[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

SBS2003-STD Crash Server when OS X client renames file or folder // RANDOM - VsrFsJnl.sys

Posted on 2006-04-30
6
Medium Priority
?
833 Views
Last Modified: 2010-05-18
Install of SBS2003 STD with Exchange 2003 enabled, and operating as file server on seperate raid array.
Dual Core AMD system, 4gb Ram... almost a terrabyte of free space on File server and 200Gb free on Exchange Array.
Gigabit Network, ExtremeZ-IP share (shared via Windows also). Used this product (for OS X) as uploads were slow to server even thought GP was set for SMB signing correctly...

Most Recent dump analysis follows. HELP KINDLY APPRECIATED!!


Loading Dump File [C:\Documents and Settings\spike\Desktop\Mini050106-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Kernel base = 0xe0800000 PsLoadedModuleList = 0xe08a6ea8
Debug session time: Mon May  1 12:04:37.734 2006 (GMT+10)
System Uptime: 1 days 21:49:33.890
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
.......................................................................................................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image Ntfs.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {19033c, be19f584, be19f280, e0882ad0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for fltMgr.sys
*** ERROR: Module load completed but symbols could not be loaded for fltMgr.sys
*** WARNING: Unable to verify timestamp for VsrFsFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VsrFsFlt.sys
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*** WARNING: Unable to verify timestamp for VsrFsJnl.sys
*** ERROR: Module load completed but symbols could not be loaded for VsrFsJnl.sys
Probably caused by : VsrFsJnl.sys ( VsrFsJnl+7fff )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0019033c
Arg2: be19f584
Arg3: be19f280
Arg4: e0882ad0

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

FAULTING_MODULE: e0800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4399d963

EXCEPTION_RECORD:  be19f584 -- (.exr ffffffffbe19f584)
ExceptionAddress: e0882ad0 (nt+0x00082ad0)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000000
Attempt to read from address 00000000

CONTEXT:  be19f280 -- (.cxr ffffffffbe19f280)
eax=0000007e ebx=00000000 ecx=fcb11998 edx=00000000 esi=fd545c48 edi=be19fa68
eip=e0882ad0 esp=be19f64c ebp=be19f64c iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
nt+0x82ad0:
e0882ad0 ??               ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from be19f754 to e0882ad0

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f648 be19f754 bfd25fff fcb11998 00000000 nt+0x82ad0
be19f64c bfd25fff fcb11998 00000000 be19fa68 0xbe19f754
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt+0x1de83
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs+0x7b6d
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs+0x3363a
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs+0x62fb
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt+0x1dce5
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr+0x4c53
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt+0x1dce5
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt+0x1dce5
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt+0xf0433
be19fd64 7c82ed54 badb0d00 00afb234 00000000 nt+0x88c6c
be19fd68 badb0d00 00afb234 00000000 00000000 0x7c82ed54
be19fd6c 00afb234 00000000 00000000 00000000 0xbadb0d00
be19fd70 00000000 00000000 00000000 00000000 0xafb234


FOLLOWUP_IP:
VsrFsJnl+7fff
bfd25fff ??               ???

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  2

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  VsrFsJnl+7fff

MODULE_NAME:  VsrFsJnl

IMAGE_NAME:  VsrFsJnl.sys

STACK_COMMAND:  .cxr 0xffffffffbe19f280 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> .sympath srv*c:\websymbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\websymbols*http://msdl.microsoft.com/download/symbols
0: kd> .reload
Loading Kernel Symbols
.......................................................................................................
Loading User Symbols
Loading unloaded module list
.....
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0019033c
Arg2: be19f584
Arg3: be19f280
Arg4: e0882ad0

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for VsrFsFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VsrFsFlt.sys

EXCEPTION_RECORD:  be19f584 -- (.exr ffffffffbe19f584)
ExceptionAddress: e0882ad0 (nt!wcscpy+0x0000000b)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000000
Attempt to read from address 00000000

CONTEXT:  be19f280 -- (.cxr ffffffffbe19f280)
eax=0000007e ebx=00000000 ecx=fcb11998 edx=00000000 esi=fd545c48 edi=be19fa68
eip=e0882ad0 esp=be19f64c ebp=be19f64c iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
nt!wcscpy+0xb:
e0882ad0 668b02           mov     ax,[edx]              ds:0023:00000000=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS:  00000000

