Solved

2 different blue screens on windows 2003 server in 1 week

Posted on 2006-07-03
8
360 Views
Last Modified: 2008-01-09
Hi all,

A customer of ours has a windows 2003 SP1 server, which has suffered 2 blue screens in one week.

On 23/6 the code was 0x0000004e (0x0000009a, 0x00003b08, 0x00000006, 0x00000002)

Today the code was 0x000000ab (0x00000003, 0x000018d0, 0x00000000, 0x00000046)


Especially about the last one there are some clear answers in MS knowledgebase (http://support.microsoft.com/?kbid=901150 and
 
http://support.microsoft.com/?kbid=907242) , but i find it rather strange the 1st blue screen from 1 week ago is completely different.

Hopefully someone can help me out.

Logs of both blue screens can be found at http://rapidshare.de/files/24825687/Mini062306-01.dmp.html and

http://rapidshare.de/files/24825722/Mini070306-01.dmp.html

Many thanks in advance!
0
Comment
Question by:global-e
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 29

Expert Comment

by:mass2612
ID: 17034240
Hi,

I can't access Rapid Share sites from work. Has anything been changed on the system recently?

You can use the Windows Debugging Tools to analyse the memory.dmp file that should be in your C:\windows or c:\winnt folder. Copy this to a workstation and install the debugging tools and then use Windbg to analyse the dump file to try to help figure it out.

http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

You'll need to add the following setting to the symbol file path within the Windbg tool
SRV*c:\temp*http://msdl.microsoft.com/download/symbols

http://support.microsoft.com/?kbid=311503
0
 
LVL 1

Author Comment

by:global-e
ID: 17036836
Hi,

Thanks for your explanation.
I ran windbg with the correct symbol file path with the bug check of yesterday; results :


"*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck AB, {3, 18d0, 0, 46}

Probably caused by : memory_corruption ( nt!MiCheckSessionPoolAllocations+e3 )

Followup: MachineOwner
---------

1: kd> .reload
Loading Kernel Symbols
.......................................................................................................................
Loading User Symbols
Loading unloaded module list
....
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 00000003, session ID
Arg2: 000018d0, number of paged pool bytes that are leaking
Arg3: 00000000, number of nonpaged pool bytes that are leaking
Arg4: 00000046, total number of paged and nonpaged allocations that are leaking.
      nonpaged allocations are in the upper half of this word,
      paged allocations are in the lower half of this word.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xAB

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from e095df98 to e087b6be

STACK_TEXT:  
ebccfc30 e095df98 000000ab 00000003 000018d0 nt!KeBugCheckEx+0x1b
ebccfc68 e09c4c28 f9a52d88 f9a52d88 00000000 nt!MiCheckSessionPoolAllocations+0xe3
ebccfce8 e082117f f9a52d88 00000000 f96f7cf8 nt!MiDereferenceSessionFinal+0x183
ebccfd04 e0912d6f f9a52d88 f96f7cf8 f96f7f38 nt!MmCleanProcessAddressSpace+0x6b
ebccfd8c e092d96b 00000000 00000000 f96f7cf8 nt!PspExitThread+0x5f1
ebccfda4 e092cd0d f96f7cf8 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b
ebccfddc e0841a96 de12b980 fa59bfb0 00000000 nt!PspSystemThreadStartup+0x3c
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+e3
e095df98 cc               int     3

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!MiCheckSessionPoolAllocations+e3

MODULE_NAME:  nt

DEBUG_FLR_IMAGE_TIMESTAMP:  42435e60

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

Followup: MachineOwner
---------"


I am not sure how to interpret the results, although if i am looking into it i think the cure could be in http://support.microsoft.com/?kbid=907242 ?  Am i correct in this ?

Cheers,
Robert
0
 
LVL 29

Accepted Solution

by:
mass2612 earned 500 total points
ID: 17039002
Yes. It may be that. I would also download and update the video driver for the system.
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
LVL 1

Author Comment

by:global-e
ID: 17040654
i received the hotfix from MS and installed it on the server.
0
 
LVL 29

Expert Comment

by:mass2612
ID: 17040675
Sounds good. Did they review anything and provide any feedback before provifing the patch? Let us know how you get on.
0
 
LVL 1

Author Comment

by:global-e
ID: 17040685
no they didnot review anything; its just like ordering a pizza, only i didnot have to pay ;-)
I will let you know, but it takes some time probably before i know the bsod is not coming back.

Thanks al lot!
0
 
LVL 29

Expert Comment

by:mass2612
ID: 17040698
Yeah its going to take some monitoring before you know for sure. I always wondered if they reviewed anything before handing out the patch Now I know.

Thanks.
0
 
LVL 1

Author Comment

by:global-e
ID: 17184633
Hi there, until now no blue screen anymore.

Many thanks,
Robert.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Ms Filer Server Migration toolkit issues 2 96
Windows server 2003 bootable iso 9 276
AD account Auto logoff 1 37
windows Server 2003 in 2017 10 71
So you have two Windows Servers and you have a directory/folder/files on one that you'd like to mirror to the other?  You don't really want to deal with DFS or a 3rd party solution like Doubletake. You can use Robocopy from the Windows Server 200…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below. https://filedb.experts-exchange.com/incoming/2017/03_w12/1151775/Permutations.txt https://filedb.experts-exchange.com/incoming/201…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question