Hi,
I have got a BSOD on a windows 2003 server running Symantec Backup Exec, SAV client, SQL 2005. The windbg tools output is as below:
Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*c:\localsymbols*
http://msdl.microsoft.com/download/symbolsExecutable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-
2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Fri Dec 21 09:34:51.218 2007 (GMT-5)
System Uptime: 48 days 23:04:34.687
WARNING: Process directory table base BFF9C520 doesn't match CR3 0057C000
WARNING: Process directory table base BFF9C520 doesn't match CR3 0057C000
Loading Kernel Symbols
..........................
..........
..........
..........
..........
..........
..........
..........
..........
..........
...
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details
Loading unloaded module list
..........................
......
**************************
**********
**********
**********
**********
**********
***
* *
* Bugcheck Analysis *
* *
**************************
**********
**********
**********
**********
**********
***
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {8, f7747fe0, 0, 0}
Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+5c )
Followup: MachineOwner
---------
5: kd> !analyze -v
**************************
**********
**********
**********
**********
**********
***
* *
* Bugcheck Analysis *
* *
**************************
**********
**********
**********
**********
**********
***
UNEXPECTED_KERNEL_MODE_TRA
P (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: f7747fe0
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
TSS: 00000028 -- (.tss 0x28)
eax=b7fc0023 ebx=b7fc70e0 ecx=a3206db0 edx=a35c9928 esi=b7fc705c edi=808813d8
eip=8088c718 esp=b7fc6fd8 ebp=b7fc6fd8 iopl=0 nv up di pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010046
nt!KiTrap0E+0x5c:
8088c718 89550c mov dword ptr [ebp+0Ch],edx ss:0010:b7fc6fe4=????????
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 1
LAST_CONTROL_TRANSFER: from 00000000 to 8088c718
STACK_TEXT:
b7fc6fd8 00000000 00000000 00000000 00000000 nt!KiTrap0E+0x5c
STACK_COMMAND: .tss 0x28 ; kb
FOLLOWUP_IP:
nt!KiTrap0E+5c
8088c718 89550c mov dword ptr [ebp+0Ch],edx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KiTrap0E+5c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:
45ec0a19
FAILURE_BUCKET_ID: 0x7f_8_nt!KiTrap0E+5c
BUCKET_ID: 0x7f_8_nt!KiTrap0E+5c
Followup: MachineOwner
---------
I need help to understand what is causing the crash ? Thank you