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from bfd25fff to e0882ad0

STACK_TEXT:  
be19f64c bfd25fff fcb11998 00000000 be19fa68 nt!wcscpy+0xb
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt!IopfCompleteRequest+0xcd
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs!NtfsCompleteRequest+0xc8
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs!NtfsCommonSetInformation+0x4f6
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs!NtfsFsdSetInformation+0xa3
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt!IofCallDriver+0x45
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr!FltpDispatch+0x6f
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt!IofCallDriver+0x45
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt!IofCallDriver+0x45
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt!NtSetInformationFile+0x5ab
be19fd48 7c82ed54 00000e00 00afb288 00afb290 nt!KiFastCallEntry+0xfc
00010bfe 00000000 00000000 00000000 00000000 0x7c82ed54


FOLLOWUP_IP:
VsrFsJnl+7fff
bfd25fff ??               ???

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  VsrFsJnl+7fff

MODULE_NAME:  VsrFsJnl

IMAGE_NAME:  VsrFsJnl.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4399d963

STACK_COMMAND:  .cxr 0xffffffffbe19f280 ; kb

FAILURE_BUCKET_ID:  0x24_VsrFsJnl+7fff

BUCKET_ID:  0x24_VsrFsJnl+7fff

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0019033c
Arg2: be19f584
Arg3: be19f280
Arg4: e0882ad0

Debugging Details:
------------------


EXCEPTION_RECORD:  be19f584 -- (.exr ffffffffbe19f584)
ExceptionAddress: e0882ad0 (nt!wcscpy+0x0000000b)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000000
Attempt to read from address 00000000

CONTEXT:  be19f280 -- (.cxr ffffffffbe19f280)
eax=0000007e ebx=00000000 ecx=fcb11998 edx=00000000 esi=fd545c48 edi=be19fa68
eip=e0882ad0 esp=be19f64c ebp=be19f64c iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
nt!wcscpy+0xb:
e0882ad0 668b02           mov     ax,[edx]              ds:0023:00000000=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS:  00000000

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from bfd25fff to e0882ad0

STACK_TEXT:  
be19f64c bfd25fff fcb11998 00000000 be19fa68 nt!wcscpy+0xb
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt!IopfCompleteRequest+0xcd
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs!NtfsCompleteRequest+0xc8
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs!NtfsCommonSetInformation+0x4f6
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs!NtfsFsdSetInformation+0xa3
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt!IofCallDriver+0x45
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr!FltpDispatch+0x6f
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt!IofCallDriver+0x45
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt!IofCallDriver+0x45
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt!NtSetInformationFile+0x5ab
be19fd48 7c82ed54 00000e00 00afb288 00afb290 nt!KiFastCallEntry+0xfc
00010bfe 00000000 00000000 00000000 00000000 0x7c82ed54


FOLLOWUP_IP:
VsrFsJnl+7fff
bfd25fff ??               ???

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  VsrFsJnl+7fff

MODULE_NAME:  VsrFsJnl

IMAGE_NAME:  VsrFsJnl.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4399d963

