• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3424
  • Last Modified:

Vmware sb server 2008 bsod

I have a Dell server with ESXi 4.1 embedded installed. The only vm running is sbs2008 with exchange server. The problem I am having is a random blue screen that can happen several times a day. I have updated ESXi to the latest build. I have checked the memory. No hardware has been added. The server is only being used for email. What could it be and how can I narrow it the problem down?

  • 6
  • 6
1 Solution
You might provide a bit more information on what the BSOD error codes are...

That might help us narrow down the issue
JohnBranAuthor Commented:
The failure detail in the performance monitor list : 0x000000d1 (0x0000000000000000,0x0000000000000002, 0x000000000
That is usually associated with a driver. Was this vm a P2V conversion or did you build it as a vm?

Often there is a particular driver indicated in the error screen - what driver is it?

If this was a P2V take a look at my fellow expert BestWay's article on P2V of Windows servers: http://www.experts-exchange.com/Software/VMWare/A_3639-VMware-vConverter-P2V-for-Windows-Servers.html

He covers a lot of the issues that come up, in particular not removing vendor specific software and specialized device drivers (like RAID drivers). Read the article and see if anything jumps out at you.

Good Luck
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

JohnBranAuthor Commented:
It was configured as a vm by Dell. The problem is it is a headless system. I never see the blue screen. The only clue to the blue screen is the users getting kicked off outlook. I then have to look at the performance monitor to know it happened. The performance monitor doesn't list a driver.
Are the VMware tools installed and up to date? The tools package provides updated drivers for some of the virtual hardware. Is there anything in the event logs around the time of the error that may be indicative of the cause? Can you uninstall whatever it was that was installed just prior to the error occurring?

Check this link for other troubleshooting tips: http://www.faultwire.com/solutions-fatal_error/DRIVER-IRQL-NOT-LESS-OR-EQUAL-0x000000D1-*1210.html
JohnBranAuthor Commented:
Vmware update was my first try.  Here is my minidump results:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini030811-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at start of path element
WARNING: Whitespace at end of path element
Symbol search path is: C:\Windows\symbols; http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) UP Free x64
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 6002.18267.amd64fre.vistasp2_gdr.100608-0458
Machine Name:
Kernel base = 0xfffff800`01819000 PsLoadedModuleList = 0xfffff800`019dddd0
Debug session time: Tue Mar  8 06:14:00.303 2011 (UTC - 5:00)
System Uptime: 1 days 16:33:16.381
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffffa600107d3b4}

Probably caused by : NETIO.SYS ( NETIO!NetioDereferenceNetBufferList+78 )

Followup: MachineOwner

kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffffa600107d3b4, address which referenced memory

Debugging Details:

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a40080


tcpip! ?? ::FNODOBFM::`string'+5824
fffffa60`0107d3b4 488b01          mov     rax,qword ptr [rcx]





TRAP_FRAME:  fffff80002b41550 -- (.trap 0xfffff80002b41550)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8006481f40 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8006481f41 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa600107d3b4 rsp=fffff80002b416e0 rbp=fffffa8004969030
 r8=fffffa8006481f40  r9=00000000006ee330 r10=fffff8000198d580
r11=fffffa80048fe940 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
tcpip! ?? ::FNODOBFM::`string'+0x5824:
fffffa60`0107d3b4 488b01          mov     rax,qword ptr [rcx] ds:01a0:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000187326e to fffff800018734d0

