Server Logs and Server Rebooting

Posted on 2006-03-23
Last Modified: 2010-05-19
I have a Windows 2003 Server used as my Terminal Server.  Over the last 3 months I have see eventlog error 6008 on 4 different occassions.
I have seen others post error log dumps here along with their questions to give info to users here in this Experts Exchange to help them determine what is going on.
1st Question:
How do I set my server..... If not already to do error dumps or logs like I see others doing?
Once I know if I already have the logs I want to know how to copy them and post them here in a question so someone can help me figure out why my server is rebooting on it's own.

2nd Question:
What is causing the server to reboot?
That question is a hard one for anyone here yet I suspect until I can get #1 answered and get some log data to post.
David S.
Question by:drshira
    LVL 23

    Expert Comment

    Is your server actually crashing?  If not, it won't dump a debug log (set in the system properties, advanced, startup and recovery)

    Is the server on SP1?

    What other applications are installed on the server, especially 3rd party apps?

    Do you see any event log entries before the 6008 entries that lead to anything?

    Author Comment

    Yes it is crashing.
    Yes it is updated to SP1
    Several 3rd party applications will list later.
    Yes on the 6008 msgs.  That is what concerned me sorry I did not say that in origianl ???
    I answered my 1st question myself.  I found the .dmp files down under C:\Windows\MimiDump.
    There were 3 .dmp files here 3 in March 3/20, 3/22 and today 3/23 all dates I show the 6008 event log entry for.
    NOW how do I open these .dmp files and get that info posted here like others so we can figure out what's going on?
    I tried notepad but it opened the file and it looked like gibberish.
    David S
    LVL 23

    Expert Comment


    Go there to get the debugging tools to open the dump file...

    See this KB article:;en-us;Q315263

    Author Comment

    Downloaded the debug tool and installed on my machine (Windows XP Pro) vs my Server if that makes a differance.
    I brought  the dump (.dmp) files down to my machine from Server and then tried to open them.
    Does not work?
    I tried to use command "Open Crash Dump" from menu.
    It pulled up the .dmp files I brought down to my computer from the server fine but when I tried to open it I get error msg:
    Does this program have to be installed on my Server?
    LVL 23

    Accepted Solution


    use the dumpchk command... (it should have been included in the debugging tools)

    Author Comment

    OK.  We have something but not sure what we have.  I opened on of the dump files using the dumpchk command from the above post.
    You get the points for this question just for staying with me till I got this file opened up so I could see whatever was in it.
    Now if this info tell you anything please let me know.
    David S
    ----- 32 bit Kernel Mini Dump Analysis

    MajorVersion        0000000f
    MinorVersion        00000ece
    DirectoryTableBase  efc51000
    PfnDataBase         81800000
    PsLoadedModuleList  808af988
    PsActiveProcessHead 808b5ba8
    MachineImageType    0000014c
    NumberProcessors    00000004
    BugCheckCode        100000d1
    BugCheckParameter1  f58af090
    BugCheckParameter2  00000002
    BugCheckParameter3  00000001
    BugCheckParameter4  f60fc180
    PaeEnabled          00000000
    KdDebuggerDataBlock 8089d3e0
    MiniDumpFields      00000dff

    ServicePackBuild      00000100
    SizeOfDump            00010000
    ValidOffset           0000fffc
    ContextOffset         00000320
    ExceptionOffset       000007d0
    MmOffset              00001068
    UnloadedDriversOffset 000010a0
    PrcbOffset            00001878
    ProcessOffset         00002738
    ThreadOffset          000029b0
    CallStackOffset       00002c00
    SizeOfCallStack       000005dc
    DriverListOffset      000034f8
    DriverCount           00000075
    StringPoolOffset      000057b8
    StringPoolSize        00001010
    BrokenDriverOffset    00000000
    TriageOptions         00000041
    TopOfStack            f3062a24
    DebuggerDataOffset    000031e0
    DebuggerDataSize      00000318
    DataBlocksOffset      000067c8
    DataBlocksCount       00000002

    Windows XP Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible

    Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
    Debug session time: Mon Mar 20 13:55:07 2006
    System Uptime: 0 days 16:30:37
    start    end        module name
    80800000 80a76000   nt             Checksum: 0025DF15  Timestamp: Wed May 04 23:
    02:28 2005 (42798CC4)

    Unloaded modules:
    f4b82000 f4bd8000   wlbs.sys    Timestamp: unavailable (00000000)
    f7647000 f7655000   imapi.sys    Timestamp: unavailable (00000000)
    f69ca000 f69d2000   Sfloppy.SYS    Timestamp: unavailable (00000000)

    Finished dump check

    C:\Program Files\Support Tools>
    LVL 23

    Expert Comment

    Well the code is:

    BugCheckCode        100000d1

    You can try searching that on google but you'll get lots of responses.

    Another thing you can do is turn off "Automatically Restart" under the system failure settings in system, advanced.

    Then you'd at least see the actually blue screen on the server when it happens.  Up to you on that one.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Free Trending Threat Insights Every Day

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Preface Having the need * to contact many different companies with different infrastructures * do remote maintenance in their network required us to implement a more flexible routing solution. As RAS, PPTP, L2TP and VPN Client connections are no…
    Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    12 Experts available now in Live!

    Get 1:1 Help Now