STACK_COMMAND:  .cxr 0xffffffffbe19f280 ; kb

FAILURE_BUCKET_ID:  0x24_VsrFsJnl+7fff

BUCKET_ID:  0x24_VsrFsJnl+7fff

Followup: MachineOwner
---------

0: kd> lm tn
start    end        module name
be13b000 be168000   RDPWD    RDPWD.SYS    Thu Jun 16 01:33:14 2005 (42B04A3A)
be2c0000 be2cb000   TDTCP    TDTCP.SYS    Fri Mar 25 11:27:15 2005 (42435AE3)
bf130000 bf15a000   Fastfat  Fastfat.SYS  Fri Mar 25 11:40:20 2005 (42435DF4)
bf7ea000 bf83a000   HTTP     HTTP.sys     Fri Mar 25 11:40:36 2005 (42435E04)
bfb0a000 bfb68000   srv      srv.sys      Wed May 04 12:44:01 2005 (427836F1)
bfb90000 bfbc4000   mrxdav   mrxdav.sys   Fri Mar 25 11:30:11 2005 (42435B93)
bfcee000 bfd1de60   exifs    exifs.sys    Fri Aug 26 10:29:05 2005 (430E6251)
bfd1e000 bfd38000   VsrFsJnl VsrFsJnl.sys Sat Dec 10 06:22:11 2005 (4399D963)
de400000 de5d0000   win32k   win32k.sys   Thu Oct 06 10:37:08 2005 (434471B4)
de5d0000 de5e6000   dxg      dxg.sys      Fri Mar 25 11:27:25 2005 (42435AED)
de5e6000 de9a0500   nv4_disp nv4_disp.dll Wed Aug 03 10:11:57 2005 (42F00BCD)
e0800000 e0a53000   nt       ntkrpamp.exe Fri Mar 25 11:28:04 2005 (42435B14)
e0a53000 e0a7f000   hal      halaacpi.dll Fri Mar 25 11:28:37 2005 (42435B35)
f38b6000 f38cb000   Cdfs     Cdfs.SYS     Fri Mar 25 11:40:55 2005 (42435E17)
f3953000 f395e000   VsrFsRec VsrFsRec.sys Sat Dec 10 06:22:11 2005 (4399D963)
f3993000 f39a4000   Fips     Fips.SYS     Fri Mar 25 11:40:33 2005 (42435E01)
f39a4000 f3a1a000   mrxsmb   mrxsmb.sys   Fri Mar 25 11:41:13 2005 (42435E29)
f3a1a000 f3a4a000   rdbss    rdbss.sys    Fri Mar 25 11:40:49 2005 (42435E11)
f3a4a000 f3a74000   afd      afd.sys      Fri Mar 25 11:40:43 2005 (42435E0B)
f3a74000 f3aa5000   netbt    netbt.sys    Fri Mar 25 11:40:31 2005 (42435DFF)
f3aa5000 f3b06000   tcpip    tcpip.sys    Fri Jan 13 13:12:43 2006 (43C70C9B)
f3b06000 f3b1f000   ipsec    ipsec.sys    Fri Mar 25 11:40:49 2005 (42435E11)
f3b3f000 f3b4c000   Npfs     Npfs.SYS     Fri Mar 25 11:30:04 2005 (42435B8C)
f3b5f000 f3b6c000   wanarp   wanarp.sys   Fri Mar 25 11:34:07 2005 (42435C7F)
f3bcf000 f3bd9000   dump_diskdump dump_diskdump.sys Fri Mar 25 11:28:56 2005 (42435B48)
f417f000 f4193000   usbhub   usbhub.sys   Fri Mar 25 11:30:46 2005 (42435BB6)
f41d2000 f4212000   update   update.sys   Fri Mar 25 11:40:27 2005 (42435DFB)
f4212000 f4249000   rdpdr    rdpdr.sys    Fri Mar 25 11:30:20 2005 (42435B9C)
f4249000 f425c000   raspptp  raspptp.sys  Fri Mar 25 11:40:43 2005 (42435E0B)
f425c000 f4276000   ndiswan  ndiswan.sys  Fri Mar 25 11:40:46 2005 (42435E0E)
f4276000 f428b000   rasl2tp  rasl2tp.sys  Fri Mar 25 11:40:29 2005 (42435DFD)
f428b000 f42a6000   VIDEOPRT VIDEOPRT.SYS Fri Mar 25 11:29:53 2005 (42435B81)
f42a6000 f45b2e60   nv4_mini nv4_mini.sys Wed Aug 03 10:17:04 2005 (42F00D00)
f45b3000 f45e5d80   NVSNPU   NVSNPU.SYS   Wed Apr 06 20:22:01 2005 (4253B849)
f45e6000 f4625f00   NVNRM    NVNRM.SYS    Wed Apr 06 20:22:11 2005 (4253B853)
f4626000 f464e000   e1000325 e1000325.sys Thu Jun 30 03:49:03 2005 (42C2DF0F)
f464e000 f4676000   ks       ks.sys       Fri Mar 25 11:41:03 2005 (42435E1F)
f4676000 f468a000   redbook  redbook.sys  Fri Mar 25 11:28:46 2005 (42435B3E)
f468a000 f469f000   cdrom    cdrom.sys    Fri Mar 25 11:28:57 2005 (42435B49)
f469f000 f46c9000   USBPORT  USBPORT.SYS  Fri Mar 25 11:30:43 2005 (42435BB3)
f46e9000 f46f7000   VsrFsFlt VsrFsFlt.sys Sat Dec 10 06:22:11 2005 (4399D963)
f4759000 f4762000   ndisuio  ndisuio.sys  Fri Mar 25 11:33:16 2005 (42435C4C)
f4789000 f4793000   Dxapi    Dxapi.sys    Tue Mar 25 18:06:01 2003 (3E7FFFD9)
f4821000 f4824280   nvnetbus nvnetbus.sys Wed Apr 06 20:22:28 2005 (4253B864)
f4b29000 f4b34000   fdc      fdc.sys      Fri Mar 25 11:28:43 2005 (42435B3B)
f4b79000 f4b86000   netbios  netbios.sys  Fri Mar 25 11:33:21 2005 (42435C51)
f4b99000 f4ba8000   termdd   termdd.sys   Fri Mar 25 11:27:15 2005 (42435AE3)
f4ba9000 f4bb4000   ptilink  ptilink.sys  Fri Mar 25 11:28:25 2005 (42435B29)
f4bb9000 f4bc4000   Msfs     Msfs.SYS     Fri Mar 25 11:30:04 2005 (42435B8C)
f4d5b000 f4d7a000   Mup      Mup.sys      Fri Mar 25 11:40:49 2005 (42435E11)
f4d7a000 f4db0000   NDIS     NDIS.sys     Fri Mar 25 11:40:26 2005 (42435DFA)
