Hey,
I have a client with a SBS 2003 server which has started to Blue Screen. It was blue screening maybe once every 2 weeks now its starting to blue screen once a day.
Hardware Specs Pentium D 2.8 with 2GB of RAM and a Intel S3000-AH motherboard
at first I went through the event logs and went from there so I applied
http://support.microsoft.com/kb/928006http://support.microsoft.com/kb/937455These however did not rectify the problem
I then started analyzing mini-dumps which suspected the raid controller card was causing the issue which I upgraded to the latest.
Today however it blue screened once again.
Minidump output of !analyze -v
: kd> !analyze -v
**************************
**********
**********
**********
**********
**********
***
* *
* Bugcheck Analysis *
* *
**************************
**********
**********
**********
**********
**********
***
UNEXPECTED_KERNEL_MODE_TRA
P_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: f7727fe0
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDU
MP
CURRENT_IRQL: 7
LAST_CONTROL_TRANSFER: from 00000000 to f727cf0c
STACK_TEXT:
b894cff0 00000000 00000000 00000000 00000000 MegaIDE+0x6f0c
STACK_COMMAND: kb
FOLLOWUP_IP:
MegaIDE+6f0c
f727cf0c ?? ???
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: MegaIDE+6f0c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: MegaIDE
IMAGE_NAME: MegaIDE.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
44a53372
FAILURE_BUCKET_ID: 0x7f_8_MegaIDE+6f0c
BUCKET_ID: 0x7f_8_MegaIDE+6f0c
Followup: MachineOwner
---------
Complete Dump
1: kd> !analyze -v
**************************
**********
**********
**********
**********
**********
***
* *
* Bugcheck Analysis *
* *
**************************
**********
**********
**********
**********
**********
***
UNEXPECTED_KERNEL_MODE_TRA
P (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: f7727fe0
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
*** ERROR: Module load completed but symbols could not be loaded for MegaIDE.sys
*** ERROR: Module load completed but symbols could not be loaded for vsp.sys
*** ERROR: Module load completed but symbols could not be loaded for TmPreFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VSApiNt.sys
*** ERROR: Module load completed but symbols could not be loaded for TmXPFlt.sys
*** WARNING: Unable to verify checksum for ntrtscan.exe
*** ERROR: Module load completed but symbols could not be loaded for ntrtscan.exe
**************************
**********
**********
**********
**********
*******
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
**************************
**********
**********
**********
**********
*******
**************************
**********
**********
**********
**********
*******
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
**************************
**********
**********
**********
**********
*******
BUGCHECK_STR: 0x7f_8
TSS: 00000028 -- (.tss 0x28)
eax=00001000 ebx=8a1080e8 ecx=8a13f9e8 edx=8a140004 esi=8946f25c edi=8a155af8
eip=f727cf0c esp=b894cff4 ebp=b894d034 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
MegaIDE+0x6f0c:
f727cf0c c745c000000000 mov dword ptr [ebp-40h],0 ss:0010:b894cff4=????????
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: NTRtScan.exe
