Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

2 different blue screens on windows 2003 server in 1 week

Posted on 2006-07-03
8
359 Views
Last Modified: 2008-01-09
Hi all,

A customer of ours has a windows 2003 SP1 server, which has suffered 2 blue screens in one week.

On 23/6 the code was 0x0000004e (0x0000009a, 0x00003b08, 0x00000006, 0x00000002)

Today the code was 0x000000ab (0x00000003, 0x000018d0, 0x00000000, 0x00000046)


Especially about the last one there are some clear answers in MS knowledgebase (http://support.microsoft.com/?kbid=901150 and
 
http://support.microsoft.com/?kbid=907242) , but i find it rather strange the 1st blue screen from 1 week ago is completely different.

Hopefully someone can help me out.

Logs of both blue screens can be found at http://rapidshare.de/files/24825687/Mini062306-01.dmp.html and

http://rapidshare.de/files/24825722/Mini070306-01.dmp.html

Many thanks in advance!
0
Comment
Question by:global-e
  • 4
  • 4
8 Comments
 
LVL 29

Expert Comment

by:mass2612
ID: 17034240
Hi,

I can't access Rapid Share sites from work. Has anything been changed on the system recently?

You can use the Windows Debugging Tools to analyse the memory.dmp file that should be in your C:\windows or c:\winnt folder. Copy this to a workstation and install the debugging tools and then use Windbg to analyse the dump file to try to help figure it out.

http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

You'll need to add the following setting to the symbol file path within the Windbg tool
SRV*c:\temp*http://msdl.microsoft.com/download/symbols

http://support.microsoft.com/?kbid=311503
0
 
LVL 1

Author Comment

by:global-e
ID: 17036836
Hi,

Thanks for your explanation.
I ran windbg with the correct symbol file path with the bug check of yesterday; results :


"*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck AB, {3, 18d0, 0, 46}

Probably caused by : memory_corruption ( nt!MiCheckSessionPoolAllocations+e3 )

Followup: MachineOwner
---------

1: kd> .reload
Loading Kernel Symbols
.......................................................................................................................
Loading User Symbols
Loading unloaded module list
....
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 00000003, session ID
Arg2: 000018d0, number of paged pool bytes that are leaking
Arg3: 00000000, number of nonpaged pool bytes that are leaking
Arg4: 00000046, total number of paged and nonpaged allocations that are leaking.
      nonpaged allocations are in the upper half of this word,
      paged allocations are in the lower half of this word.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xAB

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from e095df98 to e087b6be

STACK_TEXT:  
ebccfc30 e095df98 000000ab 00000003 000018d0 nt!KeBugCheckEx+0x1b
ebccfc68 e09c4c28 f9a52d88 f9a52d88 00000000 nt!MiCheckSessionPoolAllocations+0xe3
ebccfce8 e082117f f9a52d88 00000000 f96f7cf8 nt!MiDereferenceSessionFinal+0x183
ebccfd04 e0912d6f f9a52d88 f96f7cf8 f96f7f38 nt!MmCleanProcessAddressSpace+0x6b
ebccfd8c e092d96b 00000000 00000000 f96f7cf8 nt!PspExitThread+0x5f1
ebccfda4 e092cd0d f96f7cf8 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b
ebccfddc e0841a96 de12b980 fa59bfb0 00000000 nt!PspSystemThreadStartup+0x3c
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+e3
e095df98 cc               int     3

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!MiCheckSessionPoolAllocations+e3

MODULE_NAME:  nt

DEBUG_FLR_IMAGE_TIMESTAMP:  42435e60

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

Followup: MachineOwner
---------"


I am not sure how to interpret the results, although if i am looking into it i think the cure could be in http://support.microsoft.com/?kbid=907242 ?  Am i correct in this ?

Cheers,
Robert
0
 
LVL 29

Accepted Solution

by:
mass2612 earned 500 total points
ID: 17039002
Yes. It may be that. I would also download and update the video driver for the system.
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
LVL 1

Author Comment

by:global-e
ID: 17040654
i received the hotfix from MS and installed it on the server.
0
 
LVL 29

Expert Comment

by:mass2612
ID: 17040675
Sounds good. Did they review anything and provide any feedback before provifing the patch? Let us know how you get on.
0
 
LVL 1

Author Comment

by:global-e
ID: 17040685
no they didnot review anything; its just like ordering a pizza, only i didnot have to pay ;-)
I will let you know, but it takes some time probably before i know the bsod is not coming back.

Thanks al lot!
0
 
LVL 29

Expert Comment

by:mass2612
ID: 17040698
Yeah its going to take some monitoring before you know for sure. I always wondered if they reviewed anything before handing out the patch Now I know.

Thanks.
0
 
LVL 1

Author Comment

by:global-e
ID: 17184633
Hi there, until now no blue screen anymore.

Many thanks,
Robert.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Numerous times I have been asked this questions that what is it that makes my machine log on so slow, there have been cases where computers took 23 minute exactly after taking password and getting to the desktop. Interesting thing was the fact th…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

860 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question