Re: server crashing/restarting consistently
- From: "Les Connor [SBS Community Member - SBS MVP]" <les.connor@xxxxxxxxxxxx>
- Date: Wed, 6 Jul 2005 22:46:53 -0500
If the crashes are related to Trend, they can only be because of a
misconfiguration of the application(s). So many use Trend, that if it was a
more general issue the noise would be unbearable. As in that pattern file
issue of a year or so ago, literally hundreds of posts in less than an hour.
If Trend is suspected, then inspect the exclusion list for the server file
system in Officescan; Realtime (I/O), scheduled, and manual scans - make
sure any scanning method you use or may use has the appropriate exclusions.
If exclusions are set correctly, then I doubt this is caused by Trend A/V.
--
Les Connor [SBS Community Member - SBS MVP]
-----------------------------------------------------------
SBS Rocks !
"Bill Swan" <bill@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:uXACcaogFHA.1252@xxxxxxxxxxxxxxxxxxxxxxx
> Hi Eric, are you able to take trend out of the equation. Hopefully before
> a restart, disconnect from the internet, disable trend services and see
> what happens ? Uninstall and reinstall trend ? Install a time limit
> alternative virus protection?
>
> --
> Thinking of upgrading .. COOL... http://www.sbsmigration.com
>
> www.smallbizserver.net (2000 and 2003)
>
> microsoft.public.backoffice.smallbiz2000 (2000 NG)
>
> microsoft.public.windows.server.sbs (2003 NG)
>
> http://groups.google.com/groups?hl=en&safe=off&group=microsoft.public.backoffice.smallbiz2000
>
> http://groups.google.com/groups?hl=en&lr=lang_en&ie=UTF-8&safe=off&group=microsoft.public.windows.server.sbs
>
> http://www.sbslinks.com/
>
>
> "Eric" <Eric@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:2120CB4A-DD1C-440E-BBDD-7C6BFF5673B3@xxxxxxxxxxxxxxxx
>> Yes almost everday. I have run extensive memory tests, so that kind of
>> hardware problem can be ruled out. This propblem has existed before and
>> after installation of SP1. I've checked similar posts with people having
>> problems with random restarts, but so far I am fruitless in finding the
>> proper solution. This problem is like yours in that it's not quite so
>> random
>> because it always occurs in the morning. Very strange. Any help on
>> reading
>> the memory dump file? I do now know how to investigate memory dumps.
>>
>> "Orville" wrote:
>>
>>> Is restarting literally EVERYDAY? I have a similar problem but restart
>>> occurs from 1 to 6 days. However, each restart occur at approximately
>>> 7am &
>>> 12 pm.
>>> See my posting on 7/1/05 titled "SBS 2003 Rebooting at Random - Bugcheck
>>> String 0x0000008e". It may provide some ideas.
>>>
>>> Orville
>>>
>>>
>>>
>>>
>>>
>>> "Eric" <Eric@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
>>> news:EEB58CEA-345F-49B8-AD9E-7D0F5DDA63D9@xxxxxxxxxxxxxxxx
>>> > My SBS 2003 server is crashing consistently, and I think it may have
>>> > something to do with Trend Micro CSM for SMB b/c this behavior started
>>> after
>>> > installation of their software. I cannot fully establish if that is
>>> > true
>>> at
>>> > this time. Regardless, the server restarts itself every day anywhere
>>> > from
>>> > the the early morning to late moring. I analyzed the memory dump file
>>> with
>>> > the latest version of Windows Debugger, and it relayed the following
>>> > information concerning the dump file. Any help analyzing the output
>>> > of
>>> the
>>> > dump file would be GREATLY appreciated.
>>> >
>>> > Here it is:
>>> >
>>> > Microsoft (R) Windows Debugger Version 6.4.0007.2
>>> > Copyright (c) Microsoft Corporation. All rights reserved.
>>> >
>>> >
>>> > Loading Dump File [C:\WINDOWS\MEMORY.DMP]
>>> > Kernel Complete Dump File: Full address space is available
>>> >
>>> > Symbol search path is: c:\windows\symbols
>>> > Executable search path is:
>>> > Windows Server 2003 Kernel Version 3790 UP Free x86 compatible
>>> > Product: LanManNt, suite: SmallBusiness TerminalServer
>>> > SmallBusinessRestricted
>>> >
>>> > SingleUserTS
>>> > Built by: 3790.srv03_rtm.030324-2048
>>> > Kernel base = 0x804de000 PsLoadedModuleList = 0x80568c08
>>> > Debug session time: Mon Apr 26 12:44:02.704 2004 (GMT-5)
>>> > System Uptime: 0 days 21:24:39.284
>>> > Loading Kernel Symbols
>>> >
>>> .............................................................................
>>> ............
>>> >
>>> > ..................
>>> > Loading unloaded module list
>>> > ..................
>>> > Loading User Symbols
>>> >
>>> ****************************************************************************
>>> ***
>>> > *
>>> > *
>>> > * Bugcheck Analysis
>>> > *
>>> > *
>>> > *
>>> >
>>> ****************************************************************************
>>> ***
>>> >
>>> > Use !analyze -v to get detailed debugging information.
>>> >
>>> > BugCheck 7E, {c0000005, 804e446a, f15977a4, f15973f4}
>>> >
>>> > Probably caused by : TmXPFlt.sys ( TmXPFlt+b8db )
>>> >
>>> > Followup: MachineOwner
>>> > ---------
>>> >
>>> > kd> !analyze -v
>>> >
>>> ****************************************************************************
>>> ***
>>> > *
>>> > *
>>> > * Bugcheck Analysis
>>> > *
>>> > *
>>> > *
>>> >
>>> ****************************************************************************
>>> ***
>>> >
>>> > SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
>>> > This is a very common bugcheck. Usually the exception address
>>> > pinpoints
>>> > the driver/function that caused the problem. Always note this address
>>> > as well as the link date of the driver/image that contains this
>>> > address.
