Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1339
  • Last Modified:

2k3 ent svr reboots for no reason - error code. 0x0000007e (0xc0000005, 0xb9320708, 0xb7755700, 0xb77553fc)

hello,

i have a win 2k3 r2 enterprise edition sp1 machine. For some reason my machine just tanked. Machine rebooted itself and came back up and gave an error code. 0x0000007e (0xc0000005, 0xb9320708, 0xb7755700, 0xb77553fc)

now i have been getting the following two errors:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date:  8/7/2007
Time:  2:04:19 PM
User:  N/A
Computer: RHCACC3
Description:
Application popup: Windows - System Error : A Machine Check Error has occurred. Please check the system eventlog for additional information.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: WMIxWDM
Event Category: None
Event ID: 106
Date:  8/7/2007
Time:  2:04:19 PM
User:  N/A
Computer: RHCACC3
Description:
Machine Check Event reported is a corrected error.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 01 00 00 00 01 00 00 00   ........
0008: 61 43 0e c2 25 d9 c7 01   aC.Â%ÙÇ.
0010: 00 00 00 00 00 00 00 00   ........
0018: 01 00 00 00 00 00 00 00   ........
0020: 34 01 00 00 a0 09 00 84   4... ..
0028: 00 bf e9 bf 00 00 00 00   .¿é¿....
0030: 00 00 00 00 00 00 00 00   ........
0038: 18 00 00 00 00 00 00 00   ........
0040: 00 00 00 00 00 00 00 00   ........
0048: 00 00 00 00 00 00 00 00   ........
0050: 00 00 00 00 00 00 00 00   ........
0058: 00 00 00 00 00 00 00 00   ........
0060: 00 00 00 00 00 00 00 00   ........
0068: 00 00 00 00 00 00 00 00   ........
0070: 00 00 00 00 00 00 00 00   ........
0078: 00 00 00 00 00 00 00 00   ........
0080: 00 00 00 00 00 00 00 00   ........
0088: 00 00 00 00 00 00 00 00   ........
0090: 00 00 00 00 00 00 00 00   ........
0098: 00 00 00 00 00 00 00 00   ........
00a0: 00 00 00 00 00 00 00 00   ........
00a8: 00 00 00 00 00 00 00 00   ........
00b0: 00 00 00 00 00 00 00 00   ........
00b8: 00 00 00 00 00 00 00 00   ........
00c0: 00 00 00 00 00 00 00 00   ........
00c8: 00 00 00 00 00 00 00 00   ........
00d0: 00 00 00 00 00 00 00 00   ........
00d8: 00 00 00 00 00 00 00 00   ........
00e0: 00 00 00 00 00 00 00 00   ........
00e8: 00 00 00 00 00 00 00 00   ........
00f0: 00 00 00 00 00 00 00 00   ........
00f8: 00 00 00 00 00 00 00 00   ........

i've checked device manager and nothing out of the ordinary there. the rest of the logs look fine. so i'm at a loss of what next to check or to try out. any suggestions on this one?
0
knightstawker
Asked:
knightstawker
  • 9
  • 2
  • 2
  • +2
1 Solution
 
Alan Huseyin KayahanCommented:
        Hi knightstawker
             Please upload memory dump files locatet under %SystemRoot%\MEMORY.DMP to www.ee-stuff.com for us to analyze

Regards
0
 
knightstawkerAuthor Commented:
my mem dump is 16 gig or 1.89 gb zipped. where should i upload that to? that web site says that the file size limit is 4mb. i'm way over with no way of making it any smaller then that.
0
 
Alan Huseyin KayahanCommented:
      Right-click my computer>Properties>Advanced>Startup and recovery. Choose Mini dumps instead full dumps and wait for next unexpected reboot. This time smaller dumps will be created
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
knightstawkerAuthor Commented:
i have done as requested. i will wait and see if i get another crash. and report the following back.
0
 
nightmare2Commented:
It's most likely a faulty CPU.
See http://www.jsifaq.com/SF/Tips/Tip.aspx?id=8882
0
 
knightstawkerAuthor Commented:
nightmare2:
i am checking with the hardware vendor (dell) to see if that is the case. i just uploaded the mem dump (16gb) to them and they are going thru it aswell currently. i have forwarded them the CPU error to see what they think and if that is the issue that they see.

so far no more reboots yet, but i know its just a matter of time. i will keep you guys posted and thanks for the help guys!

Vp
0
 
knightstawkerAuthor Commented:
since there was a request regarding the CPU i just checked device manager and the Processors tab. I have 16 Intel(R) Xeon(TM) CPU 3.40GHz on this machine. went thru all the properties on each of them and they are all reporting back: This device is working properly.

just fyi.

