whatisthesolution
asked on
Bluescreen of Death error on 2003 SP1 server
Hi!
We are getting blue screen errors on our company webserver since yesterday - We have runned the ms debugger tool to analyse the debug results.
This is not my strong side... so could you guys be kind and help us Interpret the analysis result from the ms debugger tool?
--------------------------
Is the server hardware tosted/do we need a new server or can we fix this?
Thanx in advance guys!
Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48
Debug session time: Tue Nov 21 12:50:49.421 2006 (GMT+1)
System Uptime: 0 days 21:38:50.984
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
....
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {b91d4030, 2, 0, b91d4030}
Probably caused by : hardware
Followup: MachineOwner
---------
*** Possible invalid call from b9dd95b8 ( USBPORT!USBPORT_DM_TimerDp
*** Expected target b9dd4030 ( USBPORT!USBPORT_TrackPendi
kd> .reload
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
....
kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
DRIVER_IRQL_NOT_LESS_OR_EQ
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: b91d4030, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: b91d4030, address which referenced memory
Debugging Details:
------------------
OVERLAPPED_MODULE: Address regions for 'mrxsmb' and 'NetBurn.sys' overlap
READ_ADDRESS: b91d4030
CURRENT_IRQL: 2
FAULTING_IP:
+ffffffffb91d4030
b91d4030 ?? ???
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from b9dd95bd to b91d4030
FAILED_INSTRUCTION_ADDRESS
+ffffffffb91d4030
b91d4030 ?? ???
POSSIBLE_INVALID_CONTROL_T
TWO_BIT_ERROR: 1
TRAP_FRAME: 8089d460 -- (.trap ffffffff8089d460)
ErrCode = 00000000
eax=00000041 ebx=80a6ee01 ecx=00000041 edx=00000002 esi=89a4b730 edi=89a4b028
eip=b91d4030 esp=8089d4d4 ebp=8089d4f8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
b91d4030 ?? ???
Resetting default scope
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
8089d4d0 b9dd95bd 89a4b028 00000000 00000000 0xb91d4030
8089d4f8 8082f7c9 89a4b70c 89a4b028 49c991fe USBPORT!USBPORT_DM_TimerDp
8089d5b0 808287ad 00000000 00000000 024c1abe nt!KiTimerExpiration+0x2d0
8089d600 80820a6a 00000000 0000000e 00000000 nt!KiRetireDpcList+0x65
8089d604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x2f
STACK_COMMAND: .trap 0xffffffff8089d460 ; kb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP:
BUCKET_ID: TWO_BIT_CPU_CALL_ERROR
Followup: MachineOwner
---------
*** Possible invalid call from b9dd95b8 ( USBPORT!USBPORT_DM_TimerDp
*** Expected target b9dd4030 ( USBPORT!USBPORT_TrackPendi
--------------------------
Addtional info:
We have also a fax server installed on the server and its also reporting a exception - which might be linked to the blue screen error? - Se below for the exception report that the fax server is mailing us:
An exception occurred in RelayFax Server.
The service may need to be restarted.
Stack trace:
Parsing Thread: Exception C0000005 ACCESS_VIOLATION in Run() RelayFax version: 6.7.0 OS version: 5.2 Platform ID: 2 Build: 3790
77E6A937 01F6B3B8 0001:00029937 C:\WINDOWS\system32\kernel
77E461D9 01F6B644 0001:000051D9 C:\WINDOWS\system32\kernel
00466BFD 01F6FF08 0001:00065BFD C:\PROGRA~1\RelayFax\App\R
004B52D0 01F6FF7C 0001:000B42D0 C:\PROGRA~1\RelayFax\App\R
004B4FFB 01F6FF84 0001:000B3FFB C:\PROGRA~1\RelayFax\App\R
004C673C 01F6FFB8 0001:000C573C C:\PROGRA~1\RelayFax\App\R
77E6608B 01F6FFEC 0001:0002508B C:\WINDOWS\system32\kernel
----------
Please notice that we wish to have the debug anlysis professionally explained , into "plain english" :-) - So please dont just link the the 2 errors together at once.
