Non-Fpo])
> 0091ed40 5dacc4c1 007d05f0 007cfbc8 0091ed80
> cimwin32!Process::RefreshProcessCacheNT+0x141 (FPO: [Non-Fpo])
> 0091efa4 5dacc7ca 007cfbc8 00000000 00000000
> cimwin32!Process::Enumerate+0x79 (FPO: [Non-Fpo])
> 0091efbc 6939b5ec 007cfbc8 0091f004 00000000
> cimwin32!Process::ExecQuery+0x22 (FPO: [Non-Fpo])
> 0091efdc 693a0136 007cfbc8 0091f004 00000000
> framedyn!Provider::ExecuteQuery+0x5d (FPO: [Non-Fpo])
> 0091f4d0 010193ec 007cfb78 000b2094 000bf854
> framedyn!CWbemProviderGlue::ExecQueryAsync+0x235 (FPO: [Non-Fpo])
> 0091f520 01019591 00000000 000b2094 000bf854
> wmiprvse!CInterceptor_IWbemSyncProvider::Helper_ExecQueryAsync+0x44d
> (FPO: [Non-Fpo])
> 0091f568 77c70f3b 007cfb78 000b1614 000bdaac
> wmiprvse!CInterceptor_IWbemSyncProvider::ExecQueryAsync+0x85 (FPO:
> [Non-Fpo])
> 0091f594 77ce23f7 0101950c 0091f778 00000006 RPCRT4!Invoke+0x30
> 0091f994 77ce1a95 000bc3e8 000b0f4c 000ae494 RPCRT4!NdrStubCall2+0x299
> (FPO: [Non-Fpo])
> 0091f9ec 7557e487 000bc3e8 000ae494 000b0f4c
> RPCRT4!CStdStubBuffer_Invoke+0xc6 (FPO: [Non-Fpo])
> 0091fa00 77788ec1 005d134c 000ae494 000b0f4c
> FastProx!CBaseStublet::Invoke+0x22 (FPO: [Non-Fpo])
> 0091fa44 77788e74 000ae494 000bc428 000ab0c8 ole32!SyncStubInvoke+0x33
> (FPO: [Non-Fpo])
> 0091fa8c 7769b2b7 000ae494 000bc300 005d134c ole32!StubInvoke+0xa7
> (FPO: [Non-Fpo])
> 0091fb64 7769b0b5 000b0f4c 00000000 005d134c
> ole32!CCtxComChnl::ContextInvoke+0xe3 (FPO: [Non-Fpo])
>
>
> which suggests that the heap is getting corrupted.
>
> They're all similar. I can't easily tell when this started because my
> event log is filled with crash reports.
>
> Any ideas?
.
- Follow-Ups:
- Re: WBEM/WMI crashing. A lot. And I mean a lot
- From: Dr Pizza
- Re: WBEM/WMI crashing. A lot. And I mean a lot
- References:
- WBEM/WMI crashing. A lot. And I mean a lot
- From: Dr Pizza
- WBEM/WMI crashing. A lot. And I mean a lot
- Prev by Date: Re: Getting info on USB Devices!
- Next by Date: Multithreaded WMI scripts
- Previous by thread: WBEM/WMI crashing. A lot. And I mean a lot
- Next by thread: Re: WBEM/WMI crashing. A lot. And I mean a lot
- Index(es):
Relevant Pages
|
