Re: Volume Shadow Copy & Blue Screens

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

I'd send the dump to IBM as they recommend in the TSM problem determination
guide.


"G Man" <G Man@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:37CBBBA9-F0DB-4485-AF9B-A3103B14A2DF@xxxxxxxxxxxxxxxx
Hi all! We have a long standing issue with a Windows 2003 / Exchange 2003
server in our environment. Occassionally (every couple or few months) it
blue
screens during backups. When I analyze the memory dump with windbg it
seems
to be related to ntfs.sys and the shadow copy services. Below is the
windbg
output...

Can anybody offer any suggestions? This only ever happens during backups
at
the wee hours of the morning. We are using the TDP TSM client for Exchange
which, as far as I know, includes VSS support.

1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 0019033c
Arg2: f68de8f4
Arg3: f68de5f0
Arg4: e083f9b7

Debugging Details:
------------------






EXCEPTION_RECORD: f68de8f4 -- (.exr 0xfffffffff68de8f4)
ExceptionAddress: e083f9b7 (nt!IofCallDriver+0x0000003c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000008
Attempt to read from address 00000008

CONTEXT: f68de5f0 -- (.cxr 0xfffffffff68de5f0)
eax=0000001b ebx=fb3269a0 ecx=00000000 edx=fb3269a0 esi=fcb4b820
edi=fca099d8
eip=e083f9b7 esp=f68de9bc ebp=f68de9c0 iopl=0 nv up ei ng nz ac pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00000296
nt!IofCallDriver+0x3c:
e083f9b7 8b7108 mov esi,dword ptr [ecx+8]
ds:0023:00000008=????????
Resetting default scope

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced
memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000008

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from f6322c53 to e083f9b7

STACK_TEXT:
f68de9c0 f6322c53 fcb4b820 fb326b30 f68de9f8 nt!IofCallDriver+0x3c
f68de9e8 e083f9c0 fca099d8 fb3269a0 f68dea74 fltmgr!FltpDispatch+0x6f
f68de9fc e08f6a35 fb8409c8 f68dea74 fba44020 nt!IofCallDriver+0x45
f68dea28 e08f6ab4 fca099d8 f68dea50 f68dea48 nt!IopSynchronousCall+0xbe
f68dea78 e08c755b fb8409c8 f68dea88 00000000
nt!IopGetRelatedTargetDevice+0x62
f68dea8c e08c74bf fb8409c8 f68deaa8 00000000
nt!IoGetRelatedTargetDevice+0x16
f68dead0 f62ab2ec fb8409c8 00000006 fbb38250
nt!FsRtlNotifyVolumeEvent+0x20
f68decf0 f62aab0d fb6e7d18 fbb38250 fb6e7d18 Ntfs!NtfsMountVolume+0x17e1
f68ded04 f626b93f fb6e7d18 fbb38250 fcb93db0
Ntfs!NtfsCommonFileSystemControl+0x39
f68ded80 e083f71e fb6e7d18 00000000 fcb93db0 Ntfs!NtfsFspDispatch+0x217
f68dedac e092ccff fb6e7d18 00000000 00000000 nt!ExpWorkerThread+0xeb
f68deddc e0841a86 e083f661 00000000 00000000
nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
Ntfs!NtfsMountVolume+17e1
f62ab2ec 8b4d8c mov ecx,dword ptr [ebp-74h]

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: Ntfs!NtfsMountVolume+17e1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42435dfd

STACK_COMMAND: .cxr 0xfffffffff68de5f0 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsMountVolume+17e1

BUCKET_ID: 0x24_Ntfs!NtfsMountVolume+17e1

Followup: MachineOwner
---------






1: kd> .cxr f68de5f0
eax=0000001b ebx=fb3269a0 ecx=00000000 edx=fb3269a0 esi=fcb4b820
edi=fca099d8
eip=e083f9b7 esp=f68de9bc ebp=f68de9c0 iopl=0 nv up ei ng nz ac pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00000296
nt!IofCallDriver+0x3c:
e083f9b7 8b7108 mov esi,dword ptr [ecx+8]
ds:0023:00000008=????????
1: kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
f68de9c0 f6322c53 fcb4b820 fb326b30 f68de9f8 nt!IofCallDriver+0x3c
f68de9e8 e083f9c0 fca099d8 fb3269a0 f68dea74 fltmgr!FltpDispatch+0x6f
f68de9fc e08f6a35 fb8409c8 f68dea74 fba44020 nt!IofCallDriver+0x45
f68dea28 e08f6ab4 fca099d8 f68dea50 f68dea48 nt!IopSynchronousCall+0xbe
f68dea78 e08c755b fb8409c8 f68dea88 00000000
nt!IopGetRelatedTargetDevice+0x62
f68dea8c e08c74bf fb8409c8 f68deaa8 00000000
nt!IoGetRelatedTargetDevice+0x16
f68dead0 f62ab2ec fb8409c8 00000006 fbb38250
nt!FsRtlNotifyVolumeEvent+0x20
f68decf0 f62aab0d fb6e7d18 fbb38250 fb6e7d18 Ntfs!NtfsMountVolume+0x17e1
f68ded04 f626b93f fb6e7d18 fbb38250 fcb93db0
Ntfs!NtfsCommonFileSystemControl+0x39
f68ded80 e083f71e fb6e7d18 00000000 fcb93db0 Ntfs!NtfsFspDispatch+0x217
f68dedac e092ccff fb6e7d18 00000000 00000000 nt!ExpWorkerThread+0xeb
f68deddc e0841a86 e083f661 00000000 00000000
nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


.

Relevant Pages

  • Re: Blue Screen of Death
    ... take to analyse a memory dump of a BSOD in order to understand the cause. ... Win32 error 2 ... Loading Kernel Symbols ... Some common problems are exception code 0x80000003. ...
    (microsoft.public.windows.server.sbs)
  • BSoD references missing file?
    ... OS Manufacturer Microsoft Corporation ... I tried backing up the registry and removing these keys, ... Here's a kernel dump from the most recent crash: ... The exception code that was not handled ...
    (microsoft.public.windowsxp.general)
  • Re: A process serving application pool DefaultAppPool failed to resp
    ... kernel32!RaiseException+53 in C:\WINDOWS\system32\kernel32.dll from Microsoft ... Corporation has caused a CLR Exception) on thread 19 ... It is recommended that you get another dump of the target process when the ... If you wish to enable combined crash and hang analysis for crash ...
    (microsoft.public.inetserver.iis)
  • A process serving application pool DefaultAppPool failed to resp
    ... kernel32!RaiseException+53 in C:\WINDOWS\system32\kernel32.dll from Microsoft ... Corporation has caused a CLR Exception) on thread 19 ... It is recommended that you get another dump of the target process when the ... If you wish to enable combined crash and hang analysis for crash ...
    (microsoft.public.inetserver.iis)
  • Re: BSoD references missing file?
    ... Here's a kernel dump from the most recent crash: ... Loading Kernel Symbols ... The exception code that was not handled ... The Mmig46 Registry key denied access to SYSTEM account programs so ...
    (microsoft.public.windowsxp.help_and_support)