--------------------------
Thanks a lot, again!
We are getting blue screen errors on our company webserver since yesterday - We have runned the ms debugger tool to analyse the debug results.
This is not my strong side... so could you guys be kind and help us Interpret the analysis result from the ms debugger tool?
--------------------------
Is the server hardware tosted/do we need a new server or can we fix this?
Thanx in advance guys!
Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48
Debug session time: Tue Nov 21 12:50:49.421 2006 (GMT+1)
System Uptime: 0 days 21:38:50.984
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
....
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {b91d4030, 2, 0, b91d4030}
Probably caused by : hardware
Followup: MachineOwner
---------
*** Possible invalid call from b9dd95b8 ( USBPORT!USBPORT_DM_TimerDp
*** Expected target b9dd4030 ( USBPORT!USBPORT_TrackPendi
kd> .reload
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
....
kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
DRIVER_IRQL_NOT_LESS_OR_EQ
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: b91d4030, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: b91d4030, address which referenced memory
Debugging Details:
------------------
OVERLAPPED_MODULE: Address regions for 'mrxsmb' and 'NetBurn.sys' overlap
READ_ADDRESS: b91d4030
CURRENT_IRQL: 2
FAULTING_IP:
+ffffffffb91d4030
b91d4030 ?? ???
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from b9dd95bd to b91d4030
FAILED_INSTRUCTION_ADDRESS
+ffffffffb91d4030
b91d4030 ?? ???
POSSIBLE_INVALID_CONTROL_T
TWO_BIT_ERROR: 1
TRAP_FRAME: 8089d460 -- (.trap ffffffff8089d460)
ErrCode = 00000000
eax=00000041 ebx=80a6ee01 ecx=00000041 edx=00000002 esi=89a4b730 edi=89a4b028
eip=b91d4030 esp=8089d4d4 ebp=8089d4f8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
b91d4030 ?? ???
Resetting default scope
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
8089d4d0 b9dd95bd 89a4b028 00000000 00000000 0xb91d4030
8089d4f8 8082f7c9 89a4b70c 89a4b028 49c991fe USBPORT!USBPORT_DM_TimerDp
8089d5b0 808287ad 00000000 00000000 024c1abe nt!KiTimerExpiration+0x2d0
8089d600 80820a6a 00000000 0000000e 00000000 nt!KiRetireDpcList+0x65
8089d604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x2f
STACK_COMMAND: .trap 0xffffffff8089d460 ; kb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP:
BUCKET_ID: TWO_BIT_CPU_CALL_ERROR
Followup: MachineOwner
---------
*** Possible invalid call from b9dd95b8 ( USBPORT!USBPORT_DM_TimerDp
*** Expected target b9dd4030 ( USBPORT!USBPORT_TrackPendi
--------------------------
Addtional info:
We have also a fax server installed on the server and its also reporting a exception - which might be linked to the blue screen error? - Se below for the exception report that the fax server is mailing us:
An exception occurred in RelayFax Server.
The service may need to be restarted.
Stack trace:
Parsing Thread: Exception C0000005 ACCESS_VIOLATION in Run() RelayFax version: 6.7.0 OS version: 5.2 Platform ID: 2 Build: 3790
77E6A937 01F6B3B8 0001:00029937 C:\WINDOWS\system32\kernel
77E461D9 01F6B644 0001:000051D9 C:\WINDOWS\system32\kernel
00466BFD 01F6FF08 0001:00065BFD C:\PROGRA~1\RelayFax\App\R
004B52D0 01F6FF7C 0001:000B42D0 C:\PROGRA~1\RelayFax\App\R
004B4FFB 01F6FF84 0001:000B3FFB C:\PROGRA~1\RelayFax\App\R
004C673C 01F6FFB8 0001:000C573C C:\PROGRA~1\RelayFax\App\R
77E6608B 01F6FFEC 0001:0002508B C:\WINDOWS\system32\kernel
----------
Please notice that we wish to have the debug anlysis professionally explained , into "plain english" :-) - So please dont just link the the 2 errors together at once.
