Windows 2003 Server randomly crashing and restarting.

  • Thread starter Thread starter Sezgin
  • Start date Start date
S

Sezgin

Hi everyone,

One of our brand new HP Proliant ML350 servers is crashing and restarting
randomly. Memory Dump analysis output is below. Any help will be greatly
appreciated.

Regards,

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Symbols\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: D:\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free
x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_rtm.070216-1710
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Fri May 2 02:37:16.578 2008 (GMT+3)
System Uptime: 7 days 0:04:54.644
Loading Kernel Symbols
.................................................................................................................
Loading User Symbols

Loading unloaded module list
.....
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {19033d, f78daa38, f78da734, 8089c9d3}





Probably caused by : Pool_Corruption ( nt!ExFreePool+f )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 0019033d
Arg2: f78daa38
Arg3: f78da734
Arg4: 8089c9d3

Debugging Details:
------------------






EXCEPTION_RECORD: f78daa38 -- (.exr 0xfffffffff78daa38)
ExceptionAddress: 8089c9d3 (nt!ExFreePoolWithTag+0x000006a1)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000000
Attempt to write to address 00000000

CONTEXT: f78da734 -- (.cxr 0xfffffffff78da734)
eax=eb4b2178 ebx=00000000 ecx=000001ff edx=00000000 esi=eb4b21c0 edi=89fb9090
eip=8089c9d3 esp=f78dab00 ebp=f78dab4c iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!ExFreePoolWithTag+0x6a1:
8089c9d3 8913 mov dword ptr [ebx],edx
ds:0023:00000000=????????
Resetting default scope

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced
memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: 00000000

BUGCHECK_STR: 0x24

DEFAULT_BUCKET_ID: NULL_DEREFERENCE

LAST_CONTROL_TRANSFER: from 8089c26e to 8089c9d3

STACK_TEXT:
f78dab4c 8089c26e 89fbb150 00000000 f78dab68 nt!ExFreePoolWithTag+0x6a1
f78dab5c f71eb9e8 eb4b21c8 f78dab90 f721ccfd nt!ExFreePool+0xf
f78dab68 f721ccfd f72050a0 eb4b21c8 f16d19c0
Ntfs!ExFreeToNPagedLookasideList+0x1e
f78dab90 f71e5212 86609bb8 f78dabbc f78dabc6 Ntfs!NtfsDeleteFcb+0x205
f78dabe0 f721a1f9 86609bb8 89535100 eb4b21c8 Ntfs!NtfsTeardownFromLcb+0x1e2
f78dac38 f71e7137 86609bb8 eb4b2290 eb4b2418 Ntfs!NtfsTeardownStructures+0x12c
f78dac64 f72270a9 86609bb8 eb4b2290 eb4b2418
Ntfs!NtfsDecrementCloseCounts+0xa9
f78dacec f72211d8 86609bb8 eb4b2290 eb4b21c8 Ntfs!NtfsCommonClose+0x3a1
f78dad80 8082db08 00000000 00000000 89ecd3f0 Ntfs!NtfsFspClose+0xe2
f78dadac 80920833 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78daddc 8083fe9f 8082da4b 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
nt!ExFreePool+f
8089c26e 5d pop ebp

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExFreePool+f

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

STACK_COMMAND: .cxr 0xfffffffff78da734 kb

FAILURE_BUCKET_ID: 0x24_VRF_nt!ExFreePool+f

BUCKET_ID: 0x24_VRF_nt!ExFreePool+f

Followup: Pool_corruption
---------

1: kd> .exr 0xfffffffff78daa38
ExceptionAddress: 8089c9d3 (nt!ExFreePoolWithTag+0x000006a1)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000000
Attempt to write to address 00000000
 
What does eventvwr have to say on the issue? I'm guessing this is either a
memory or disk error. Try booting the server off a memtest86+ cd, or use your
smartstart CD to test the server.

