Solved

2 different blue screens on windows 2003 server in 1 week

Posted on 2006-07-03
8
357 Views
Last Modified: 2008-01-09
Hi all,

A customer of ours has a windows 2003 SP1 server, which has suffered 2 blue screens in one week.

On 23/6 the code was 0x0000004e (0x0000009a, 0x00003b08, 0x00000006, 0x00000002)

Today the code was 0x000000ab (0x00000003, 0x000018d0, 0x00000000, 0x00000046)


Especially about the last one there are some clear answers in MS knowledgebase (http://support.microsoft.com/?kbid=901150 and
 
http://support.microsoft.com/?kbid=907242) , but i find it rather strange the 1st blue screen from 1 week ago is completely different.

Hopefully someone can help me out.

Logs of both blue screens can be found at http://rapidshare.de/files/24825687/Mini062306-01.dmp.html and

http://rapidshare.de/files/24825722/Mini070306-01.dmp.html

Many thanks in advance!
0
Comment
Question by:global-e
  • 4
  • 4
8 Comments
 
LVL 29

Expert Comment

by:mass2612
ID: 17034240
Hi,

I can't access Rapid Share sites from work. Has anything been changed on the system recently?

You can use the Windows Debugging Tools to analyse the memory.dmp file that should be in your C:\windows or c:\winnt folder. Copy this to a workstation and install the debugging tools and then use Windbg to analyse the dump file to try to help figure it out.

http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

You'll need to add the following setting to the symbol file path within the Windbg tool
SRV*c:\temp*http://msdl.microsoft.com/download/symbols

http://support.microsoft.com/?kbid=311503
0
 
LVL 1

Author Comment

by:global-e
ID: 17036836
Hi,

Thanks for your explanation.
I ran windbg with the correct symbol file path with the bug check of yesterday; results :


"*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck AB, {3, 18d0, 0, 46}

Probably caused by : memory_corruption ( nt!MiCheckSessionPoolAllocations+e3 )

Followup: MachineOwner
---------

1: kd> .reload
Loading Kernel Symbols
.......................................................................................................................
Loading User Symbols
Loading unloaded module list
....
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 00000003, session ID
Arg2: 000018d0, number of paged pool bytes that are leaking
Arg3: 00000000, number of nonpaged pool bytes that are leaking
Arg4: 00000046, total number of paged and nonpaged allocations that are leaking.
      nonpaged allocations are in the upper half of this word,
      paged allocations are in the lower half of this word.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xAB

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from e095df98 to e087b6be

STACK_TEXT:  
ebccfc30 e095df98 000000ab 00000003 000018d0 nt!KeBugCheckEx+0x1b
ebccfc68 e09c4c28 f9a52d88 f9a52d88 00000000 nt!MiCheckSessionPoolAllocations+0xe3
ebccfce8 e082117f f9a52d88 00000000 f96f7cf8 nt!MiDereferenceSessionFinal+0x183
ebccfd04 e0912d6f f9a52d88 f96f7cf8 f96f7f38 nt!MmCleanProcessAddressSpace+0x6b
ebccfd8c e092d96b 00000000 00000000 f96f7cf8 nt!PspExitThread+0x5f1
ebccfda4 e092cd0d f96f7cf8 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b
ebccfddc e0841a96 de12b980 fa59bfb0 00000000 nt!PspSystemThreadStartup+0x3c
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+e3
e095df98 cc               int     3

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!MiCheckSessionPoolAllocations+e3

MODULE_NAME:  nt

DEBUG_FLR_IMAGE_TIMESTAMP:  42435e60

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

Followup: MachineOwner
---------"


I am not sure how to interpret the results, although if i am looking into it i think the cure could be in http://support.microsoft.com/?kbid=907242 ?  Am i correct in this ?

Cheers,
Robert
0
 
LVL 29

Accepted Solution

by:
mass2612 earned 500 total points
ID: 17039002
Yes. It may be that. I would also download and update the video driver for the system.
0
 
LVL 1

Author Comment

by:global-e
ID: 17040654
i received the hotfix from MS and installed it on the server.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 29

Expert Comment

by:mass2612
ID: 17040675
Sounds good. Did they review anything and provide any feedback before provifing the patch? Let us know how you get on.
0
 
LVL 1

Author Comment

by:global-e
ID: 17040685
no they didnot review anything; its just like ordering a pizza, only i didnot have to pay ;-)
I will let you know, but it takes some time probably before i know the bsod is not coming back.

Thanks al lot!
0
 
LVL 29

Expert Comment

by:mass2612
ID: 17040698
Yeah its going to take some monitoring before you know for sure. I always wondered if they reviewed anything before handing out the patch Now I know.

Thanks.
0
 
LVL 1

Author Comment

by:global-e
ID: 17184633
Hi there, until now no blue screen anymore.

Many thanks,
Robert.
0

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The HP utility "HP Lights-Out Online Configuration Utility for Windows Server 2003/2008" could be of great use when it comes to remotely configure a HP servers ILO WITHOUT rebooting the server. We would only need to create and run scripts using thi…
by Batuhan Cetin In this article I will be guiding through the process of removing a failed DC metadata from Active Directory (hereafter, AD) using the ntdsutil tool in a Windows Server 2003 environment. These steps are not necessary in a Win…
Concerto provides fully managed cloud services and the expertise to provide an easy and reliable route to the cloud. Our best-in-class solutions help you address the toughest IT challenges, find new efficiencies and deliver the best application expe…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now