Solved

2 different blue screens on windows 2003 server in 1 week

Posted on 2006-07-03
8
356 Views
Last Modified: 2008-01-09
Hi all,

A customer of ours has a windows 2003 SP1 server, which has suffered 2 blue screens in one week.

On 23/6 the code was 0x0000004e (0x0000009a, 0x00003b08, 0x00000006, 0x00000002)

Today the code was 0x000000ab (0x00000003, 0x000018d0, 0x00000000, 0x00000046)


Especially about the last one there are some clear answers in MS knowledgebase (http://support.microsoft.com/?kbid=901150 and
 
http://support.microsoft.com/?kbid=907242) , but i find it rather strange the 1st blue screen from 1 week ago is completely different.

Hopefully someone can help me out.

Logs of both blue screens can be found at http://rapidshare.de/files/24825687/Mini062306-01.dmp.html and

http://rapidshare.de/files/24825722/Mini070306-01.dmp.html

Many thanks in advance!
0
Comment
Question by:global-e
  • 4
  • 4
8 Comments
 
LVL 29

Expert Comment

by:mass2612
ID: 17034240
Hi,

I can't access Rapid Share sites from work. Has anything been changed on the system recently?

You can use the Windows Debugging Tools to analyse the memory.dmp file that should be in your C:\windows or c:\winnt folder. Copy this to a workstation and install the debugging tools and then use Windbg to analyse the dump file to try to help figure it out.

http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

You'll need to add the following setting to the symbol file path within the Windbg tool
SRV*c:\temp*http://msdl.microsoft.com/download/symbols

http://support.microsoft.com/?kbid=311503
0
 
LVL 1

Author Comment

by:global-e
ID: 17036836
Hi,

Thanks for your explanation.
I ran windbg with the correct symbol file path with the bug check of yesterday; results :


"*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck AB, {3, 18d0, 0, 46}

Probably caused by : memory_corruption ( nt!MiCheckSessionPoolAllocations+e3 )

Followup: MachineOwner
---------

1: kd> .reload
Loading Kernel Symbols
.......................................................................................................................
Loading User Symbols
Loading unloaded module list
....
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 00000003, session ID
Arg2: 000018d0, number of paged pool bytes that are leaking
Arg3: 00000000, number of nonpaged pool bytes that are leaking
Arg4: 00000046, total number of paged and nonpaged allocations that are leaking.
      nonpaged allocations are in the upper half of this word,
      paged allocations are in the lower half of this word.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xAB

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from e095df98 to e087b6be

STACK_TEXT:  
ebccfc30 e095df98 000000ab 00000003 000018d0 nt!KeBugCheckEx+0x1b
ebccfc68 e09c4c28 f9a52d88 f9a52d88 00000000 nt!MiCheckSessionPoolAllocations+0xe3
ebccfce8 e082117f f9a52d88 00000000 f96f7cf8 nt!MiDereferenceSessionFinal+0x183
ebccfd04 e0912d6f f9a52d88 f96f7cf8 f96f7f38 nt!MmCleanProcessAddressSpace+0x6b
ebccfd8c e092d96b 00000000 00000000 f96f7cf8 nt!PspExitThread+0x5f1
ebccfda4 e092cd0d f96f7cf8 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b
ebccfddc e0841a96 de12b980 fa59bfb0 00000000 nt!PspSystemThreadStartup+0x3c
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+e3
e095df98 cc               int     3

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!MiCheckSessionPoolAllocations+e3

MODULE_NAME:  nt

DEBUG_FLR_IMAGE_TIMESTAMP:  42435e60

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

Followup: MachineOwner
---------"


I am not sure how to interpret the results, although if i am looking into it i think the cure could be in http://support.microsoft.com/?kbid=907242 ?  Am i correct in this ?

Cheers,
Robert
0
 
LVL 29

Accepted Solution

by:
mass2612 earned 500 total points
ID: 17039002
Yes. It may be that. I would also download and update the video driver for the system.
0
 
LVL 1

Author Comment

by:global-e
ID: 17040654
i received the hotfix from MS and installed it on the server.
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 29

Expert Comment

by:mass2612
ID: 17040675
Sounds good. Did they review anything and provide any feedback before provifing the patch? Let us know how you get on.
0
 
LVL 1

Author Comment

by:global-e
ID: 17040685
no they didnot review anything; its just like ordering a pizza, only i didnot have to pay ;-)
I will let you know, but it takes some time probably before i know the bsod is not coming back.

Thanks al lot!
0
 
LVL 29

Expert Comment

by:mass2612
ID: 17040698
Yeah its going to take some monitoring before you know for sure. I always wondered if they reviewed anything before handing out the patch Now I know.

Thanks.
0
 
LVL 1

Author Comment

by:global-e
ID: 17184633
Hi there, until now no blue screen anymore.

Many thanks,
Robert.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Join & Write a Comment

So you have two Windows Servers and you have a directory/folder/files on one that you'd like to mirror to the other?  You don't really want to deal with DFS or a 3rd party solution like Doubletake. You can use Robocopy from the Windows Server 200…
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now