?
Solved

Windows debugging tool ( WINDBG)

Posted on 2007-08-02
6
Medium Priority
?
2,075 Views
Last Modified: 2008-01-09
Hi Experts,

When i use Windbg tool to debug my Blue screen errors i get to see these can any one help me in finding out what went bad on my server


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 0000121a, (reserved)
Arg3: 04330803, Memory contents of the pool block
Arg4: e1dc37e8, Address of the block of pool being deallocated

Debugging Details:
------------------
POOL_ADDRESS:  e1dc37e8
FREED_POOL_TAG:  FMfn
BUGCHECK_STR:  0xc2_7_FMfn
CUSTOMER_CRASH_COUNT:  14
DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP
PROCESS_NAME:  OvSvcDiscAgt.ex
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from e089c8f4 to e087b6be
STACK_TEXT:  
f39da8a8 e089c8f4 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b
f39da910 f5e4e99b e1dc37e8 6e664d46 f39da92c nt!ExFreePoolWithTag+0x477
f39da920 f5e4e9dd e1dc3814 f39da944 f5e4ec5f fltmgr!FltpFreeFileNameInformation+0x17
f39da92c f5e4ec5f e1dc3814 fc93a000 fc89ce78 fltmgr!FltReleaseFileNameInformation+0x1d
f39da944 f5e4ec87 00000000 fc89ce8c ffffffff fltmgr!DeleteNameCacheNodes+0x99
f39da960 f5e4ecb5 fc909250 00000000 fc89ce8c fltmgr!FltpFreeNameCacheList+0x17
f39da978 f5e39eb3 fc89ce78 fc909250 c000003a fltmgr!FltpFreeNameCacheCreateCtrl+0x25
f39da994 f5e3c46f fbca55b8 00000000 00000000 fltmgr!FltpFreeIrpCtrl+0x75
f39da9ac f5e3cbc6 fbca55b8 00000000 fbc8be48 fltmgr!FltpSynchronizeIoCleanup+0x39
f39da9d4 f5e4a5af f39da9f4 c000003a 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28e
f39daa10 e083f9d0 fc8e5af8 fbc8be48 fbc8be48 fltmgr!FltpCreate+0x23b
f39daa24 e092e269 fbe67c78 fbca1310 00000000 nt!IofCallDriver+0x45
f39dab0c e093a934 fc8e5af8 00000000 fc785f28 nt!IopParseDevice+0xa35
f39dab44 e0936848 fbe67c78 00000000 fc785f28 nt!IopParseFile+0x46
f39dabc4 e0936aa5 00000010 f39dac04 00000042 nt!ObpLookupObjectName+0x11f
f39dac18 e0936f27 00000000 00000000 003e6401 nt!ObOpenObjectByName+0xea
f39dac94 e0936ff8 00e6e7c0 80100080 00e6e75c nt!IopCreateFile+0x447
f39dacf0 e092ed98 00e6e7c0 80100080 00e6e75c nt!IoCreateFile+0xa3
f39dad30 e0834d3f 00e6e7c0 80100080 00e6e75c nt!NtCreateFile+0x30
f39dad30 7c82ed54 00e6e7c0 80100080 00e6e75c nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00e6e7b8 00000000 00000000 00000000 00000000 0x7c82ed54

STACK_COMMAND:  kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+477
e089c8f4 cc              int     3

SYMBOL_STACK_INDEX:  1
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  42435e60
SYMBOL_NAME:  nt!ExFreePoolWithTag+477
FAILURE_BUCKET_ID:  0xc2_7_FMfn_nt!ExFreePoolWithTag+477
BUCKET_ID:  0xc2_7_FMfn_nt!ExFreePoolWithTag+477
Followup: MachineOwner
---------
0
Comment
Question by:SridharMani12
6 Comments
 
LVL 3

Expert Comment

by:mukul_d
ID: 19621695
Are you using HP Openview? Are there any event entries around the time of your BSOD?
0
 
LVL 31

Expert Comment

by:merowinger
ID: 19623080
in windbg type in:
!anaylze -v

and post the result!
0
 

Author Comment

by:SridharMani12
ID: 19626713
HI Experts,

I did not find any errors WRT HP Openview.( we had installed this on the server earlier and we have uninstalled the software long back

Here is the  full details on my 14th minidump

Microsoft (R) Windows Debugger  Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [Y:\WINDOWS\Minidump\Mini121906-14.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0xe0800000 PsLoadedModuleList = 0xe08af988
Debug session time: Mon Dec 18 09:34:55.156 2006 (GMT-5)
System Uptime: 0 days 0:00:44.234
Loading Kernel Symbols
...............................................................................................................
Loading User Symbols
Loading unloaded module list
..
************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 121a, 4330803, e1dc37e8}
Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+477 )
Followup: MachineOwner
---------

1: kd> !analyze -v
************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 0000121a, (reserved)
Arg3: 04330803, Memory contents of the pool block
Arg4: e1dc37e8, Address of the block of pool being deallocated

Debugging Details:
------------------

POOL_ADDRESS:  e1dc37e8
FREED_POOL_TAG:  FMfn
BUGCHECK_STR:  0xc2_7_FMfn
CUSTOMER_CRASH_COUNT:  14
DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP
PROCESS_NAME:  OvSvcDiscAgt.ex
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from e089c8f4 to e087b6be

