Windows 2003 Server Keeps rebooting with The computer has rebooted from a bugch

  • Thread starter Thread starter Schuml
  • Start date Start date
S

Schuml

In the Event log I see this error The computer has rebooted from a bugcheck.
The bugcheck was: 0x000000c2 (0x00000007, 0x0000121a, 0xf56d3867,
0xc0000120). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

Attached is a debug from the memory.dmp file everything is pointing to the
fact that the ntkrpamp.exe is the problem and I have read that it may be
faulty memory or there may be a hot fix for dropped packets none the less the
server reboots and will run fine for 4 or 5 days then it will re-boot with
the same error. I would like to find out what is causing the error so that I
can get it fixed. This is a 2003 R2 Enterprise sp2 server fully patched and
running SQL 2005

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\i386
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free
x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed Oct 15 03:16:24.082 2008 (GMT-4)
System Uptime: 6 days 17:02:16.265
Loading Kernel Symbols
.............................................................................................................
Loading User Symbols

Loading unloaded module list
..............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 121a, f56d3867, c0000120}

*** ERROR: Module load completed but symbols could not be loaded for
MfeAVFK.sys
*** ERROR: Module load completed but symbols could not be loaded for
MfeBOPK.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
mfehidk.sys -
*** ERROR: Module load completed but symbols could not be loaded for
cpqteam.sys
*** ERROR: Module load completed but symbols could not be loaded for
q57xp32.sys
*** ERROR: Module load completed but symbols could not be loaded for
cpqasm2.sys
*** ERROR: Module load completed but symbols could not be loaded for
vstor2.sys
*** WARNING: Unable to verify timestamp for ati2drad.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
mfetdik.sys -
*** ERROR: Module load completed but symbols could not be loaded for
CPQCISSE.sys
*** ERROR: Module load completed but symbols could not be loaded for
cpqcissm.sys
*** ERROR: Module load completed but symbols could not be loaded for
dump_cpqcissm.sys
*** ERROR: Module load completed but symbols could not be loaded for
sysmgmt.sys
*** ERROR: Module load completed but symbols could not be loaded for
cpqcidrv.sys
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+477 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad
IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 0000121a, (reserved)
Arg3: f56d3867, Memory contents of the pool block
Arg4: c0000120, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS: c0000120

BUGCHECK_STR: 0xc2_7

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 808927bb to 80827c63

STACK_TEXT:
f78cead4 808927bb 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b
f78ceb3c 8087c543 c0000120 00000000 f78cebbc nt!ExFreePoolWithTag+0x477
f78ceb5c f7b4e18a 891d9998 f78cebbc f78ceb90 nt!ExDeleteResourceLite+0x5d
f78ceb6c f7b84c27 891d9998 e1427390 e1187c60 Ntfs!NtfsFreeEresource+0x6b
f78ceb90 f7b4d212 88fde500 f78cebbc f78cebc6 Ntfs!NtfsDeleteFcb+0x4e
f78cebe0 f7b821f9 88fde500 8aef47f8 e1187c60 Ntfs!NtfsTeardownFromLcb+0x1e2
f78cec38 f7b4f137 88fde500 e1187d28 00000000 Ntfs!NtfsTeardownStructures+0x12c
f78cec64 f7b8f0a9 88fde500 e1187d28 00000000
Ntfs!NtfsDecrementCloseCounts+0xa9
f78cecec f7b891d8 88fde500 e1187d28 e1187c60 Ntfs!NtfsCommonClose+0x3a1
f78ced80 8088043d 00000000 00000000 8af7b628 Ntfs!NtfsFspClose+0xe2
f78cedac 80949b7c 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78ceddc 8088e062 80880352 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+477
808927bb ff75fc push dword ptr [ebp-4]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExFreePoolWithTag+477

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

FAILURE_BUCKET_ID: 0xc2_7_nt!ExFreePoolWithTag+477

BUCKET_ID: 0xc2_7_nt!ExFreePoolWithTag+477

Followup: MachineOwner
---------
 
>In the Event log I see this error The computer has rebooted from a bugcheck.
>The bugcheck was: 0x000000c2 (0x00000007, 0x0000121a, 0xf56d3867,
>0xc0000120). A dump was saved in: C:\WINDOWS\MEMORY.DMP.
>
>Attached is a debug from the memory.dmp file everything is pointing to the
>fact that the ntkrpamp.exe is the problem and I have read that it may be
>faulty memory or there may be a hot fix for dropped packets none the less the
>server reboots and will run fine for 4 or 5 days then it will re-boot with
>the same error. I would like to find out what is causing the error so that I
>can get it fixed. This is a 2003 R2 Enterprise sp2 server fully patched and
>running SQL 2005
>
>Loading Dump File [C:\WINDOWS\MEMORY.DMP]
>Kernel Summary Dump File: Only kernel address space is available
>
>Symbol search path is:
>srv*c:\symbols*http://msdl.microsoft.com/download/symbols
>Executable search path is: c:\windows\i386
>Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free
>x86 compatible
>Product: Server, suite: Enterprise TerminalServer SingleUserTS
>Built by: 3790.srv03_sp2_gdr.070304-2240
>Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
>Debug session time: Wed Oct 15 03:16:24.082 2008 (GMT-4)
>System Uptime: 6 days 17:02:16.265
>Loading Kernel Symbols
>............................................................................................................
>Loading User Symbols
>
>Loading unloaded module list
>.............
>*******************************************************************************
>*
> *
>* Bugcheck Analysis
> *
>*
> *
>*******************************************************************************
>
>Use !analyze -v to get detailed debugging information.
>
>BugCheck C2, {7, 121a, f56d3867, c0000120}
>
>*** ERROR: Module load completed but symbols could not be loaded for
>MfeAVFK.sys
>*** ERROR: Module load completed but symbols could not be loaded for
>MfeBOPK.sys
>*** ERROR: Symbol file could not be found. Defaulted to export symbols for
>mfehidk.sys -
>*** ERROR: Module load completed but symbols could not be loaded for
>cpqteam.sys
>*** ERROR: Module load completed but symbols could not be loaded for
>q57xp32.sys
>*** ERROR: Module load completed but symbols could not be loaded for
>cpqasm2.sys
>*** ERROR: Module load completed but symbols could not be loaded for
>vstor2.sys
>*** WARNING: Unable to verify timestamp for ati2drad.dll
>*** ERROR: Symbol file could not be found. Defaulted to export symbols for
>mfetdik.sys -
>*** ERROR: Module load completed but symbols could not be loaded for
>CPQCISSE.sys
>*** ERROR: Module load completed but symbols could not be loaded for
>cpqcissm.sys
>*** ERROR: Module load completed but symbols could not be loaded for
>dump_cpqcissm.sys
>*** ERROR: Module load completed but symbols could not be loaded for
>sysmgmt.sys
>*** ERROR: Module load completed but symbols could not be loaded for
>cpqcidrv.sys
>Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+477 )

This is an HP / Compaq? Are the drivers being mentioned in the above
debug current and up to date?

- Thee Chicago Wolf
 
Re: Server Keeps rebooting with The computer has rebooted from a b

"Thee Chicago Wolf" wrote:
> - Thee Chicago Wolf
>This is an HP server and that was my first thought as well I checked the Hp management tools and everything shows that it is up to date.
 
Back
Top