Solved

Vmware sb server 2008 bsod

Posted on 2011-03-08
12
2,809 Views
Last Modified: 2012-05-11
Hello,
I have a Dell server with ESXi 4.1 embedded installed. The only vm running is sbs2008 with exchange server. The problem I am having is a random blue screen that can happen several times a day. I have updated ESXi to the latest build. I have checked the memory. No hardware has been added. The server is only being used for email. What could it be and how can I narrow it the problem down?

Thanks
0
Comment
Question by:JohnBran
  • 6
  • 6
12 Comments
 
LVL 28

Expert Comment

by:bgoering
ID: 35076768
You might provide a bit more information on what the BSOD error codes are...

That might help us narrow down the issue
0
 

Author Comment

by:JohnBran
ID: 35076907
The failure detail in the performance monitor list : 0x000000d1 (0x0000000000000000,0x0000000000000002, 0x000000000
0
 
LVL 28

Expert Comment

by:bgoering
ID: 35077327
That is usually associated with a driver. Was this vm a P2V conversion or did you build it as a vm?

Often there is a particular driver indicated in the error screen - what driver is it?

If this was a P2V take a look at my fellow expert BestWay's article on P2V of Windows servers: http://www.experts-exchange.com/Software/VMWare/A_3639-VMware-vConverter-P2V-for-Windows-Servers.html

He covers a lot of the issues that come up, in particular not removing vendor specific software and specialized device drivers (like RAID drivers). Read the article and see if anything jumps out at you.

Good Luck
0
 

Author Comment

by:JohnBran
ID: 35078028
It was configured as a vm by Dell. The problem is it is a headless system. I never see the blue screen. The only clue to the blue screen is the users getting kicked off outlook. I then have to look at the performance monitor to know it happened. The performance monitor doesn't list a driver.
0
 
LVL 28

Expert Comment

by:bgoering
ID: 35082425
Are the VMware tools installed and up to date? The tools package provides updated drivers for some of the virtual hardware. Is there anything in the event logs around the time of the error that may be indicative of the cause? Can you uninstall whatever it was that was installed just prior to the error occurring?

Check this link for other troubleshooting tips: http://www.faultwire.com/solutions-fatal_error/DRIVER-IRQL-NOT-LESS-OR-EQUAL-0x000000D1-*1210.html
0
 

Author Comment

by:JohnBran
ID: 35083089
Vmware update was my first try.  Here is my minidump results:




Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini030811-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at start of path element
WARNING: Whitespace at end of path element
Symbol search path is: C:\Windows\symbols; http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) UP Free x64
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 6002.18267.amd64fre.vistasp2_gdr.100608-0458
Machine Name:
Kernel base = 0xfffff800`01819000 PsLoadedModuleList = 0xfffff800`019dddd0
Debug session time: Tue Mar  8 06:14:00.303 2011 (UTC - 5:00)
System Uptime: 1 days 16:33:16.381
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffffa600107d3b4}

Probably caused by : NETIO.SYS ( NETIO!NetioDereferenceNetBufferList+78 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffffa600107d3b4, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a40080
 0000000000000000

CURRENT_IRQL:  2

FAULTING_IP:
tcpip! ?? ::FNODOBFM::`string'+5824
fffffa60`0107d3b4 488b01          mov     rax,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80002b41550 -- (.trap 0xfffff80002b41550)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8006481f40 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8006481f41 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa600107d3b4 rsp=fffff80002b416e0 rbp=fffffa8004969030
 r8=fffffa8006481f40  r9=00000000006ee330 r10=fffff8000198d580
r11=fffffa80048fe940 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
tcpip! ?? ::FNODOBFM::`string'+0x5824:
fffffa60`0107d3b4 488b01          mov     rax,qword ptr [rcx] ds:01a0:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000187326e to fffff800018734d0