CURRENT_IRQL: 7
TRAP_FRAME: b894dd20 -- (.trap 0xffffffffb894dd20)
ErrCode = 00000000
eax=d480d400 ebx=0000000e ecx=0000000f edx=00000000 esi=88cefdb0 edi=00000000
eip=808b64a6 esp=b894dd94 ebp=b894ddd0 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
nt!CcMapData+0x8c:
808b64a6 8a10 mov dl,byte ptr [eax] ds:0023:d480d400=42
Resetting default scope
LAST_CONTROL_TRANSFER: from f727a42f to f727cf0c
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b894d034 f727a42f 8a140004 00000000 8a140000 MegaIDE+0x6f0c
b894d080 f727a264 8a140004 8a140000 00000000 MegaIDE+0x442f
b894d2f8 f7277ae6 8a140004 00000028 004c9927 MegaIDE+0x4264
b894d328 f7277508 8a140004 8946f25c 8946f25c MegaIDE+0x1ae6
b894d348 f72590be 8a140004 8946f25c 8a155af8 MegaIDE+0x1508
b894d36c 8088d631 8a155a40 00000002 8946f202 SCSIPORT!SpStartIoSynchron
ized+0x14f
b894d3a4 80a5b147 8a155a40 887cd008 885dfb58 nt!KeSynchronizeExecution+
0x21
b894d3d0 f72593a6 885dfb58 8a155a40 88a216e8 hal!HalBuildScatterGatherL
ist+0x1c7
b894d41c 8081cf82 8a155a40 885dfb58 8a155af8 SCSIPORT!ScsiPortStartIo+0
x36a
b894d440 f725962f 8a155a40 887cd008 00000000 nt!IoStartPacket+0x82
b894d474 f7259146 8a155a40 017cd09c 8946f25c SCSIPORT!ScsiPortFdoDispat
ch+0x270
b894d490 f7258dc3 8a1080e8 887cd008 88d0f858 SCSIPORT!SpDispatchRequest
+0x68
b894d4ac f7258299 8a108030 887cd008 8a1488f8 SCSIPORT!ScsiPortPdoScsi+0
x129
b894d4c0 8081df65 8a108030 887cd008 8946f1b0 SCSIPORT!ScsiPortGlobalDis
patch+0x1d
b894d4d4 f7245607 8946f1b0 ececd000 b894d518 nt!IofCallDriver+0x45
b894d4e4 f72452b2 8946f1b0 8a148b70 88d0f9a0 CLASSPNP!SubmitTransferPac
ket+0xbb
b894d518 f7245533 00000000 00001000 88d0f858 CLASSPNP!ServiceTransferRe
quest+0x1e
4
b894d53c 8081df65 8a148ab8 00000000 8a19a030 CLASSPNP!ClassReadWrite+0x
159
b894d550 f74c80cf 8a159e00 88d0f9c4 b894d574 nt!IofCallDriver+0x45
b894d560 8081df65 8a157bb8 88d0f858 88d0f9e8 PartMgr!PmReadWrite+0x95
b894d574 f7317053 88d0fa0c 8a177c10 88d0f858 nt!IofCallDriver+0x45
b894d590 8081df65 8a159d48 88d0f858 88d0fa0c ftdisk!FtDiskReadWrite+0x1
a9
b894d5a4 f72c08bc 8a1b4c80 88d0f858 8a105918 nt!IofCallDriver+0x45
b894d5bc 8081df65 8a105918 88d0f858 f74eb0b6 volsnap!VolSnapRead+0x52
b894d5d0 f74ea6ab 88d0f858 8a105610 88d0fa0c nt!IofCallDriver+0x45
b894d5ec f74ec322 8a105610 e0d0f858 8a105610 vsp+0x36ab
b894d658 f74ed01e 8a105610 88d0f858 88d0f858 vsp+0x5322
b894d690 8081df65 00105708 88d0f858 88d0f858 vsp+0x601e
b894d6a4 f7b50a92 b894d988 b894d888 f7b50909 nt!IofCallDriver+0x45
b894d6b0 f7b50909 b894d988 8a105610 a8da3000 Ntfs!NtfsSingleAsync+0x91
b894d888 f7b51186 b894d988 88d0f858 8a0d5530 Ntfs!NtfsNonCachedIo+0x2eb
b894d974 f7b510a9 b894d988 88d0f858 00000001 Ntfs!NtfsCommonRead+0xaf5
b894db20 8081df65 89cd2020 88d0f858 88d0f858 Ntfs!NtfsFsdRead+0x113
b894db34 f7223d28 89054c18 89d0a410 890555b0 nt!IofCallDriver+0x45
b894db60 8081df65 8992d860 88d0f858 898da7b0 fltmgr!FltpDispatch+0x152
b894db74 b9822bfe b894db90 8081df65 893c5670 nt!IofCallDriver+0x45
b894db7c 8081df65 893c5670 88d0f858 88d0f858 TmPreFlt+0x1bfe
b894db90 f7223d28 090cd000 89d0a410 00000000 nt!IofCallDriver+0x45
b894dbbc 8081df65 890555b0 88d0f858 88d0f858 fltmgr!FltpDispatch+0x152
