• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2313
  • Last Modified:

Windows 2003(X64) Server Crash

I am running a windows 2003 blade server with x64 sp1 version.
i have installed the following security patches MS07-033,MS07-031,MS07-027,MS07-021,MS07-020,MS07-016,MS07-035,MS07-034 on the servers and restarted the server

After couple of hours the server crashed with the following
Event ID 1003, Type Error
Error code 000000000000001a, parameter1 0000000000000782, parameter2 fffffade5bc63880, parameter3 fffff98a99f00000, parameter4 fffffa801e7de5f0.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
and in another server

Error code 0000000000000024, parameter1 000000000019033c, parameter2 fffffadf25f07bf0, parameter3 fffffadf25f07600, parameter4 fffff80001055593.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Can some one help me in finding out the root cause of the failure
0
SridharMani12
Asked:
SridharMani12
  • 3
  • 2
  • 2
  • +1
1 Solution
 
paintcheck200Commented:
what kind of server is it Make/Model/Type ?  I would be looking for a hardware issue -  You could use some testing tools like OverClockix.  If its an IBM server - Check all the firmware/drivers  and run System diagnostics
0
 
iCoreKCCommented:
Anytime you see "parameter" errors, it is usually memory DIMMS.   What I would do is use your Vendor's Setup Disk and reinstall system drivers (memory, HDD's, so forth) before I did anything more radical. Or you can begin to back out the patches one by one, but this may take an extended time to do as it takes 2 or more hours for it to crash.

Do you see anything in the Even Viewer leading up to the crash?

0
 
SridharMani12Author Commented:
The model of blades servers are HP BL465
The Above errors are been captured from event log other than these ther are no errors reported in event log

The blue dump errors in servers are not identical.
When I use windbg tool to analyze the crash dump I get to see this

First Server

FOLLOWUP_IP:
Ntfs!NtfsReadUsnJournal+6e8
fffffadf`290bb938 ??              ???
SYMBOL_STACK_INDEX:  1
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME:  Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  42436082
SYMBOL_NAME:  Ntfs!NtfsReadUsnJournal+6e8
STACK_COMMAND:  .cxr 0xfffffadf295e8600 ; kb
FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsReadUsnJournal+6e8
BUCKET_ID:  X64_0x24_Ntfs!NtfsReadUsnJournal+6e8

Second dump

STACK_COMMAND:  kb
FOLLOWUP_IP:
processr!DisplayPowerStateInfo+a2
fffffadf`29555912 c3              ret
SYMBOL_STACK_INDEX:  0
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: processr
IMAGE_NAME:  processr.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  42435dc9
SYMBOL_NAME:  processr!DisplayPowerStateInfo+a2
FAILURE_BUCKET_ID:  X64_0x1a_4128b_processr!DisplayPowerStateInfo+a2
BUCKET_ID:  X64_0x1a_4128b_processr!DisplayPowerStateInfo+a2
Followup: MachineOwner
---------

Second Server

FOLLOWUP_IP:
nt!FsRtlPrivateInsertExclusiveLock+23d
fffff800`0102db2d ??              ???
SYMBOL_STACK_INDEX:  6
SYMBOL_NAME:  nt!FsRtlPrivateInsertExclusiveLock+23d
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  42436123
FAILURE_BUCKET_ID:  X64_0xA_nt!FsRtlPrivateInsertExclusiveLock+23d
BUCKET_ID:  X64_0xA_nt!FsRtlPrivateInsertExclusiveLock+23d
Followup: MachineOwner

Third Server

STACK_COMMAND:  kb
FOLLOWUP_IP:
nt!IopRemoveLockedDeviceNode+9f0
fffff800`010501d0 48894c2408      mov     qword ptr [rsp+8],rcx
SYMBOL_STACK_INDEX:  0
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  42436123
SYMBOL_NAME:  nt!IopRemoveLockedDeviceNode+9f0
FAILURE_BUCKET_ID:  X64_0x109_nt!IopRemoveLockedDeviceNode+9f0
BUCKET_ID:  X64_0x109_nt!IopRemoveLockedDeviceNode+9f0
Followup: MachineOwner

Fourth Server

STACK_COMMAND:  kb
FOLLOWUP_IP:
nt!IopRemoveLockedDeviceNode+9f0
fffff800`010501d0 48894c2408      mov     qword ptr [rsp+8],rcx
SYMBOL_STACK_INDEX:  0
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  42436123
SYMBOL_NAME:  nt!IopRemoveLockedDeviceNode+9f0
FAILURE_BUCKET_ID:  X64_0x1a_782_nt!IopRemoveLockedDeviceNode+9f0
BUCKET_ID:  X64_0x1a_782_nt!IopRemoveLockedDeviceNode+9f0
Followup: MachineOwner
 
0
Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

 
paintcheck200Commented:
"The blue dump errors in servers are not identical."

2 Diff Blades??  When the errors are diff on the same HW, its almost always a HW issue.

Also FIrmware Firmware Firmware.
0
 
SridharMani12Author Commented:
There are 4 blade servers (Currently updated) on the same model (HP BL465).

How do i find which hardware has failed or required upgrade with the avaliable minidump and memory dump files on the servers.
0
 
busukaCommented:
I've learned that BSOD with random causes usually happen because of failed RAM
BUT
I've used to administer HP ML370 G3 server and got such advice from HP support staff to run HP
support pack after every Windows Update session.
http://h18023.www1.hp.com/support/files/server/us/download/27534.html

Hope this helps
0
 
busukaCommented:
OOPS, sorry, wrong link. Here's right one:
http://h18023.www1.hp.com/support/files/server/us/download/27535.html

(forgot that you have x64 version)
0
 
SridharMani12Author Commented:
Thanks Busuka,
I will try this option and will update the status
Thanks for your help  and support
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 3
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now