Vp
0
 
knightstawkerAuthor Commented:
so the hardware vendor sends an email with this info:

The software engineers looked over the dump and found the reboot is caused by symevent on  the Symatec application installed. He sent this link stating to ask you to update your symevent files:

http://service1.symantec.com/SUPPORT/ent-security.nsf/ad649eccef145d2d88256e22005026f2/45c5f0d588d1298a88256a22002726d9

and i did this
ftp://ftp.symantec.com/public/english_us_canada/symevnt/Sevinst.exe
To update the Symevent files on Windows 2003/XP/2000/NT
Download Sevinst.exe from the Symantec FTP site. Save the file to a folder on the hard drive (for example, C:\Windows\Temp).
Open a command prompt, and change to the folder where you downloaded the Sevinst.exe file.
Depending on the program version, do one of the following:
On computers that run Symantec AntiVirus 9.x or later, type the following command:

sevinst.exe SAVCE


On computers that run Symantec AntiVirus 8.x or earlier, type the following command:

sevinst.exe NAVNT


Restart the computer.


--------------------------------------------------------------------------------
Note: Sevinst.exe does not run on 64-bit versions of Windows 2003 Server or 64-bit versions of Windows XP.





So far everything is good and it has been over a week without a restart. Points to Dell Gold Level Support! thanks guys.
0
 
knightstawkerAuthor Commented:
ok, so it seems my server rebooted yesterday... here's the new error code...

Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            8/20/2007
Time:            8:32:52 AM
User:            N/A
Computer:      RHCACC3
Description:
Error code 1000008e, parameter1 c0000005, parameter2 808d907f, parameter3 bafdf724, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 38    1000008
0020: 65 20 20 50 61 72 61 6d   e  Param
0028: 65 74 65 72 73 20 63 30   eters c0
0030: 30 30 30 30 30 35 2c 20   000005,
0038: 38 30 38 64 39 30 37 66   808d907f
0040: 2c 20 62 61 66 64 66 37   , bafdf7
0048: 32 34 2c 20 30 30 30 30   24, 0000
0050: 30 30 30 30               0000    

any thoughts on this one?
0
 
r-kCommented:
Please upload the minidump file (mini######-##.dmp) to http://www.ee-stuff.com/
0
 
knightstawkerAuthor Commented:
0
 
r-kCommented:
This crash is also caused by SYMEVENT.SYS

I think you have a faulty version of Symantec. Contact Symantec for all latest patches. Consider removing Symantec from your server. etc.
0
 
knightstawkerAuthor Commented:
from dell gold support

The software engineer looked at the DSET report along with me, I couldnt find any hardware failures. But he found something wrong with the symevent (Symantec).

Heres the listing from the first DSET report you sent that shows the version:
symevent
 
 Symantec Event Library
 
 C:\PROGRAM FILES\SYMANTEC\SYMEVENT.SYS
 
 12.0.0.20
 
 Kernel Driver
 
 Manual
 
 Running
 
 SymEvent
 
 SYMEVENT
 
 Symantec Corporation

Heres the one that you just sent, we expected to see the updated version, but instead theres nothing there:

symevent
 
 N/A
 
 C:\WINDOWS\\??\C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS
 
 N/A
 
 Kernel Driver
 
 Manual
 
 Running
 
 SymEvent
 
 N/A
 
 N/A

He said something must have gone wrong with the update because symevent is not loaded. So could you please download and install this again:


Updating the Symevent files

Situation:
 This document describes how to update the Symevent files.
 

 

Solution:
 Several files make up the module known as Symevent. Symevent is used by many different Symantec programs in all versions of Windows and is updated periodically. When you install current Symantec software, these files will normally be updated. If you are experiencing a problem with a Symantec program that may be fixed by updating these files, or if you just want to make sure that you have the most recent version, then follow the instructions for your operating system:

To update the Symevent files on Windows 2003/XP/2000/NT

1.     Download Sevinst.exe from the Symantec FTP site. (ftp://ftp.symantec.com/public/english_us_canada/symevnt/Sevinst.exe) Save the file to a folder on the hard drive (for example, C:\Windows\Temp).

2.     Open a command prompt, and change to the folder where you downloaded the Sevinst.exe file.

3.     Depending on the program version, do one of the following:

§  On computers that run Symantec AntiVirus 9.x or later, type the following command:

sevinst.exe SAVCE

§  On computers that run Symantec AntiVirus 8.x or earlier, type the following command:

sevinst.exe NAVNT

4.     Restart the computer.
 
0
 
knightstawkerAuthor Commented:
i will be doing the update to the symevent tonight along with a reboot and will let you guys know how it goes tomorrow.
0
 
Computer101Commented:
PAQed with points refunded (500)

Computer101
EE Admin
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 9
  • 2
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now