--------------------------
Thanks a lot, again!
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
MOBO? <---?
Yes we have a usb keyboard (manufactures own) and mouse attched to it. The server is from fujitsu siemens.
ASKER
ahh ok MOBO--> motherboard?
I would run their own diags if they got em'.
You might try a different keyboard and see what happens.
You might try a different keyboard and see what happens.
ASKER
We have looked for it without any luck..
So i guess the best is to run the mem test as proposed by Callandor9... + testing the keyboard thing..
Since im not very good at thees kind of errors i was little bit afraid of that the CPu was damaged to .. --> BUCKET_ID: TWO_BIT_CPU_CALL_ERROR ...
But thats not the case?
Lets see how it goes..
So i guess the best is to run the mem test as proposed by Callandor9... + testing the keyboard thing..
Since im not very good at thees kind of errors i was little bit afraid of that the CPu was damaged to .. --> BUCKET_ID: TWO_BIT_CPU_CALL_ERROR ...
But thats not the case?
Lets see how it goes..
ASKER
Hi!
We took the webserver offline at midnight and runned the memtest for testing memory for corrupted ram. - The test returned no errors!
So what can be wrong then?
We took the webserver offline at midnight and runned the memtest for testing memory for corrupted ram. - The test returned no errors!
So what can be wrong then?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Ok - Thanks!
I for got to tell that we upgraded Relay fax to latest version in the process, and until now relay fax hasn't sendt out any exception mail reports to us so that part seams to be solved.
I will try to test you suggestion with swapping ram. I'll get out to morrow to fetch some new ram blocks tomorrow from our distibutor and we'll see how it works...
Oh by the way - the usb slot reference:
*** Possible invalid call from b9dd95b8 ( USBPORT!USBPORT_DM_TimerDp
*** Expected target b9dd4030 ( USBPORT!USBPORT_TrackPendi
What can be the cause of this?
I'm thinking..... it's the manufactures own products attached to the usb ports, and they should be compatible right? (Anyway - we have change it, as suggested and we havn'nt got any malfunction errors yet.)
Cheers!
whats the solution.
I for got to tell that we upgraded Relay fax to latest version in the process, and until now relay fax hasn't sendt out any exception mail reports to us so that part seams to be solved.
I will try to test you suggestion with swapping ram. I'll get out to morrow to fetch some new ram blocks tomorrow from our distibutor and we'll see how it works...
Oh by the way - the usb slot reference:
*** Possible invalid call from b9dd95b8 ( USBPORT!USBPORT_DM_TimerDp
*** Expected target b9dd4030 ( USBPORT!USBPORT_TrackPendi
What can be the cause of this?
I'm thinking..... it's the manufactures own products attached to the usb ports, and they should be compatible right? (Anyway - we have change it, as suggested and we havn'nt got any malfunction errors yet.)
Cheers!
whats the solution.
ASKER
Hi!
We been testing the week/end through with new gbs ram blocks installed on the server and it runs without a glitch, (and lets hope it continues that way).
SO....
It seems like the case is solved! - Thanks to you guys - so we'll split the pts between you!
Thanks a lot for the help and have nice day!
Sincerly,
What is the solution.
We been testing the week/end through with new gbs ram blocks installed on the server and it runs without a glitch, (and lets hope it continues that way).
SO....
It seems like the case is solved! - Thanks to you guys - so we'll split the pts between you!
Thanks a lot for the help and have nice day!
Sincerly,
What is the solution.
This is typically a bad RAM problem or a system DLL corruption. If you run the diagnostic from www.memtest.org and it fails, you have bad RAM. You can check for a bad Windows driver by running a non-Windows system such as Knoppix: http://www.knopper.net/knoppix/index-en.html