Server 2003 reboots
- From: windcrestred <windcrestred@xxxxxxxxx>
- Date: Wed, 8 Nov 2006 12:52:01 -0800
Hello:
We are running a Dell Server PowerEdge 1800 with a single Xeon 3000 2048 meg
ram. OS is Windoes Server 2003 Standard. Since feb 2006 when this box went
live, we have been getting reboots maybe twice a month. The system will hang
then reboot with this error in event viewer. The system isn't under a heavy
load and there doesn't seem to be any kind of pattern. Terminal Services is
in application mode and most users are accessing this server through remote
desktop.
There are usually no more than 8 users logged in at any time
After reboot there is a system has recovered from a serious error ....
message. When I search for information on this type of error I don't seem to
find any exact hits.
From Event LogDetails
Product: Windows Operating System
Event ID: 1003
Category (102)
Source: System Error
Version: 5.2
Symbolic Name: ER_KRNLCRASH_LOG
Message: Error code %1, parameter1 %2, parameter2 %3, parameter3 %4,
parameter4 %5.
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 30 0000000
0020: 61 20 20 50 61 72 61 6d a Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 31 2c 20 000001,
0038: 30 30 30 30 30 30 31 62 0000001b
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 30 2c 20 38 30 38 33 00, 8083
0050: 30 66 62 63 0fbc
We have installed the latest drivers for all hardware on the system,scanned
for viruses and spyware, run memory tests and other diagnostics with the Dell
Open Manage Server Administrator. All the hardware passes the tests. No
viruses or spyware was found. I have applied hotfix from KB Article
Number(s): 905909
When I run Windbg on the mini dump files the problem file appears to be
ntkrpamp.exe. see output file below.
Does any body have any experience with this type of error or what steps I
should try next. The end users are getting very frustrated (it happened again
today) and my name is mudd around the office. I would appreciate any help or
feedback you can offer.
cheers,
Windcrestred
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini110806-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\local
cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free
x86 compatible
Product: LanManNt, suite: TerminalServer
Built by: 3790.srv03_sp1_qfe.050823-2021
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed Nov 8 15:10:04.234 2006 (GMT-4)
System Uptime: 5 days 19:36:02.983
Loading Kernel Symbols
...................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {1, 1b, 0, 80830fbc}
Probably caused by : ntkrpamp.exe ( nt!KiUnwaitThread+e )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80830fbc, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: 00000001
CURRENT_IRQL: 1b
FAULTING_IP:
nt!KiUnwaitThread+e
80830fbc 8b08 mov ecx,dword ptr [eax]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
BUGCHECK_STR: 0xA
PROCESS_NAME: Idle
TRAP_FRAME: 8089a478 -- (.trap ffffffff8089a478)
ErrCode = 00000000
eax=00000001 ebx=00000000 ecx=88aa9450 edx=88aa9450 esi=886dba40 edi=8885b828
eip=80830fbc esp=8089a4ec ebp=8089a4f0 iopl=0 nv up ei pl nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010217
nt!KiUnwaitThread+0xe:
80830fbc 8b08 mov ecx,dword ptr [eax]
ds:0023:00000001=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 80830fbc to 8088bf33
STACK_TEXT:
8089a478 80830fbc badb0d00 88aa9450 89fbed50 nt!KiTrap0E+0x2a7
8089a4f0 808315e6 00000000 ffdffa40 ffdff120 nt!KiUnwaitThread+0xe
8089a5a8 80831d91 00000000 00000000 02eac8be nt!KiTimerExpiration+0x178
8089a600 8088d3ef 00000000 0000000e 00000000 nt!KiRetireDpcList+0x65
8089a604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x37
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiUnwaitThread+e
80830fbc 8b08 mov ecx,dword ptr [eax]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiUnwaitThread+e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 430c04cd
FAILURE_BUCKET_ID: 0xA_nt!KiUnwaitThread+e
BUCKET_ID: 0xA_nt!KiUnwaitThread+e
Followup: MachineOwner
---------
.
- Follow-Ups:
- Re: Server 2003 reboots
- From: Pegasus \(MVP\)
- Re: Server 2003 reboots
- Prev by Date: Re: 2003 server std moving to the new hardware
- Next by Date: Re: R2:Export/import FileServerResourceManngerConfig
- Previous by thread: Public Folders not working correctly on new Exchange 2003 Server
- Next by thread: Re: Server 2003 reboots
- Index(es):
Relevant Pages
|