f4db0000 f4e45000   Ntfs     Ntfs.sys     Fri Mar 25 11:40:29 2005 (42435DFD)
f4e45000 f4e6c000   KSecDD   KSecDD.sys   Fri Mar 25 11:28:53 2005 (42435B45)
f4e6c000 f4e91000   fltMgr   fltMgr.sys   Fri Mar 25 11:30:25 2005 (42435BA1)
f4e91000 f4ea4000   CLASSPNP CLASSPNP.SYS Fri Mar 25 11:40:23 2005 (42435DF7)
f4ea4000 f4ec3000   SCSIPORT SCSIPORT.SYS Fri Mar 25 11:40:26 2005 (42435DFA)
f4ec3000 f4edf000   atapi    atapi.sys    Fri Mar 25 11:28:49 2005 (42435B41)
f4edf000 f4f09000   volsnap  volsnap.sys  Fri Mar 25 11:29:10 2005 (42435B56)
f4f09000 f4f35000   dmio     dmio.sys     Fri Mar 25 11:30:02 2005 (42435B8A)
f4f35000 f4f5c000   ftdisk   ftdisk.sys   Fri Mar 25 11:29:00 2005 (42435B4C)
f4f5c000 f4f72000   pci      pci.sys      Fri Mar 25 11:34:14 2005 (42435C86)
f4f72000 f4fa6000   ACPI     ACPI.sys     Fri Mar 25 11:34:09 2005 (42435C81)
f50a7000 f50b0000   WMILIB   WMILIB.SYS   Tue Mar 25 18:13:00 2003 (3E80017C)
f50b7000 f50c6000   isapnp   isapnp.sys   Tue Mar 25 18:16:35 2003 (3E800253)
f50c7000 f50d4000   PCIIDEX  PCIIDEX.SYS  Fri Mar 25 11:28:48 2005 (42435B40)
f50d7000 f50e7000   MountMgr MountMgr.sys Fri Mar 25 11:27:23 2005 (42435AEB)
f50e7000 f50f2000   PartMgr  PartMgr.sys  Fri Mar 25 11:40:34 2005 (42435E02)
f50f7000 f5107000   disk     disk.sys     Fri Mar 25 11:28:58 2005 (42435B4A)
f5107000 f5113000   Dfs      Dfs.sys      Fri Mar 25 11:30:28 2005 (42435BA4)
f5117000 f5121000   crcdisk  crcdisk.sys  Fri Mar 25 11:29:40 2005 (42435B74)
f5157000 f5163000   vga      vga.sys      Fri Mar 25 11:29:54 2005 (42435B82)
f5197000 f51a1000   mouclass mouclass.sys Tue Mar 25 18:03:09 2003 (3E7FFF2D)
f51a7000 f51b2000   TDI      TDI.SYS      Fri Mar 25 11:35:34 2005 (42435CD6)
f51b7000 f51c0000   mssmbios mssmbios.sys Fri Mar 25 11:34:14 2005 (42435C86)
f51d7000 f51e0000   ndistapi ndistapi.sys Fri Mar 25 11:34:11 2005 (42435C83)
f51f7000 f5206000   raspppoe raspppoe.sys Fri Mar 25 11:34:16 2005 (42435C88)
f5207000 f5210000   raspti   raspti.sys   Fri Mar 25 11:34:16 2005 (42435C88)
f5217000 f5225000   msgpc    msgpc.sys    Fri Mar 25 11:33:31 2005 (42435C5B)
f5247000 f5251000   flpydisk flpydisk.sys Tue Mar 25 18:04:32 2003 (3E7FFF80)
f5267000 f5271000   kbdclass kbdclass.sys Tue Mar 25 18:03:10 2003 (3E7FFF2E)
f5287000 f5295000   processr processr.sys Fri Mar 25 11:28:39 2005 (42435B37)
f52b7000 f52c5000   NDProxy  NDProxy.SYS  Fri Mar 25 11:34:13 2005 (42435C85)
f5317000 f5320000   watchdog watchdog.sys Fri Mar 25 11:30:19 2005 (42435B9B)
f5327000 f532f000   kdcom    kdcom.dll    Tue Mar 25 18:08:00 2003 (3E800050)
f532f000 f5337000   BOOTVID  BOOTVID.dll  Tue Mar 25 18:07:58 2003 (3E80004E)
f5337000 f533e000   pciide   pciide.sys   Tue Mar 25 18:04:46 2003 (3E7FFF8E)
f533f000 f5346000   dmload   dmload.sys   Tue Mar 25 18:08:08 2003 (3E800058)
f5347000 f534f000   st8350   st8350.sys   Sat Jun 11 08:15:50 2005 (42AA1116)
f5357000 f535e000   dxgthk   dxgthk.sys   Tue Mar 25 18:05:52 2003 (3E7FFFD0)
f5387000 f538f000   Fs_Rec   Fs_Rec.SYS   Tue Mar 25 18:08:36 2003 (3E800074)
f538f000 f5397000   rasacd   rasacd.sys   Tue Mar 25 18:11:50 2003 (3E800136)
f53a7000 f53ab400   usbohci  usbohci.sys  Fri Mar 25 11:30:45 2005 (42435BB5)
f53af000 f53b5a00   usbehci  usbehci.sys  Fri Mar 25 11:30:43 2005 (42435BB3)
f53b7000 f53be000   Null     Null.SYS     Tue Mar 25 18:03:05 2003 (3E7FFF29)
f53bf000 f53c6000   Beep     Beep.SYS     Tue Mar 25 18:03:04 2003 (3E7FFF28)
f53df000 f53e7000   audstub  audstub.sys  Tue Mar 25 18:09:12 2003 (3E800098)
f5477000 f547f000   dump_st8350 dump_st8350.sys Sat Jun 11 08:15:50 2005 (42AA1116)
f549f000 f54a7000   mnmdd    mnmdd.SYS    Tue Mar 25 18:07:53 2003 (3E800049)
f54a7000 f54ad300   HIDPARSE HIDPARSE.SYS Fri Mar 25 11:30:36 2005 (42435BAC)
f54af000 f54b7000   RDPCDD   RDPCDD.sys   Tue Mar 25 18:03:05 2003 (3E7FFF29)
f55f3000 f55f4420   ASACPI   ASACPI.sys   Fri Aug 13 12:52:52 2004 (411C2D04)
f55f5000 f55f6280   swenum   swenum.sys   Fri Mar 25 11:27:42 2005 (42435AFE)
f5605000 f5606580   USBD     USBD.SYS     Tue Mar 25 18:10:39 2003 (3E8000EF)
f5619000 f561a160   AsIO     AsIO.sys     Thu Oct 14 19:52:27 2004 (416E4C5B)