STACK_TEXT:  
fffff800`02b41408 fffff800`0187326e : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`02b41410 fffff800`0187214b : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`04969030 : nt!KiBugCheckDispatch+0x6e
fffff800`02b41550 fffffa60`0107d3b4 : fffffa80`04972010 fffffa80`04953e40 ffffd399`2f6bb422 fffffa80`206c644d : nt!KiPageFault+0x20b
fffff800`02b416e0 fffffa60`00a08f18 : fffffa80`04969030 00000000`019aa8f8 00000000`00000000 fffffa80`04a98880 : tcpip! ?? ::FNODOBFM::`string'+0x5824
fffff800`02b41730 fffffa60`00a06a3d : fffffa80`06335aa0 00000000`00000000 fffffa80`06428bb0 00000000`00000002 : NETIO!NetioDereferenceNetBufferList+0x78
fffff800`02b41760 fffffa60`01038d96 : fffff800`02b418f8 fffffa80`05131e00 00000000`00000000 00000000`00000001 : NETIO!NetioDereferenceNetBufferListChain+0x28d
fffff800`02b41820 fffffa60`01023824 : fffffa80`06428bb0 fffffa80`06098590 fffffa80`040f8010 fffffa80`041015b0 : tcpip!IppCompleteAndFreePacketList+0xb6
fffff800`02b41850 fffffa60`0102bc70 : 00000000`00000000 fffffa80`040f8010 fffffa80`041015b0 fffffa60`01141050 : tcpip!IppCleanupMfe+0x44
fffff800`02b41880 fffffa60`010712bd : fffffa80`041015b0 fffffa60`01145558 fffff800`02b41928 fffffa80`040f8010 : tcpip!IppDereferenceMfe+0x20
fffff800`02b418b0 fffffa60`0107113a : fffff800`02b41ad8 00000000`00000000 fffffa80`040f8028 fffff800`02b41ad8 : tcpip!IppMfeSetTimeOut+0x10d
fffff800`02b419d0 fffffa60`010713ea : fffffa60`01150b00 fffff800`02b41ad8 00000000`00000000 00000000`00000001 : tcpip!IppCompartmentSetTimeout+0x9a
fffff800`02b41a40 fffff800`018773fd : fffff800`0198c680 fffff800`0198cf80 fffff800`0198ccf0 00000000`00000001 : tcpip!IppTimeout+0x5a
fffff800`02b41a70 fffff800`018768d5 : fffff800`02b41cd0 fffffa60`00fb7702 fffff800`02b41cc8 00000000`00000001 : nt!KiTimerListExpire+0x30d
fffff800`02b41ca0 fffff800`01876faf : 00013de1`27f9ae0b 00000000`00000000 00000000`00000001 fffff800`0198fa80 : nt!KiTimerExpiration+0x295
fffff800`02b41d10 fffff800`018778d2 : fffff800`0198c680 fffff800`0198c680 00000000`00000000 fffff800`01991b80 : nt!KiRetireDpcList+0x1df
fffff800`02b41d80 fffff800`01a44860 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x62
fffff800`02b41db0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!zzz_AsmCodeRange_End+0x4


STACK_COMMAND:  kb

FOLLOWUP_IP:
NETIO!NetioDereferenceNetBufferList+78
fffffa60`00a08f18 4885ff          test    rdi,rdi

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  NETIO!NetioDereferenceNetBufferList+78

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  49e02e06

FAILURE_BUCKET_ID:  X64_0xD1_NETIO!NetioDereferenceNetBufferList+78

BUCKET_ID:  X64_0xD1_NETIO!NetioDereferenceNetBufferList+78

Followup: MachineOwner
---------
0
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

 
LVL 28

Accepted Solution

by:
bgoering earned 500 total points
ID: 35083646
It certainly is looking like a network card driver issue. At this point I would try to change the nic type. I suspect you have either a "flexible" or "E1000" type of network card -- and I recommend that you change this to a "VMXNET3" type. To do this:

1. If you have a static IP address, make note of it and change it to DHCP (to avoid dup ip message later)
2. Shutdown the vm
3. Go into "Edit Settings" on the vm and remove the current nic
4. Add a new nic of type VMXNET3
5. Boot up the machine
6. If the new nic is not recognized reinstall (or repair) vmware tools installation to pick up the driver
7. Reconfigure static IP address, gateway, mask, dns, etc.

This will provide you with the optimum networking for the ESX environment, as well as a driver optimized for virtualization

Good Luck
0
 

Author Comment

by:JohnBran
ID: 35100832
The VMXNET3 drivers are not there. The vmware tools are not installed on the guest OS.
I am having problems installing them.  Under events in vsphere it says:" Install vmware tools package inside this virtual machine. After the guest os starts, select vm > install vmware tools."  The problem is vsphere does not place the vm tools setup in the guest os.  I've checked every where.  It also does not create a virtual ISO in the drive to load them.  Do you know whats going on?
0
 
LVL 28

Expert Comment

by:bgoering
ID: 35112666
You do have to install the tools to get driver support for VMXNET3 - and actually to most efficiently run any vm you should have the tools package installed on the vm.

You need to have a CD drive defined in the guest OS. When you select Install/Upgrade VMware Tools it will normally mount the iso with the tools package on the virtual CD, then autoplay takes over to give you the option to install.

Refer to http://kb.vmware.com/kb/340 for some troubleshooting tips on installing tools. I believe that article also provides links to OSP (operating specific packages) as well as downloadable tools packages if you are not seeing them on the virtual CD.
0
 

Author Comment

by:JohnBran
ID: 35113885
Hey thanks for all your help.  I was able to get the tools and driver installed. The problem was I always used the consoul tab instead of an external window. The vm menu won't show up in the tab.  Hopefully the blue screens will stop now. I noticed the bsods started the day after blackberry server software was installed. Do you think it could be related?
0
 
LVL 28

Expert Comment

by:bgoering
ID: 35114212
I wouldn't expect that to make a difference - I am successfully running BES for Lotus Notes in a vm.

About the only issue I am aware of for BES is on Windows 2008 R2 where after a reboot, you log on again and get the shutdown event tracker when you log on (even when you did a normal reboot).

This thread discusses the issue and a workaround for it if you are interested: http://www.experts-exchange.com/Software/VMWare/Q_26803223.html#34832532
0
 

Author Closing Comment

by:JohnBran
ID: 35140703
bgoering was a great help.  I would not have been able to fix the issue with out their knowledge.

Thanks
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

In this article, I will show you HOW TO: Install VMware Tools for Windows on a VMware Windows virtual machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, using the VMware Host Client. The virtual machine has Windows Server 2016 instal…
In this article, I will show you HOW TO: Perform a Physical to Virtual (P2V) Conversion the easy way from a computer backup (image).
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now