Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

help interpreting windbg memory dump log

Posted on 2008-10-16
3
Medium Priority
?
1,437 Views
Last Modified: 2013-12-04
windows server 2003 sp2 received memory dump error 0x0000020 (0x00000000,0x00000fff1 ran windbg diagnostics.  Was unable to interpert logs.  windbg log attached.
Microsoft (R) Windows Debugger  Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [C:\WINDOWS\Minidump\Mini101408-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
 
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Oct 14 17:18:00.625 2008 (GMT-4)
System Uptime: 2 days 4:39:32.390
Loading Kernel Symbols
............................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck 20, {0, fff1, 0, 1}
 
Probably caused by : ntkrpamp.exe ( nt!PspExitThread+64c )
 
Followup: MachineOwner
---------
 
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
KERNEL_APC_PENDING_DURING_EXIT (20)
The key data item is the thread's APC disable count.
If this is non-zero, then this is the source of the problem.
The APC disable count is decremented each time a driver calls
KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem.  The APC
disable count is incremented each time a driver calls KeLeaveCriticalRegion,
KeReleaseMutex, or FsRtlExitFileSystem.  Since these calls should always be in
pairs, this value should be zero when a thread exits.  A negative value
indicates that a driver has disabled APC calls without re-enabling them.  A
positive value indicates that the reverse is true.
If you ever see this error, be very suspicious of all drivers installed on the
machine -- especially unusual or non-standard drivers.  Third party file
system redirectors are especially suspicious since they do not generally
receive the heavy duty testing that NTFS, FAT, RDR, etc receive.
This current IRQL should also be 0.  If it is not, that a driver's
cancelation routine can cause this bugcheck by returning at an elevated
IRQL.  Always attempt to note what you were doing/closing at the
time of the crash, and note all of the installed drivers at the time of
the crash.  This symptom is usually a severe bug in a third party
driver.
Arguments:
Arg1: 00000000, The address of the APC found pending during exit.
Arg2: 0000fff1, The thread's APC disable count
Arg3: 00000000, The current IRQL
Arg4: 00000001
 
Debugging Details:
------------------
 
 
BUGCHECK_STR:  0x20_NULLAPC_KAPC_NEGATIVE
 
CUSTOMER_CRASH_COUNT:  1
 
DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP
 
PROCESS_NAME:  winlogon.exe
 
CURRENT_IRQL:  0
 
LAST_CONTROL_TRANSFER:  from 8094c546 to 80827c63
 
STACK_TEXT:  
b8096c80 8094c546 00000020 00000000 0000fff1 nt!KeBugCheckEx+0x1b
b8096d18 8094c63f 00000000 00000000 88dc2578 nt!PspExitThread+0x64c
b8096d30 8094c991 88dc2578 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b
b8096d54 8088978c 00000000 00000000 00f1ffb8 nt!NtTerminateThread+0x71
b8096d54 7c8285ec 00000000 00000000 00f1ffb8 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f1ffb8 00000000 00000000 00000000 00000000 0x7c8285ec
 
 
STACK_COMMAND:  kb
 
FOLLOWUP_IP: 
nt!PspExitThread+64c
8094c546 cc              int     3
 
SYMBOL_STACK_INDEX:  1
 
SYMBOL_NAME:  nt!PspExitThread+64c
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: nt
 
IMAGE_NAME:  ntkrpamp.exe
 
DEBUG_FLR_IMAGE_TIMESTAMP:  45ec0a19
 
FAILURE_BUCKET_ID:  0x20_NULLAPC_KAPC_NEGATIVE_nt!PspExitThread+64c
 
BUCKET_ID:  0x20_NULLAPC_KAPC_NEGATIVE_nt!PspExitThread+64c
 
Followup: MachineOwner
---------

Open in new window

bsod.doc
0
Comment
Question by:mmsppm
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 5

Expert Comment

by:thechaosrealm
ID: 22732691
Did an event show up in the Windows Event Log? What is the Event ID?
0
 

Author Comment

by:mmsppm
ID: 22733741
Event ID 1003
0
 
LVL 1

Accepted Solution

by:
simadownnow earned 1500 total points
ID: 22758626
Stop error message on a Windows Server 2003-based computer: "Stop 0x00000020"
View products that this article applies to.
Article ID : 920911
Last Review : October 11, 2007
Revision : 2.4
On This Page
SYMPTOMS
On a Microsoft Windows Server 2003-based computer, you receive the following Stop error message:
Stop 0x00000020 (0x00000000, 0x0000fffc, 0x00000000, 0x00000001)
KERNEL_APC_PENDING_DURING_EXIT
Note The four parameters in the error message vary.

Additionally, the computer restarts automatically. After this problem occurs, an event that resembles the following is logged in the System log:
Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: Date
Time: Time
User: N/A
Computer: Computer
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000020 (0x00000000, 0x0000fffc, 0x00000000, 0x00000001). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

Back to the top

CAUSE
This problem occurs because the Win32k.sys module incorrectly manages font objects. This causes an asynchronous procedure call (APC) leak. When the system detects an APC leak, the system reports the Stop error that is described in the "Symptoms" section.
Back to the top

RESOLUTION
Service pack information
To resolve this problem, install the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 (http://kbalertz.com/Feedback.aspx?kbNumber=889100/) How to obtain the latest service pack for Windows Server 2003
Back to the top

Hotfix information
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
Prerequisites
To apply this hotfix, you must have Windows Server 2003 Service Pack 1 installed on the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 (http://kbalertz.com/Feedback.aspx?kbNumber=889100/) How to obtain the latest service pack for Windows Server 2003
Restart requirement
You must restart the computer after you apply this hotfix.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Windows Server 2003 with Service Pack 1, x86-based versions
File name File version File size Date Time Platform SP requirement
Gdi32.dll 5.2.3790.2811 282,112 12-Oct-2006 14:57 x86 SP1
Win32k.sys 5.2.3790.2811 1,851,392 12-Oct-2006 13:11 x86 SP1

Windows Server 2003 with Service Pack 1, Itanium-based versions
File name File version File size Date Time Platform SP requirement Service branch
Gdi32.dll 5.2.3790.2811 906,240 12-Oct-2006 00:46 IA-64 SP1 Not Applicable
Win32k.sys 5.2.3790.2811 5,546,496 12-Oct-2006 00:46 IA-64 SP1 Not Applicable
Wgdi32.dll 5.2.3790.2811 285,184 12-Oct-2006 00:46 x86 SP1 WOW

Windows Server 2003, x64-based versions
File name File version File size Date Time Platform SP requirement Service branch
Gdi32.dll 5.2.3790.2811 610,304 12-Oct-2006 00:45 x64 SP1 Not Applicable
Win32k.sys 5.2.3790.2811 4,529,664 12-Oct-2006 00:45 x64 SP1 Not Applicable
Wgdi32.dll 5.2.3790.2811 285,184 12-Oct-2006 00:45 x86 SP1 WOW

Back to the top

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Back to the top

MORE INFORMATION
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
824684 (http://kbalertz.com/Feedback.aspx?kbNumber=824684/) Description of the standard terminology that is used to describe Microsoft software updates
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As more and more people are shifting to the latest .Net frameworks, the windows presentation framework is gaining importance by the day. Many people are now turning to WPF controls to provide a rich user experience. I have been using WPF controls fo…
Entering time in Microsoft Access can be difficult. An input mask often bothers users more than helping them and won't catch all typing errors. This article shows how to create a textbox for 24-hour time input with full validation politely catching …
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
Suggested Courses

604 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question