Solved

Server 2008 Random Reboot

Posted on 2011-02-22
3
916 Views
Last Modified: 2012-05-11
Server 2008 SBS (virtual) is randomly rebooting.  We have tested the memory by selectively removing 1 DIM at a time.  It does not appear to be the memory.

Posted is the minidump which we cannot read very well.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini022211-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 6001.18538.amd64fre.vistasp1_gdr.101014-0432
Machine Name:
Kernel base = 0xfffff800`01a0a000 PsLoadedModuleList = 0xfffff800`01bcfdb0
Debug session time: Tue Feb 22 03:47:12.701 2011 (UTC - 5:00)
System Uptime: 0 days 13:23:02.250
Loading Kernel Symbols
...............................................................
Loading User Symbols
Loading unloaded module list
*******************************************************************************
*                        Bugcheck Analysis                                    *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 1, fffffa80060cb67a}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+20b )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                        Bugcheck Analysis                                    *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffffa80060cb67a, address which referenced memory

Debugging Details:
------------------
OVERLAPPED_MODULE: Address regions for 'Dxapi' and 'crashdmp.sys' overlap

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001c33080
 0000000000000000

CURRENT_IRQL:  2

FAULTING_IP:
+3365643139363532
fffffa80`060cb67a ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80002b6e3d0 -- (.trap 0xfffff80002b6e3d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000202
rdx=0000000008000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa80060cb67a rsp=fffff80002b6e560 rbp=fffff80002b6e600
 r8=000000000000082f  r9=000000000000000c r10=0000000000000000
r11=fffff80001c33640 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
fffffa80`060cb67a ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001a5f1ae to fffff80001a5f410

STACK_TEXT:  
fffff800`02b6e288 fffff800`01a5f1ae : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`02b6e290 fffff800`01a5e08b : 00000000`00000001 00000000`00000000 fffff800`02b6dc00 fffffa80`060ca074 : nt!KiBugCheckDispatch+0x6e
fffff800`02b6e3d0 fffffa80`060cb67a : 00000000`000069d4 fffff800`01b56894 00000000`00000002 00000000`000069ee : nt!KiPageFault+0x20b
fffff800`02b6e560 00000000`000069d4 : fffff800`01b56894 00000000`00000002 00000000`000069ee fffff800`02b71c30 : 0xfffffa80`060cb67a
fffff800`02b6e568 fffff800`01b56894 : 00000000`00000002 00000000`000069ee fffff800`02b71c30 fffff800`01a585fc : 0x69d4
fffff800`02b6e570 00000000`00000002 : 00000000`000069ee fffff800`02b71c30 fffff800`01a585fc fffff800`01b568bc : nt!_imp_NtOpenSymbolicLinkObject+0x5c7c
fffff800`02b6e578 00000000`000069ee : fffff800`02b71c30 fffff800`01a585fc fffff800`01b568bc fffff800`01a10a37 : 0x2
fffff800`02b6e580 fffff800`02b71c30 : fffff800`01a585fc fffff800`01b568bc fffff800`01a10a37 fffff800`02b6dfe0 : 0x69ee
fffff800`02b6e588 fffff800`01a585fc : fffff800`01b568bc fffff800`01a10a37 fffff800`02b6dfe0 00000000`00000000 : 0xfffff800`02b71c30
fffff800`02b6e590 fffff800`01aa8227 : 00000202`00180000 00000000`00000000 00000000`00000000 fffff800`02b6f3b0 : nt!local_unwind+0x1c
fffff800`02b6ea70 fffff800`01a728ac : 00000202`0018f058 ffffffff`c0000005 fffff800`02b6f058 00000000`00000000 : nt!ExpTimeRefreshDpcRoutine+0x174
fffff800`02b6eaa0 fffff800`01a7275d : fffff800`02b71c30 fffff800`02b71c30 fffff800`02b71c30 00000000`00000002 : nt!_C_specific_handler+0x140
fffff800`02b6eb10 ffffffff`c0000005 : fffff800`00000000 fffff800`02b70300 fffff800`02b71ad8 fffff800`02b71a70 : nt!RtlpExecuteHandlerForUnwind+0xd
fffff800`02b6eb40 fffff800`00000000 : fffff800`02b70300 fffff800`02b71ad8 fffff800`02b71a70 00000000`00000000 : 0xffffffff`c0000005
fffff800`02b6eb48 fffff800`02b70300 : fffff800`02b71ad8 fffff800`02b71a70 00000000`00000000 00000000`00000002 : 0xfffff800`00000000
fffff800`02b6eb50 fffff800`02b71ad8 : fffff800`02b71a70 00000000`00000000 00000000`00000002 fffffa80`05a0a900 : 0xfffff800`02b70300
fffff800`02b6eb58 fffff800`02b71a70 : 00000000`00000000 00000000`00000002 fffffa80`05a0a900 00000000`00000000 : 0xfffff800`02b71ad8
fffff800`02b6eb60 00000000`00000000 : 00000000`00000002 fffffa80`05a0a900 00000000`00000000 fffff800`02b71c30 : 0xfffff800`02b71a70


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!KiPageFault+20b
fffff800`01a5e08b 488d058e320000  lea     rax,[nt!RtlInterlockedPopEntrySList (fffff800`01a61320)]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+20b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4cb71b96

FAILURE_BUCKET_ID:  X64_0xD1_nt!KiPageFault+20b

BUCKET_ID:  X64_0xD1_nt!KiPageFault+20b

Followup: MachineOwner
---------


0
Comment
Question by:ButlerTechnology
  • 2
3 Comments
 
LVL 6

Author Comment

by:ButlerTechnology
ID: 34956524
Thanks for your help!
0
 
LVL 11

Accepted Solution

by:
Patmac951 earned 500 total points
ID: 34956629
This is definitely a hardware error of some sort.  If you have determined it is not the memory, I would suggest moving the system Page file to another hard drive if possible.  This error indicates it is trying to access the hard drive Pageable memory but it is unable to read it.  

I have successfully fixed this problem by running c:\chkdsk /f      on the drive where the paging file is located.  Then if necessary actually moving the page file to another drive.

I have also seen this same problem occur with a bad hardware driver.  It could be the Video, Sound or even hard disk controller drivers.  If moving the page file does not work...I would suggest updating all of the hardware drivers for all of your peripheral devices.
0
 
LVL 6

Author Closing Comment

by:ButlerTechnology
ID: 35039699
Drivers were the answer.  The physical driver updates had not been passed into the virtual machines.  Once we did that the crashing stopped.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Usually shares are where we want them for our users and we tend to take them for granted. There are times, however, when those shares may disappear causing difficulty for your users. One of the first things to try is searching for files that shou…
Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now