Solved

help interpreting windbg memory dump log

Posted on 2008-10-16
3
1,363 Views
Last Modified: 2013-12-04
windows server 2003 sp2 received memory dump error 0x0000020 (0x00000000,0x00000fff1 ran windbg diagnostics.  Was unable to interpert logs.  windbg log attached.
Microsoft (R) Windows Debugger  Version 6.7.0005.0

Copyright (c) Microsoft Corporation. All rights reserved.
 
 

Loading Dump File [C:\WINDOWS\Minidump\Mini101408-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available
 

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Executable search path is: 

Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible

Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS

Built by: 3790.srv03_sp2_gdr.070304-2240

Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8

Debug session time: Tue Oct 14 17:18:00.625 2008 (GMT-4)

System Uptime: 2 days 4:39:32.390

Loading Kernel Symbols

............................................................................................................

Loading User Symbols

Loading unloaded module list

....

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************
 

Use !analyze -v to get detailed debugging information.
 

BugCheck 20, {0, fff1, 0, 1}
 

Probably caused by : ntkrpamp.exe ( nt!PspExitThread+64c )
 

Followup: MachineOwner

---------
 

1: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************
 

KERNEL_APC_PENDING_DURING_EXIT (20)

The key data item is the thread's APC disable count.

If this is non-zero, then this is the source of the problem.

The APC disable count is decremented each time a driver calls

KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem.  The APC

disable count is incremented each time a driver calls KeLeaveCriticalRegion,

KeReleaseMutex, or FsRtlExitFileSystem.  Since these calls should always be in

pairs, this value should be zero when a thread exits.  A negative value

indicates that a driver has disabled APC calls without re-enabling them.  A

positive value indicates that the reverse is true.

If you ever see this error, be very suspicious of all drivers installed on the

machine -- especially unusual or non-standard drivers.  Third party file

system redirectors are especially suspicious since they do not generally

receive the heavy duty testing that NTFS, FAT, RDR, etc receive.

This current IRQL should also be 0.  If it is not, that a driver's

cancelation routine can cause this bugcheck by returning at an elevated

IRQL.  Always attempt to note what you were doing/closing at the

time of the crash, and note all of the installed drivers at the time of

the crash.  This symptom is usually a severe bug in a third party

driver.

Arguments:

Arg1: 00000000, The address of the APC found pending during exit.

Arg2: 0000fff1, The thread's APC disable count

Arg3: 00000000, The current IRQL

Arg4: 00000001
 

Debugging Details:

------------------
 
 

BUGCHECK_STR:  0x20_NULLAPC_KAPC_NEGATIVE
 

CUSTOMER_CRASH_COUNT:  1
 

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP
 

PROCESS_NAME:  winlogon.exe
 

CURRENT_IRQL:  0
 

LAST_CONTROL_TRANSFER:  from 8094c546 to 80827c63
 

STACK_TEXT:  

b8096c80 8094c546 00000020 00000000 0000fff1 nt!KeBugCheckEx+0x1b

b8096d18 8094c63f 00000000 00000000 88dc2578 nt!PspExitThread+0x64c

b8096d30 8094c991 88dc2578 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b

b8096d54 8088978c 00000000 00000000 00f1ffb8 nt!NtTerminateThread+0x71

b8096d54 7c8285ec 00000000 00000000 00f1ffb8 nt!KiFastCallEntry+0xfc

WARNING: Frame IP not in any known module. Following frames may be wrong.