Unloaded modules:
bfacd000 bfae2000   Serial.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f51c7000 f51d5000   imapi.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f46f9000 f4702000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3bcc000 f3bdf000   i8042prt.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f538f000 f5397000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
0: kd> !thread
GetPointerFromAddress: unable to read from e089c298
THREAD fd954830  Cid 0698.1ba0  Teb: bd5de000 Win32Thread: 00000000 RUNNING on processor 0
IRP List:
    Unable to read nt!_IRP @ fd545c48
Unable to read Impersonation Information at e34a5340
GetUlongFromAddress: unable to read from e08ab934
Owning Process            fe4cbd88       Image:         ExtremeZ-IP.exe
ffdf0000: Unable to get shared data
Wait Start TickCount      10558329    
Context Switch Count      71935            
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.0000
KernelTime                00:00:00.0000
Start Address 0x77e6b5bb
Win32 Start Address 0x004ef930
Stack Init be1a0000 Current be19f4a0 Base be1a0000 Limit be19d000 Call 0
Priority 14 BasePriority 13 PriorityDecrement 0
ChildEBP RetAddr  Args to Child              
be19f080 f4dbea1a 00000024 0019033c be19f584 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
be19f0a8 f4db158c fd8e58b8 be19f0d4 e0880ce1 Ntfs!NtfsExceptionFilter+0x168 (FPO: [Non-Fpo])
be19f0b4 e0880ce1 be19f0dc 00000000 be19f0dc Ntfs!NtfsFsdSetInformation+0xc1 (FPO: [SEH])
be19f0dc e088e1be be19f584 be19fbc4 be19f280 nt!_except_handler3+0x61 (FPO: [Uses EBP] [3,0,7])
be19f100 e088e190 be19f584 be19fbc4 be19f280 nt!ExecuteHandler2+0x26
be19f1b0 e082cd91 be19f584 be19f280 00000000 nt!ExecuteHandler+0x24
be19f568 e08896d2 be19f584 00000000 be19f5d8 nt!KiDispatchException+0x131 (FPO: [Non-Fpo])
be19f5d0 e0889686 be19f64c e0882ad0 badb0d00 nt!CommonDispatchException+0x4a (FPO: [0,20,0])
be19f680 e0893099 bfd343a8 00000004 00000000 nt!Kei386EoiHelper+0x186
be19f64c bfd25fff fcb11998 00000000 be19fa68 nt!ExAllocatePoolWithTag+0x521 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt!IopfCompleteRequest+0xcd (FPO: [Non-Fpo])
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs!NtfsCompleteRequest+0xc8 (FPO: [Non-Fpo])
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs!NtfsCommonSetInformation+0x4f6 (FPO: [Non-Fpo])
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs!NtfsFsdSetInformation+0xa3 (FPO: [Non-Fpo])
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr!FltpDispatch+0x6f (FPO: [Non-Fpo])
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt!NtSetInformationFile+0x5ab (FPO: [Non-Fpo])
be19fd48 7c82ed54 00000e00 00afb288 00afb290 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ be19fd64)
00010bfe 00000000 00000000 00000000 00000000 0x7c82ed54