b894dbd0 8081e4ed 88cefdb0 88a216b0 c06a4068 nt!IofCallDriver+0x45
b894dbe8 8085114a 89ff4a0b 88a216e8 88a216c8 nt!IoPageRead+0x109
b894dc84 8085ea66 00000001 d480d400 88a216b0 nt!MiDispatchFault+0xece
b894dd08 8088c798 00000000 d480d400 00000000 nt!MmAccessFault+0x89e
b894dd08 808b64a6 00000000 d480d400 00000000 nt!KiTrap0E+0xdc
b894ddd0 f7b90f4e 89ff4a28 b894de00 00000400 nt!CcMapData+0x8c
b894ddf0 f7b8e4b1 88a162d0 8a0d5530 090cd400 Ntfs!NtfsMapStream+0x4b
b894de64 f7b90e11 88a162d0 89cd2100 eb62c5c0 Ntfs!NtfsReadMftRecord+0x8
6
b894de9c f7b90fcd 88a162d0 89cd2100 eb62c5c0 Ntfs!NtfsReadFileRecord+0x
7a
b894ded4 f7b8289b 88a162d0 eb62c5b8 eb62c5c0 Ntfs!NtfsLookupInFileRecor
d+0x37
b894df84 f7b847ce 88a162d0 00000001 eb62c5b8 Ntfs!NtfsUpdateFcbInfoFrom
Disk+0x3e
b894e050 f7b820c7 88a162d0 887a9008 887a91e0 Ntfs!NtfsOpenFile+0x330
b894e274 f7b91f18 88a162d0 887a9008 b894e2b4 Ntfs!NtfsCommonCreate+0x12
80
b894e378 8081df65 89cd2020 887a9008 887a9008 Ntfs!NtfsFsdCreate+0x17d
b894e38c f723154d 00000000 887a9008 89d0a410 nt!IofCallDriver+0x45
b894e3bc 8081df65 8992d860 887a9008 887a91e0 fltmgr!FltpCreate+0x1d9
b894e3d0 b98289ba 881bd0a8 898da7b0 887a91e0 nt!IofCallDriver+0x45
b894e438 8081df65 893c5670 887a9008 887a9008 TmPreFlt+0x79ba
b894e44c f723154d 88f690b0 881bd0a8 89d0a410 nt!IofCallDriver+0x45
b894e47c 8081df65 890555b0 887a9008 887a9008 fltmgr!FltpCreate+0x1d9
b894e490 808f8f71 b894e638 8a159d30 00000000 nt!IofCallDriver+0x45
b894e578 80937942 8a159d48 00000000 8a005008 nt!IopParseDevice+0xa35
b894e5f8 80933a76 00000000 b894e638 00000040 nt!ObpLookupObjectName+0x5
b0
b894e64c 808eae25 00000000 00000000 00000000 nt!ObOpenObjectByName+0xea
b894e6c8 808ec0bf e1cd27c0 80100000 b894e890 nt!IopCreateFile+0x447
b894e724 808eeb4e e1cd27c0 80100000 b894e890 nt!IoCreateFile+0xa3
b894e764 8088978c e1cd27c0 80100000 b894e890 nt!NtCreateFile+0x30
b894e764 8082e901 e1cd27c0 80100000 b894e890 nt!KiFastCallEntry+0xfc
b894e808 b95b4e38 e1cd27c0 80100000 b894e890 nt!ZwCreateFile+0x11
b894e848 b95ce7db e1cd27c0 80100000 b894e890 VSApiNt+0xe0e38
b894e8ec b95cf4bc b894ec24 00000000 b894e920 VSApiNt+0xfa7db
b894e8fc b95c4859 b894ec24 00000000 00000002 VSApiNt+0xfb4bc
b894e920 b95c47ab b894ec24 00000002 00000000 VSApiNt+0xf0859
b894e94c b95398b0 b894ec24 00000002 00000000 VSApiNt+0xf07ab
b894e97c b9538bb0 b894ec24 b894f0f0 b894f0ee VSApiNt+0x658b0
b894f108 b9538cb0 e1cd8656 b894f124 00002e3a VSApiNt+0x64bb0
STACK_COMMAND: .tss 0x28 ; kb
FOLLOWUP_IP:
MegaIDE+6f0c
f727cf0c c745c000000000 mov dword ptr [ebp-40h],0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: MegaIDE+6f0c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: MegaIDE
IMAGE_NAME: MegaIDE.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
44a53372
FAILURE_BUCKET_ID: 0x7f_8_MegaIDE+6f0c
BUCKET_ID: 0x7f_8_MegaIDE+6f0c
Followup: MachineOwner
---------
The first time I ran a analyze on the comlete dump it said Probably caused by : ntkrpamp.exe
I am new to analyzing dumps so I need a bit of a hand...
I am going to run a memtest overnight as I am leaning towards hardware at the moment...
Or could it be that the new raid driver is causing the same problem ?
Thanks Heaps
Zong.
Start Free Trial
