Re: Server 2003 reboots


"windcrestred" <windcrestred@xxxxxxxxx> wrote in message
news:FDDA5A1E-F98B-4DAA-82FB-3CF1017128B0@xxxxxxxxxxxxxxxx


"Pegasus (MVP)" wrote:


"windcrestred" <windcrestred@xxxxxxxxx> wrote in message
news:D86182DD-B438-42D4-A47D-CEDD16FE6D25@xxxxxxxxxxxxxxxx
Hello:

We are running a Dell Server PowerEdge 1800 with a single Xeon 3000
2048
meg
ram. OS is Windoes Server 2003 Standard. Since feb 2006 when this box
went
live, we have been getting reboots maybe twice a month. The system
will
hang
then reboot with this error in event viewer. The system isn't under a
heavy
load and there doesn't seem to be any kind of pattern. Terminal
Services
is
in application mode and most users are accessing this server through
remote
desktop.
There are usually no more than 8 users logged in at any time
After reboot there is a system has recovered from a serious error ....
message. When I search for information on this type of error I don't
seem
to
find any exact hits.

From Event Log
Details
Product: Windows Operating System
Event ID: 1003
Category (102)
Source: System Error
Version: 5.2
Symbolic Name: ER_KRNLCRASH_LOG
Message: Error code %1, parameter1 %2, parameter2 %3, parameter3 %4,
parameter4 %5.

0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 30 0000000
0020: 61 20 20 50 61 72 61 6d a Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 31 2c 20 000001,
0038: 30 30 30 30 30 30 31 62 0000001b
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 30 2c 20 38 30 38 33 00, 8083
0050: 30 66 62 63 0fbc

We have installed the latest drivers for all hardware on the
system,scanned
for viruses and spyware, run memory tests and other diagnostics with
the
Dell
Open Manage Server Administrator. All the hardware passes the tests.
No
viruses or spyware was found. I have applied hotfix from KB Article
Number(s): 905909

When I run Windbg on the mini dump files the problem file appears to
be
ntkrpamp.exe. see output file below.

Does any body have any experience with this type of error or what
steps I
should try next. The end users are getting very frustrated (it
happened
again
today) and my name is mudd around the office. I would appreciate any
help
or
feedback you can offer.

cheers,
Windcrestred



Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini110806-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\local
cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs)
Free
x86 compatible
Product: LanManNt, suite: TerminalServer
Built by: 3790.srv03_sp1_qfe.050823-2021
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed Nov 8 15:10:04.234 2006 (GMT-4)
System Uptime: 5 days 19:36:02.983
Loading Kernel Symbols


.............................................................................
..
......................................................
Loading User Symbols
Loading unloaded module list
.................


****************************************************************************
***
*
*
* Bugcheck Analysis
*
*
*


****************************************************************************
***

Use !analyze -v to get detailed debugging information.

BugCheck A, {1, 1b, 0, 80830fbc}

Probably caused by : ntkrpamp.exe ( nt!KiUnwaitThread+e )

Followup: MachineOwner
---------

0: kd> !analyze -v


****************************************************************************
***
*
*
* Bugcheck Analysis
*
*
*


****************************************************************************
***

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address
at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80830fbc, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000001

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KiUnwaitThread+e
80830fbc 8b08 mov ecx,dword ptr [eax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xA

PROCESS_NAME: Idle

TRAP_FRAME: 8089a478 -- (.trap ffffffff8089a478)
ErrCode = 00000000
eax=00000001 ebx=00000000 ecx=88aa9450 edx=88aa9450 esi=886dba40
edi=8885b828
eip=80830fbc esp=8089a4ec ebp=8089a4f0 iopl=0 nv up ei pl nz
ac pe
cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010217
nt!KiUnwaitThread+0xe:
80830fbc 8b08 mov ecx,dword ptr [eax]
ds:0023:00000001=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 80830fbc to 8088bf33

STACK_TEXT:
8089a478 80830fbc badb0d00 88aa9450 89fbed50 nt!KiTrap0E+0x2a7
8089a4f0 808315e6 00000000 ffdffa40 ffdff120 nt!KiUnwaitThread+0xe
8089a5a8 80831d91 00000000 00000000 02eac8be
nt!KiTimerExpiration+0x178
8089a600 8088d3ef 00000000 0000000e 00000000 nt!KiRetireDpcList+0x65
8089a604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x37


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiUnwaitThread+e
80830fbc 8b08 mov ecx,dword ptr [eax]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiUnwaitThread+e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 430c04cd

FAILURE_BUCKET_ID: 0xA_nt!KiUnwaitThread+e

BUCKET_ID: 0xA_nt!KiUnwaitThread+e

Followup: MachineOwner
---------

You might have a memory leak. Try rebooting the machine
once a week and see if the problem persists.


Thank you for your quick response!

Could this be caused by remote users disconnecting from a remote desktop
session with out logging off? There appear to be several users doing this.
If this memory leak is the case and rebooting once a week mitigates this
issue what else we can do that would be a more permanent solution?
Most of the apps are Microsoft but there is an accounting package and a
CRM
app that could be at issue


Rebooting once a week is a temporary measure. It would confirm that
the problem is somehow related to the total uptime. I would check how
the amount of free memory changes as time goes by.


.

Relevant Pages

  • Re: Server 2003 reboots
    ... If a kernel debugger is available get the stack backtrace. ... FOLLOWUP_NAME: MachineOwner ... Could this be caused by remote users disconnecting from a remote desktop ... If this memory leak is the case and rebooting once a week mitigates this ...
    (microsoft.public.windows.server.general)
  • Re: How to slove these bugcheck code??
    ... It seems to me your device/driver is badly corrupting the system memory. ... > I got these bugcheck code when I develop my own dma driver. ... > FOLLOWUP_NAME: MachineOwner ... > If a kernel debugger is available get the stack backtrace. ...
    (microsoft.public.development.device.drivers)
  • RE: System reboots intermittently - WinXP SP2
    ... Perhaps you may need to re-seat device cables, cards, memory sticks, CPU, ... Problem is I don't even have that sound card installed anymore. ... Microsoft Windows Debugger Version 6.5.0003.7 ... FOLLOWUP_NAME: MachineOwner ...
    (microsoft.public.windowsxp.perform_maintain)
  • DumpFiles
    ... I am getting this error from my memory dump. ... *** The machine has been manipulated using the kernel debugger. ... Followup: MachineOwner ... MODULE_NAME: VSApiNt ...
    (microsoft.public.windows.server.general)
  • ntoskernel error and bluescreen
    ... I ran debugger on memory dump file and got the following: ... If a kernel debugger is available get the stack backtrace. ... Arg2: 00000002, IRQL ... FOLLOWUP_NAME: MachineOwner ...
    (microsoft.public.win2000.general)