fffff800`02b41408 fffff800`0187326e : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`02b41410 fffff800`0187214b : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`04969030 : nt!KiBugCheckDispatch+0x6e
fffff800`02b41550 fffffa60`0107d3b4 : fffffa80`04972010 fffffa80`04953e40 ffffd399`2f6bb422 fffffa80`206c644d : nt!KiPageFault+0x20b
fffff800`02b416e0 fffffa60`00a08f18 : fffffa80`04969030 00000000`019aa8f8 00000000`00000000 fffffa80`04a98880 : tcpip! ?? ::FNODOBFM::`string'+0x5824
fffff800`02b41730 fffffa60`00a06a3d : fffffa80`06335aa0 00000000`00000000 fffffa80`06428bb0 00000000`00000002 : NETIO!NetioDereferenceNetBufferList+0x78
fffff800`02b41760 fffffa60`01038d96 : fffff800`02b418f8 fffffa80`05131e00 00000000`00000000 00000000`00000001 : NETIO!NetioDereferenceNetBufferListChain+0x28d
fffff800`02b41820 fffffa60`01023824 : fffffa80`06428bb0 fffffa80`06098590 fffffa80`040f8010 fffffa80`041015b0 : tcpip!IppCompleteAndFreePacketList+0xb6
fffff800`02b41850 fffffa60`0102bc70 : 00000000`00000000 fffffa80`040f8010 fffffa80`041015b0 fffffa60`01141050 : tcpip!IppCleanupMfe+0x44
fffff800`02b41880 fffffa60`010712bd : fffffa80`041015b0 fffffa60`01145558 fffff800`02b41928 fffffa80`040f8010 : tcpip!IppDereferenceMfe+0x20
fffff800`02b418b0 fffffa60`0107113a : fffff800`02b41ad8 00000000`00000000 fffffa80`040f8028 fffff800`02b41ad8 : tcpip!IppMfeSetTimeOut+0x10d
fffff800`02b419d0 fffffa60`010713ea : fffffa60`01150b00 fffff800`02b41ad8 00000000`00000000 00000000`00000001 : tcpip!IppCompartmentSetTimeout+0x9a
fffff800`02b41a40 fffff800`018773fd : fffff800`0198c680 fffff800`0198cf80 fffff800`0198ccf0 00000000`00000001 : tcpip!IppTimeout+0x5a
fffff800`02b41a70 fffff800`018768d5 : fffff800`02b41cd0 fffffa60`00fb7702 fffff800`02b41cc8 00000000`00000001 : nt!KiTimerListExpire+0x30d
fffff800`02b41ca0 fffff800`01876faf : 00013de1`27f9ae0b 00000000`00000000 00000000`00000001 fffff800`0198fa80 : nt!KiTimerExpiration+0x295
fffff800`02b41d10 fffff800`018778d2 : fffff800`0198c680 fffff800`0198c680 00000000`00000000 fffff800`01991b80 : nt!KiRetireDpcList+0x1df
fffff800`02b41d80 fffff800`01a44860 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x62
fffff800`02b41db0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!zzz_AsmCodeRange_End+0x4


fffffa60`00a08f18 4885ff          test    rdi,rdi


SYMBOL_NAME:  NETIO!NetioDereferenceNetBufferList+78

FOLLOWUP_NAME:  MachineOwner




FAILURE_BUCKET_ID:  X64_0xD1_NETIO!NetioDereferenceNetBufferList+78

BUCKET_ID:  X64_0xD1_NETIO!NetioDereferenceNetBufferList+78

Followup: MachineOwner
It certainly is looking like a network card driver issue. At this point I would try to change the nic type. I suspect you have either a "flexible" or "E1000" type of network card -- and I recommend that you change this to a "VMXNET3" type. To do this:

1. If you have a static IP address, make note of it and change it to DHCP (to avoid dup ip message later)
2. Shutdown the vm
3. Go into "Edit Settings" on the vm and remove the current nic
4. Add a new nic of type VMXNET3
5. Boot up the machine
6. If the new nic is not recognized reinstall (or repair) vmware tools installation to pick up the driver
7. Reconfigure static IP address, gateway, mask, dns, etc.

This will provide you with the optimum networking for the ESX environment, as well as a driver optimized for virtualization

Good Luck
JohnBranAuthor Commented:
The VMXNET3 drivers are not there. The vmware tools are not installed on the guest OS.
I am having problems installing them.  Under events in vsphere it says:" Install vmware tools package inside this virtual machine. After the guest os starts, select vm > install vmware tools."  The problem is vsphere does not place the vm tools setup in the guest os.  I've checked every where.  It also does not create a virtual ISO in the drive to load them.  Do you know whats going on?
You do have to install the tools to get driver support for VMXNET3 - and actually to most efficiently run any vm you should have the tools package installed on the vm.

You need to have a CD drive defined in the guest OS. When you select Install/Upgrade VMware Tools it will normally mount the iso with the tools package on the virtual CD, then autoplay takes over to give you the option to install.

Refer to http://kb.vmware.com/kb/340 for some troubleshooting tips on installing tools. I believe that article also provides links to OSP (operating specific packages) as well as downloadable tools packages if you are not seeing them on the virtual CD.
JohnBranAuthor Commented:
Hey thanks for all your help.  I was able to get the tools and driver installed. The problem was I always used the consoul tab instead of an external window. The vm menu won't show up in the tab.  Hopefully the blue screens will stop now. I noticed the bsods started the day after blackberry server software was installed. Do you think it could be related?
I wouldn't expect that to make a difference - I am successfully running BES for Lotus Notes in a vm.

About the only issue I am aware of for BES is on Windows 2008 R2 where after a reboot, you log on again and get the shutdown event tracker when you log on (even when you did a normal reboot).

This thread discusses the issue and a workaround for it if you are interested: http://www.experts-exchange.com/Software/VMWare/Q_26803223.html#34832532
JohnBranAuthor Commented:
bgoering was a great help.  I would not have been able to fix the issue with out their knowledge.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

  • 6
  • 6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now