00f1ffb8 00000000 00000000 00000000 00000000 0x7c8285ec
 
 

STACK_COMMAND:  kb
 

FOLLOWUP_IP: 

nt!PspExitThread+64c

8094c546 cc              int     3
 

SYMBOL_STACK_INDEX:  1
 

SYMBOL_NAME:  nt!PspExitThread+64c
 

FOLLOWUP_NAME:  MachineOwner
 

MODULE_NAME: nt
 

IMAGE_NAME:  ntkrpamp.exe
 

DEBUG_FLR_IMAGE_TIMESTAMP:  45ec0a19
 

FAILURE_BUCKET_ID:  0x20_NULLAPC_KAPC_NEGATIVE_nt!PspExitThread+64c
 

BUCKET_ID:  0x20_NULLAPC_KAPC_NEGATIVE_nt!PspExitThread+64c
 

Followup: MachineOwner

---------

Open in new window

bsod.doc
0
Comment
Question by:mmsppm
3 Comments
 
LVL 5

Expert Comment

by:thechaosrealm
ID: 22732691
Did an event show up in the Windows Event Log? What is the Event ID?
0
 

Author Comment

by:mmsppm
ID: 22733741
Event ID 1003
0
 
LVL 1

Accepted Solution

by:
simadownnow earned 500 total points
ID: 22758626
Stop error message on a Windows Server 2003-based computer: "Stop 0x00000020"
View products that this article applies to.
Article ID : 920911
Last Review : October 11, 2007
Revision : 2.4
On This Page
SYMPTOMS
On a Microsoft Windows Server 2003-based computer, you receive the following Stop error message:
Stop 0x00000020 (0x00000000, 0x0000fffc, 0x00000000, 0x00000001)
KERNEL_APC_PENDING_DURING_EXIT
Note The four parameters in the error message vary.

Additionally, the computer restarts automatically. After this problem occurs, an event that resembles the following is logged in the System log:
Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: Date
Time: Time
User: N/A
Computer: Computer
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000020 (0x00000000, 0x0000fffc, 0x00000000, 0x00000001). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

Back to the top

CAUSE
This problem occurs because the Win32k.sys module incorrectly manages font objects. This causes an asynchronous procedure call (APC) leak. When the system detects an APC leak, the system reports the Stop error that is described in the "Symptoms" section.
Back to the top

RESOLUTION
Service pack information
To resolve this problem, install the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 (http://kbalertz.com/Feedback.aspx?kbNumber=889100/) How to obtain the latest service pack for Windows Server 2003
Back to the top

Hotfix information
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
Prerequisites
To apply this hotfix, you must have Windows Server 2003 Service Pack 1 installed on the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 (http://kbalertz.com/Feedback.aspx?kbNumber=889100/) How to obtain the latest service pack for Windows Server 2003
Restart requirement
You must restart the computer after you apply this hotfix.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Windows Server 2003 with Service Pack 1, x86-based versions
File name File version File size Date Time Platform SP requirement
Gdi32.dll 5.2.3790.2811 282,112 12-Oct-2006 14:57 x86 SP1
Win32k.sys 5.2.3790.2811 1,851,392 12-Oct-2006 13:11 x86 SP1

Windows Server 2003 with Service Pack 1, Itanium-based versions
File name File version File size Date Time Platform SP requirement Service branch
Gdi32.dll 5.2.3790.2811 906,240 12-Oct-2006 00:46 IA-64 SP1 Not Applicable
Win32k.sys 5.2.3790.2811 5,546,496 12-Oct-2006 00:46 IA-64 SP1 Not Applicable
Wgdi32.dll 5.2.3790.2811 285,184 12-Oct-2006 00:46 x86 SP1 WOW

Windows Server 2003, x64-based versions
File name File version File size Date Time Platform SP requirement Service branch
Gdi32.dll 5.2.3790.2811 610,304 12-Oct-2006 00:45 x64 SP1 Not Applicable
Win32k.sys 5.2.3790.2811 4,529,664 12-Oct-2006 00:45 x64 SP1 Not Applicable
Wgdi32.dll 5.2.3790.2811 285,184 12-Oct-2006 00:45 x86 SP1 WOW

Back to the top

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Back to the top

MORE INFORMATION
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
824684 (http://kbalertz.com/Feedback.aspx?kbNumber=824684/) Description of the standard terminology that is used to describe Microsoft software updates
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
For a while now I'v been searching for a circular progress control, much like the one you get when first starting your Silverlight application. I found a couple that were written in WPF and there were a few written in Silverlight, but all appeared o…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now