Re: Server 2003 reboots
- From: "Pegasus \(MVP\)" <I.can@xxxxxxx>
- Date: Thu, 9 Nov 2006 12:27:29 +1100
"windcrestred" <windcrestred@xxxxxxxxx> wrote in message
news:D86182DD-B438-42D4-A47D-CEDD16FE6D25@xxxxxxxxxxxxxxxx
Hello:meg
We are running a Dell Server PowerEdge 1800 with a single Xeon 3000 2048
ram. OS is Windoes Server 2003 Standard. Since feb 2006 when this boxwent
live, we have been getting reboots maybe twice a month. The system willhang
then reboot with this error in event viewer. The system isn't under aheavy
load and there doesn't seem to be any kind of pattern. Terminal Servicesis
in application mode and most users are accessing this server throughremote
desktop.to
There are usually no more than 8 users logged in at any time
After reboot there is a system has recovered from a serious error ....
message. When I search for information on this type of error I don't seem
find any exact hits.system,scanned
From Event Log
Details
Product: Windows Operating System
Event ID: 1003
Category (102)
Source: System Error
Version: 5.2
Symbolic Name: ER_KRNLCRASH_LOG
Message: Error code %1, parameter1 %2, parameter2 %3, parameter3 %4,
parameter4 %5.
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 30 0000000
0020: 61 20 20 50 61 72 61 6d a Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 31 2c 20 000001,
0038: 30 30 30 30 30 30 31 62 0000001b
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 30 2c 20 38 30 38 33 00, 8083
0050: 30 66 62 63 0fbc
We have installed the latest drivers for all hardware on the
for viruses and spyware, run memory tests and other diagnostics with theDell
Open Manage Server Administrator. All the hardware passes the tests. Noagain
viruses or spyware was found. I have applied hotfix from KB Article
Number(s): 905909
When I run Windbg on the mini dump files the problem file appears to be
ntkrpamp.exe. see output file below.
Does any body have any experience with this type of error or what steps I
should try next. The end users are getting very frustrated (it happened
today) and my name is mudd around the office. I would appreciate any helpor
feedback you can offer..............................................................................
cheers,
Windcrestred
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini110806-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\local
cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free
x86 compatible
Product: LanManNt, suite: TerminalServer
Built by: 3790.srv03_sp1_qfe.050823-2021
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed Nov 8 15:10:04.234 2006 (GMT-4)
System Uptime: 5 days 19:36:02.983
Loading Kernel Symbols
......................................................
Loading User Symbols****************************************************************************
Loading unloaded module list
.................
***
*****************************************************************************
*
* Bugcheck Analysis
*
*
*
***
****************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {1, 1b, 0, 80830fbc}
Probably caused by : ntkrpamp.exe ( nt!KiUnwaitThread+e )
Followup: MachineOwner
---------
0: kd> !analyze -v
***
*****************************************************************************
*
* Bugcheck Analysis
*
*
*
***
at an
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address
interrupt request level (IRQL) that is too high. This is usuallyedi=8885b828
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80830fbc, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: 00000001
CURRENT_IRQL: 1b
FAULTING_IP:
nt!KiUnwaitThread+e
80830fbc 8b08 mov ecx,dword ptr [eax]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
BUGCHECK_STR: 0xA
PROCESS_NAME: Idle
TRAP_FRAME: 8089a478 -- (.trap ffffffff8089a478)
ErrCode = 00000000
eax=00000001 ebx=00000000 ecx=88aa9450 edx=88aa9450 esi=886dba40
eip=80830fbc esp=8089a4ec ebp=8089a4f0 iopl=0 nv up ei pl nz ac pecy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000efl=00010217
nt!KiUnwaitThread+0xe:
80830fbc 8b08 mov ecx,dword ptr [eax]
ds:0023:00000001=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 80830fbc to 8088bf33
STACK_TEXT:
8089a478 80830fbc badb0d00 88aa9450 89fbed50 nt!KiTrap0E+0x2a7
8089a4f0 808315e6 00000000 ffdffa40 ffdff120 nt!KiUnwaitThread+0xe
8089a5a8 80831d91 00000000 00000000 02eac8be nt!KiTimerExpiration+0x178
8089a600 8088d3ef 00000000 0000000e 00000000 nt!KiRetireDpcList+0x65
8089a604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x37
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiUnwaitThread+e
80830fbc 8b08 mov ecx,dword ptr [eax]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiUnwaitThread+e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 430c04cd
FAILURE_BUCKET_ID: 0xA_nt!KiUnwaitThread+e
BUCKET_ID: 0xA_nt!KiUnwaitThread+e
Followup: MachineOwner
---------
You might have a memory leak. Try rebooting the machine
once a week and see if the problem persists.
.
- Follow-Ups:
- Re: Server 2003 reboots
- From: windcrestred
- Re: Server 2003 reboots
- References:
- Server 2003 reboots
- From: windcrestred
- Server 2003 reboots
- Prev by Date: Disable Udates Ready Balloon
- Next by Date: Re: Change Installation Source Location
- Previous by thread: Server 2003 reboots
- Next by thread: Re: Server 2003 reboots
- Index(es):
Relevant Pages
|
Loading