>>> > Arguments:
>>> > Arg1: c0000005, The exception code that was not handled
>>> > Arg2: 804e446a, The address that the exception occurred at
>>> > Arg3: f15977a4, Exception Record Address
>>> > Arg4: f15973f4, Context Record Address
>>> >
>>> > Debugging Details:
>>> > ------------------
>>> >
>>> >
>>> > ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
>>> referenced
>>> > memory at
>>> >
>>> > "0x%08lx". The memory could not be "%s".
>>> >
>>> > FAULTING_IP:
>>> > nt!ObfDereferenceObject+1d
>>> > 804e446a f00fc13e lock xadd [esi],edi
>>> >
>>> > EXCEPTION_PARAMETER1: f15977a4
>>> >
>>> > CONTEXT: f15973f4 -- (.cxr fffffffff15973f4)
>>> > eax=81cd898c ebx=00000000 ecx=40000800 edx=f219e5b0 esi=400007e8
>>> edi=ffffffff
>>> > eip=804e446a esp=f159786c ebp=40000800 iopl=0 nv up ei ng nz
>>> > na po
>>> nc
>>> > cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
>>> efl=00010286
>>> > nt!ObfDereferenceObject+0x1d:
>>> > 804e446a f00fc13e lock xadd [esi],edi
>>> ds:0023:400007e8=????????
>>> > Resetting default scope
>>> >
>>> > DEFAULT_BUCKET_ID: DRIVER_FAULT
>>> >
>>> > BUGCHECK_STR: 0x7E
>>> >
>>> > CURRENT_IRQL: 0
>>> >
>>> > LAST_CONTROL_TRANSFER: from f21818db to 804e446a
>>> >
>>> > STACK_TEXT:
>>> > f1597878 f21818db 00000000 81cd8808 f21785d5
>>> > nt!ObfDereferenceObject+0x1d
>>> > WARNING: Stack unwind information not available. Following frames may
>>> > be
>>> > wrong.
>>> > f15978f4 804e0e0d 8198fec0 00000108 81cd8808 TmXPFlt+0xb8db
>>> > f1597904 8057be4b 81db1b38 81da5e60 f1597adc nt!IofCallDriver+0x3f
>>> > f15979ec 80586490 8198fe08 00000000 819a57f8 nt!IopParseDevice+0xa7b
>>> > f1597a24 80577c9a 81db1b38 00000000 819a57f8 nt!IopParseFile+0x44
>>> > f1597a9c 80577b79 00001cd4 f1597adc 00000040
>>> > nt!ObpLookupObjectName+0x117
>>> > f1597af0 8057c101 00000000 00000000 58caee00
>>> > nt!ObOpenObjectByName+0xe8
>>> > f1597b6c 8057c1be f1597ccc 0002019f f1597c94 nt!IopCreateFile+0x413
>>> > f1597bb8 f0b1a4ee f1597ccc 0002019f f1597c94 nt!IoCreateFile+0x3d
>>> > f1597c28 f0b166c9 81ebff50 f1597ccc 0002019f srv!SrvIoCreateFile+0x35e
>>> > f1597cf4 f0b16293 824b2b50 e29e0438 0002019f srv!SrvNtCreateFile+0x562
>>> > f1597d78 f0b02854 81ebff58 82385380 f0b16c47
>>> > srv!SrvSmbNtCreateAndX+0xf8
>>> > f1597d84 f0b16c47 00000000 81a5cc58 00000000 srv!SrvProcessSmb+0xb5
>>> > f1597dac 805f1828 00385380 00000000 00000000 srv!WorkerThread+0x136
>>> > f1597ddc 8050058e f0b16b80 82385380 00000000
>>> nt!PspSystemThreadStartup+0x2e
>>> > 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>>> >
>>> >
>>> > FOLLOWUP_IP:
>>> > TmXPFlt+b8db
>>> > f21818db 83662800 and dword ptr [esi+0x28],0x0
>>> >
>>> > SYMBOL_STACK_INDEX: 1
>>> >
>>> > FOLLOWUP_NAME: MachineOwner
>>> >
>>> > SYMBOL_NAME: TmXPFlt+b8db
>>> >
>>> > MODULE_NAME: TmXPFlt
>>> >
>>> > IMAGE_NAME: TmXPFlt.sys
>>> >
>>> > DEBUG_FLR_IMAGE_TIMESTAMP: 40693f4e
>>> >
>>> > STACK_COMMAND: .cxr fffffffff15973f4 ; kb
>>> >
>>> > FAILURE_BUCKET_ID: 0x7E_TmXPFlt+b8db
>>> >
>>> > BUCKET_ID: 0x7E_TmXPFlt+b8db
>>> >
>>> > Followup: MachineOwner
>>> >
>>>
>>>
>>>
>
>
.
- References:
- server crashing/restarting consistently
- From: Eric
- Re: server crashing/restarting consistently
- From: Orville
- Re: server crashing/restarting consistently
- From: Eric
- Re: server crashing/restarting consistently
- From: Bill Swan
- server crashing/restarting consistently
- Prev by Date: Re: Exchange AND SP1 re-install
- Next by Date: Re: More RAID 1 questions
- Previous by thread: Re: server crashing/restarting consistently
- Next by thread: Re: server crashing/restarting consistently
- Index(es):
Relevant Pages
|
