Solved

2 different blue screens on windows 2003 server in 1 week

Posted on 2006-07-03
8
362 Views
Last Modified: 2008-01-09
Hi all,

A customer of ours has a windows 2003 SP1 server, which has suffered 2 blue screens in one week.

On 23/6 the code was 0x0000004e (0x0000009a, 0x00003b08, 0x00000006, 0x00000002)

Today the code was 0x000000ab (0x00000003, 0x000018d0, 0x00000000, 0x00000046)


Especially about the last one there are some clear answers in MS knowledgebase (http://support.microsoft.com/?kbid=901150 and
 
http://support.microsoft.com/?kbid=907242) , but i find it rather strange the 1st blue screen from 1 week ago is completely different.

Hopefully someone can help me out.

Logs of both blue screens can be found at http://rapidshare.de/files/24825687/Mini062306-01.dmp.html and

http://rapidshare.de/files/24825722/Mini070306-01.dmp.html

Many thanks in advance!
0
Comment
Question by:global-e
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 29

Expert Comment

by:mass2612
ID: 17034240
Hi,

I can't access Rapid Share sites from work. Has anything been changed on the system recently?

You can use the Windows Debugging Tools to analyse the memory.dmp file that should be in your C:\windows or c:\winnt folder. Copy this to a workstation and install the debugging tools and then use Windbg to analyse the dump file to try to help figure it out.

http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

You'll need to add the following setting to the symbol file path within the Windbg tool
SRV*c:\temp*http://msdl.microsoft.com/download/symbols

http://support.microsoft.com/?kbid=311503
0
 
LVL 1

Author Comment

by:global-e
ID: 17036836
Hi,

Thanks for your explanation.
I ran windbg with the correct symbol file path with the bug check of yesterday; results :


"*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck AB, {3, 18d0, 0, 46}

Probably caused by : memory_corruption ( nt!MiCheckSessionPoolAllocations+e3 )

Followup: MachineOwner
---------

1: kd> .reload
Loading Kernel Symbols
.......................................................................................................................
Loading User Symbols
Loading unloaded module list
....
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 00000003, session ID
Arg2: 000018d0, number of paged pool bytes that are leaking
Arg3: 00000000, number of nonpaged pool bytes that are leaking
Arg4: 00000046, total number of paged and nonpaged allocations that are leaking.
      nonpaged allocations are in the upper half of this word,
      paged allocations are in the lower half of this word.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xAB

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from e095df98 to e087b6be

STACK_TEXT:  
ebccfc30 e095df98 000000ab 00000003 000018d0 nt!KeBugCheckEx+0x1b
ebccfc68 e09c4c28 f9a52d88 f9a52d88 00000000 nt!MiCheckSessionPoolAllocations+0xe3
ebccfce8 e082117f f9a52d88 00000000 f96f7cf8 nt!MiDereferenceSessionFinal+0x183
ebccfd04 e0912d6f f9a52d88 f96f7cf8 f96f7f38 nt!MmCleanProcessAddressSpace+0x6b
ebccfd8c e092d96b 00000000 00000000 f96f7cf8 nt!PspExitThread+0x5f1
ebccfda4 e092cd0d f96f7cf8 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b
ebccfddc e0841a96 de12b980 fa59bfb0 00000000 nt!PspSystemThreadStartup+0x3c
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+e3
e095df98 cc               int     3

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!MiCheckSessionPoolAllocations+e3

MODULE_NAME:  nt

DEBUG_FLR_IMAGE_TIMESTAMP:  42435e60

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

Followup: MachineOwner
---------"


I am not sure how to interpret the results, although if i am looking into it i think the cure could be in http://support.microsoft.com/?kbid=907242 ?  Am i correct in this ?

Cheers,
Robert
0
 
LVL 29

Accepted Solution

by:
mass2612 earned 500 total points
ID: 17039002
Yes. It may be that. I would also download and update the video driver for the system.
0
[Live Webinar] The Cloud Skills Gap

As Cloud technologies come of age, business leaders grapple with the impact it has on their team's skills and the gap associated with the use of a cloud platform.

Join experts from 451 Research and Concerto Cloud Services on July 27th where we will examine fact and fiction.

 
LVL 1

Author Comment

by:global-e
ID: 17040654
i received the hotfix from MS and installed it on the server.
0
 
LVL 29

Expert Comment

by:mass2612
ID: 17040675
Sounds good. Did they review anything and provide any feedback before provifing the patch? Let us know how you get on.
0
 
LVL 1

Author Comment

by:global-e
ID: 17040685
no they didnot review anything; its just like ordering a pizza, only i didnot have to pay ;-)
I will let you know, but it takes some time probably before i know the bsod is not coming back.

Thanks al lot!
0
 
LVL 29

Expert Comment

by:mass2612
ID: 17040698
Yeah its going to take some monitoring before you know for sure. I always wondered if they reviewed anything before handing out the patch Now I know.

Thanks.
0
 
LVL 1

Author Comment

by:global-e
ID: 17184633
Hi there, until now no blue screen anymore.

Many thanks,
Robert.
0

Featured Post

Salesforce Has Never Been Easier

Improve and reinforce salesforce training & adoption using WalkMe's digital adoption platform. Start saving on costly employee training by creating fast intuitive Walk-Thrus for Salesforce. Claim your Free Account Now

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…

635 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question