STACK_TEXT:  
f39da8a8 e089c8f4 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b
f39da910 f5e4e99b e1dc37e8 6e664d46 f39da92c nt!ExFreePoolWithTag+0x477
f39da920 f5e4e9dd e1dc3814 f39da944 f5e4ec5f fltmgr!FltpFreeFileNameInformation+0x17
f39da92c f5e4ec5f e1dc3814 fc93a000 fc89ce78 fltmgr!FltReleaseFileNameInformation+0x1d
f39da944 f5e4ec87 00000000 fc89ce8c ffffffff fltmgr!DeleteNameCacheNodes+0x99
f39da960 f5e4ecb5 fc909250 00000000 fc89ce8c fltmgr!FltpFreeNameCacheList+0x17
f39da978 f5e39eb3 fc89ce78 fc909250 c000003a fltmgr!FltpFreeNameCacheCreateCtrl+0x25
f39da994 f5e3c46f fbca55b8 00000000 00000000 fltmgr!FltpFreeIrpCtrl+0x75
f39da9ac f5e3cbc6 fbca55b8 00000000 fbc8be48 fltmgr!FltpSynchronizeIoCleanup+0x39
f39da9d4 f5e4a5af f39da9f4 c000003a 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28e
f39daa10 e083f9d0 fc8e5af8 fbc8be48 fbc8be48 fltmgr!FltpCreate+0x23b
f39daa24 e092e269 fbe67c78 fbca1310 00000000 nt!IofCallDriver+0x45
f39dab0c e093a934 fc8e5af8 00000000 fc785f28 nt!IopParseDevice+0xa35
f39dab44 e0936848 fbe67c78 00000000 fc785f28 nt!IopParseFile+0x46
f39dabc4 e0936aa5 00000010 f39dac04 00000042 nt!ObpLookupObjectName+0x11f
f39dac18 e0936f27 00000000 00000000 003e6401 nt!ObOpenObjectByName+0xea
f39dac94 e0936ff8 00e6e7c0 80100080 00e6e75c nt!IopCreateFile+0x447
f39dacf0 e092ed98 00e6e7c0 80100080 00e6e75c nt!IoCreateFile+0xa3
f39dad30 e0834d3f 00e6e7c0 80100080 00e6e75c nt!NtCreateFile+0x30
f39dad30 7c82ed54 00e6e7c0 80100080 00e6e75c nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00e6e7b8 00000000 00000000 00000000 00000000 0x7c82ed54


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+477
e089c8f4 cc              int     3
SYMBOL_STACK_INDEX:  1
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  42435e60
SYMBOL_NAME:  nt!ExFreePoolWithTag+477
FAILURE_BUCKET_ID:  0xc2_7_FMfn_nt!ExFreePoolWithTag+477
BUCKET_ID:  0xc2_7_FMfn_nt!ExFreePoolWithTag+477

Followup: MachineOwner
---------

1: kd> lmvm nt
start    end        module name
e0800000 e0a75000   nt       # (pdb symbols)          c:\symbols\ntkrnlmp.pdb\D11928D0A382448AA96E545C81E4DD172\ntkrnlmp.pdb
    Loaded symbol image file: ntkrnlmp.exe
    Mapped memory image file: c:\symbols\ntkrnlmp.exe\42435E60275000\ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Thu Mar 24 18:42:08 2005 (42435E60)
    CheckSum:         0025EC4B
    ImageSize:        00275000
    File version:     5.2.3790.1830
    Product version:  5.2.3790.1830
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0404.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft(R) Windows(R) Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   5.2.3790.1830
    FileVersion:      5.2.3790.1830 (srv03_sp1_rtm.050324-1447)
    FileDescription:  NT Kernel & System
    LegalCopyright:   (C) Microsoft Corporation. All rights reserved.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 29

Expert Comment

by:Alan Huseyin Kayahan
ID: 19627448
  Hi SridharMani12
            I suggest you to check your RAMs with following utility for errors
 http://www.memtest86.com/
            Since when do you encounter this issue?
            What was the recent change you made?

Regards
0
 
LVL 31

Accepted Solution

by:
merowinger earned 1500 total points
ID: 19628420
its HP Open View!!! Its not uninstalled clearly!!

OvSvcDiscAgt.exe = HP Open View...this process causes a problem!!!

1. Check your systrem for drivers which may are from HP
2. Also check your processes if this process is still running
3. Check your services if there is something listed
0
 

Author Comment

by:SridharMani12
ID: 19659102
I have logged a call with HP to run the diag on the server and waiting for thier responce for Open view
will update the issue once they notify me
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The way I use Experts Exchange to assist me in analyzing and diagnosing a problem is I first enter a Verbose Question at Experts Exchange like: Office 2007 will hang when opening and saving files I then launch WordPad (any text editor will do) an…
The password reset disk is often mentioned as the best solution to deal with the lost Windows password problem. In Windows 2008, 7, Vista and XP, a password reset disk can be easily created. But besides Windows 7/Vista/XP, Windows Server 2008 and ot…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question