0
Comment
Question by:yespit
  • 2
  • 2
4 Comments
 
LVL 20

Expert Comment

by:cpc2004
ID: 16575031
Probably caused by : VsrFsJnl.sys ( VsrFsJnl+7fff )

Probably it is the software error at VsrFsJnl.sys. I search google and I cannot find any hit relating to this module. Another possibility is faulty ram. One minidump is insufficent to determine the root cause of blue scree.
,
Zip 5 to 6 minidumps to a zip file and attach it at any webspace. I will study the dump and find out the culprit.  Run memtest to stress test the ram. Make sure that your windows is not infected with spyware, adware adn chkdsk /r.

http://www.memtest86.com/.

Get public webspace
Use a free service like rapidshare to attach the minidumps and post the url of the mimidumps at this thread.
http://www.rapidshare.de/
0
 

Author Comment

by:yespit
ID: 16576165
Thanks for the Quick reply. Its definately not hardware as the backup server is running identical hardware and i swapped to it and same result.
I have posted 5 minidumps here: http://www.ground-under.com.au/Desktop.rar 
0
 
LVL 20

Accepted Solution

by:
cpc2004 earned 2000 total points
ID: 16577182
All the minidumps are crashed at VsrFsJnl.sys (Veritas Replication Program) and the running process is  ExtremeZ-IP.exe.
Obviously it is the software at Veritas Replication Program. Report the problem to Vertias or visit Veritas WebSite to look for the solution.

Mini042706-01.dmp BugCheck 24, {19033c, bf0e3584, bf0e3280, e0882ad0}
Owning Process            fe49b848       Image:         ExtremeZ-IP.exe
Probably caused by : VsrFsJnl.sys ( VsrFsJnl+7fff )
0
 

Author Comment

by:yespit
ID: 16591717
VsrFsJnl.sys is  the Symantec File System Journal Writer for the Continuous Protection Server (CPS) component.

From cpc2004 help i have ascertained that this crash situation only occurs whilst the hourly snapshot of the server is in progress or while the nightly offsite backup over the WAN (that often runs into the next morning) is in progress. If there is no snapshot occuring by the CPS the server doesnot crash.
As i have temporarily disable the CPS the issue is resolved, but as this cant be the solution i am now on the veritas forums trying to resolve the actual problem. Will post it for everyones further help.

Thanks cpc2004, your help enabled me to pinpoint the problem. I dont know if i should accept this answer? (can a mod be involved?) The solution will hopefully be forthcoming!
0

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A quick step-by-step overview of installing and configuring Carbonite Server Backup.
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Screencast - Getting to Know the Pipeline
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question