[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 265
  • Last Modified:

Server Logs and Server Rebooting

I have a Windows 2003 Server used as my Terminal Server.  Over the last 3 months I have see eventlog error 6008 on 4 different occassions.
I have seen others post error log dumps here along with their questions to give info to users here in this Experts Exchange to help them determine what is going on.
1st Question:
How do I set my server..... If not already to do error dumps or logs like I see others doing?
Once I know if I already have the logs I want to know how to copy them and post them here in a question so someone can help me figure out why my server is rebooting on it's own.

2nd Question:
What is causing the server to reboot?
That question is a hard one for anyone here yet I suspect until I can get #1 answered and get some log data to post.
David S.
0
drshira
Asked:
drshira
  • 4
  • 3
1 Solution
 
TheCleanerCommented:
Is your server actually crashing?  If not, it won't dump a debug log (set in the system properties, advanced, startup and recovery)

Is the server on SP1?

What other applications are installed on the server, especially 3rd party apps?

Do you see any event log entries before the 6008 entries that lead to anything?
0
 
drshiraAuthor Commented:
Yes it is crashing.
Yes it is updated to SP1
Several 3rd party applications will list later.
Yes on the 6008 msgs.  That is what concerned me sorry I did not say that in origianl ???
I answered my 1st question myself.  I found the .dmp files down under C:\Windows\MimiDump.
There were 3 .dmp files here 3 in March 3/20, 3/22 and today 3/23 all dates I show the 6008 event log entry for.
NOW how do I open these .dmp files and get that info posted here like others so we can figure out what's going on?
I tried notepad but it opened the file and it looked like gibberish.
David S
0
 
TheCleanerCommented:
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Go there to get the debugging tools to open the dump file...

See this KB article:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q315263
0
Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

 
drshiraAuthor Commented:
OK.  
Downloaded the debug tool and installed on my machine (Windows XP Pro) vs my Server if that makes a differance.
I brought  the dump (.dmp) files down to my machine from Server and then tried to open them.
Does not work?
I tried to use command "Open Crash Dump" from menu.
It pulled up the .dmp files I brought down to my computer from the server fine but when I tried to open it I get error msg:
Does this program have to be installed on my Server?
0
 
TheCleanerCommented:
http://support.microsoft.com/kb/315271/

use the dumpchk command... (it should have been included in the debugging tools)
0
 
drshiraAuthor Commented:
OK.  We have something but not sure what we have.  I opened on of the dump files using the dumpchk command from the above post.
You get the points for this question just for staying with me till I got this file opened up so I could see whatever was in it.
Now if this info tell you anything please let me know.
David S
----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion        0000000f
MinorVersion        00000ece
DirectoryTableBase  efc51000
PfnDataBase         81800000
PsLoadedModuleList  808af988
PsActiveProcessHead 808b5ba8
MachineImageType    0000014c
NumberProcessors    00000004
BugCheckCode        100000d1
BugCheckParameter1  f58af090
BugCheckParameter2  00000002
BugCheckParameter3  00000001
BugCheckParameter4  f60fc180
PaeEnabled          00000000
KdDebuggerDataBlock 8089d3e0
MiniDumpFields      00000dff

TRIAGE_DUMP32:
ServicePackBuild      00000100
SizeOfDump            00010000
ValidOffset           0000fffc
ContextOffset         00000320
ExceptionOffset       000007d0
MmOffset              00001068
UnloadedDriversOffset 000010a0
PrcbOffset            00001878
ProcessOffset         00002738
ThreadOffset          000029b0
CallStackOffset       00002c00
SizeOfCallStack       000005dc
DriverListOffset      000034f8
DriverCount           00000075
StringPoolOffset      000057b8
StringPoolSize        00001010
BrokenDriverOffset    00000000
TriageOptions         00000041
TopOfStack            f3062a24
DebuggerDataOffset    000031e0
DebuggerDataSize      00000318
DataBlocksOffset      000067c8
DataBlocksCount       00000002


Windows XP Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible

Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
Debug session time: Mon Mar 20 13:55:07 2006
System Uptime: 0 days 16:30:37
start    end        module name
80800000 80a76000   nt             Checksum: 0025DF15  Timestamp: Wed May 04 23:
02:28 2005 (42798CC4)

Unloaded modules:
f4b82000 f4bd8000   wlbs.sys    Timestamp: unavailable (00000000)
f7647000 f7655000   imapi.sys    Timestamp: unavailable (00000000)
f69ca000 f69d2000   Sfloppy.SYS    Timestamp: unavailable (00000000)

Finished dump check

C:\Program Files\Support Tools>
0
 
TheCleanerCommented:
Well the code is:

BugCheckCode        100000d1


You can try searching that on google but you'll get lots of responses.

Another thing you can do is turn off "Automatically Restart" under the system failure settings in system, advanced.

Then you'd at least see the actually blue screen on the server when it happens.  Up to you on that one.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now