Re: Crashdump Win2k Server

I'm afraid that mini dump is too limited to analyze and obtain enough
infomations.Because 64k minidump is just like the memory of Dos system.

I suggest that you config "Write debugging information" to Complete memory
dump.

--
Junxiu Lee
Diyinside Community Publications Division

http://www.diyinside.com

Diyinside, The Pleasure of Technology.

This posting is provided "AS IS" with no warranties.
Please respond to newsgroups only ...
"Ralf Klebermass" <ralf@xxxxxxxxxxxxxx> wrote in message
news:428f759f$0$10578$3b214f66@xxxxxxxxxxxxxxxxxxxxxxx
> my windows 2000 server (sp4, latest updates) is crashing from time to time
> whit BSOD error 0A (irql_not_less_or_equal). i analyzed the crashdump (64k
> dump) with the debugging tools, but i am not able to find out, what the
> cause of the crashes is.
> maybe anyone can help me analyze this?
>
> here the log file from debugger:
>
>
> Microsoft (R) Windows Debugger Version 6.4.0007.2
>
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\WINNT.SBS\Minidump\Mini052105-01.dmp]
>
> Mini Kernel Dump File: Only registers and stack trace are available
>
> Symbol search path is: c:\winnt.sbs\symbols
>
> Executable search path is:
>
> Unable to load image ntoskrnl.exe, Win32 error 2
>
> *** WARNING: symbols timestamp is wrong 0x42258bf7 0x3ee6c002 for
> ntoskrnl.exe
>
> Windows 2000 Kernel Version 2195 (Service Pack 4) MP (2 procs) Free x86
> compatible
>
> Kernel base = 0x80400000 PsLoadedModuleList = 0x80485ac0
>
> Debug session time: Sat May 21 07:34:13.656 2005 (GMT+2)
>
> System Uptime: not available
>
> Unable to load image ntoskrnl.exe, Win32 error 2
>
> *** WARNING: symbols timestamp is wrong 0x42258bf7 0x3ee6c002 for
> ntoskrnl.exe
>
> Loading Kernel Symbols
>
> ...........................................................................................................
>
> Loading unloaded module list
>
> ...............
>
> Loading User Symbols
>
> *******************************************************************************
>
> * *
>
> * Bugcheck Analysis *
>
> * *
>
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck A, {0, 1c, 0, 8042d43f}
>
> Probably caused by : ntoskrnl.exe ( nt!KeConnectInterrupt+90 )
>
> Followup: MachineOwner
>
> ---------
>
> 0: kd> !analyze -v
>
> *******************************************************************************
>
> * *
>
> * Bugcheck Analysis *
>
> * *
>
> *******************************************************************************
>
> IRQL_NOT_LESS_OR_EQUAL (a)
>
> An attempt was made to access a pageable (or completely invalid) address
> at an
>
> interrupt request level (IRQL) that is too high. This is usually
>
> caused by drivers using improper addresses.
>
> If a kernel debugger is available get the stack backtrace.
>
> Arguments:
>
> Arg1: 00000000, memory referenced
>
> Arg2: 0000001c, IRQL
>
> Arg3: 00000000, value 0 = read operation, 1 = write operation
>
> Arg4: 8042d43f, address which referenced memory
>
> Debugging Details:
>
> ------------------
>
>
> READ_ADDRESS: unable to read from 80482fac
>
> unable to read from 80482a08
>
> unable to read from 804828e0
>
> unable to read from 80474e00
>
> unable to read from 804828f8
>
> unable to read from 80482a04
>
> unable to read from 80474e04
>
> unable to read from 80482ac4
>
> unable to read from 80482f80
>
> 00000000
>
> CURRENT_IRQL: 1c
>
> FAULTING_IP:
>
> nt!KeConnectInterrupt+90
>
> 8042d43f ?? ???
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> BUGCHECK_STR: 0xA
>
> LAST_CONTROL_TRANSFER: from 00000000 to 8046b11c
>
> STACK_TEXT:
>
> bce55cb8 00000000 00000000 0000001c 00000000
> nt!ExAllocatePoolWithTag+0x3b1
>
>
> STACK_COMMAND: .bugcheck ; kb
>
> FOLLOWUP_IP:
>
> nt!KeConnectInterrupt+90
>
> 8042d43f ?? ???
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: nt!KeConnectInterrupt+90
>
> MODULE_NAME: nt
>
> IMAGE_NAME: ntoskrnl.exe
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 42258bf7
>
> FAILURE_BUCKET_ID: 0xA_nt!KeConnectInterrupt+90
>
> BUCKET_ID: 0xA_nt!KeConnectInterrupt+90
>
> Followup: MachineOwner
>
> ---------
>
>
>
>
>


.

Relevant Pages