HTH

"Sezgin" wrote:

> Hi everyone,
>
> One of our brand new HP Proliant ML350 servers is crashing and restarting
> randomly. Memory Dump analysis output is below. Any help will be greatly
> appreciated.
>
> Regards,
>
> Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [D:\Symbols\MEMORY.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> Symbol search path is: D:\Symbols
> Executable search path is:
> Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free
> x86 compatible
> Product: Server, suite: TerminalServer SingleUserTS
> Built by: 3790.srv03_sp2_rtm.070216-1710
> Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
> Debug session time: Fri May 2 02:37:16.578 2008 (GMT+3)
> System Uptime: 7 days 0:04:54.644
> Loading Kernel Symbols
> ................................................................................................................
> Loading User Symbols
>
> Loading unloaded module list
> ....
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 24, {19033d, f78daa38, f78da734, 8089c9d3}
>
>
>
>
>
> Probably caused by : Pool_Corruption ( nt!ExFreePool+f )
>
> Followup: Pool_corruption
> ---------
>
> 1: kd> !analyze -v
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> NTFS_FILE_SYSTEM (24)
> If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
> parameters are the exception record and context record. Do a .cxr
> on the 3rd parameter and then kb to obtain a more informative stack
> trace.
> Arguments:
> Arg1: 0019033d
> Arg2: f78daa38
> Arg3: f78da734
> Arg4: 8089c9d3
>
> Debugging Details:
> ------------------
>
>
>
>
>
>
> EXCEPTION_RECORD: f78daa38 -- (.exr 0xfffffffff78daa38)
> ExceptionAddress: 8089c9d3 (nt!ExFreePoolWithTag+0x000006a1)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 00000001
> Parameter[1]: 00000000
> Attempt to write to address 00000000
>
> CONTEXT: f78da734 -- (.cxr 0xfffffffff78da734)
> eax=eb4b2178 ebx=00000000 ecx=000001ff edx=00000000 esi=eb4b21c0 edi=89fb9090
> eip=8089c9d3 esp=f78dab00 ebp=f78dab4c iopl=0 nv up ei ng nz ac pe cy
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
> nt!ExFreePoolWithTag+0x6a1:
> 8089c9d3 8913 mov dword ptr [ebx],edx
> ds:0023:00000000=????????
> Resetting default scope
>
> PROCESS_NAME: System
>
> CURRENT_IRQL: 0
>
> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced
> memory at "0x%08lx". The memory could not be "%s".
>
> WRITE_ADDRESS: 00000000
>
> BUGCHECK_STR: 0x24
>
> DEFAULT_BUCKET_ID: NULL_DEREFERENCE
>
> LAST_CONTROL_TRANSFER: from 8089c26e to 8089c9d3
>
> STACK_TEXT:
> f78dab4c 8089c26e 89fbb150 00000000 f78dab68 nt!ExFreePoolWithTag+0x6a1
> f78dab5c f71eb9e8 eb4b21c8 f78dab90 f721ccfd nt!ExFreePool+0xf
> f78dab68 f721ccfd f72050a0 eb4b21c8 f16d19c0
> Ntfs!ExFreeToNPagedLookasideList+0x1e
> f78dab90 f71e5212 86609bb8 f78dabbc f78dabc6 Ntfs!NtfsDeleteFcb+0x205
> f78dabe0 f721a1f9 86609bb8 89535100 eb4b21c8 Ntfs!NtfsTeardownFromLcb+0x1e2
> f78dac38 f71e7137 86609bb8 eb4b2290 eb4b2418 Ntfs!NtfsTeardownStructures+0x12c
> f78dac64 f72270a9 86609bb8 eb4b2290 eb4b2418
> Ntfs!NtfsDecrementCloseCounts+0xa9
> f78dacec f72211d8 86609bb8 eb4b2290 eb4b21c8 Ntfs!NtfsCommonClose+0x3a1
> f78dad80 8082db08 00000000 00000000 89ecd3f0 Ntfs!NtfsFspClose+0xe2
> f78dadac 80920833 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
> f78daddc 8083fe9f 8082da4b 00000000 00000000 nt!PspSystemThreadStartup+0x2e
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> FOLLOWUP_IP:
> nt!ExFreePool+f
> 8089c26e 5d pop ebp
>
> SYMBOL_STACK_INDEX: 1
>
> SYMBOL_NAME: nt!ExFreePool+f
>
> FOLLOWUP_NAME: Pool_corruption
>
> IMAGE_NAME: Pool_Corruption
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 0
>
> MODULE_NAME: Pool_Corruption
>
> STACK_COMMAND: .cxr 0xfffffffff78da734 kb
>
> FAILURE_BUCKET_ID: 0x24_VRF_nt!ExFreePool+f
>
> BUCKET_ID: 0x24_VRF_nt!ExFreePool+f
>
> Followup: Pool_corruption
> ---------
>
> 1: kd> .exr 0xfffffffff78daa38
> ExceptionAddress: 8089c9d3 (nt!ExFreePoolWithTag+0x000006a1)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 00000001
> Parameter[1]: 00000000
> Attempt to write to address 00000000
>
 
Back
Top