Event ID 6008
Hello All,
One of our servers (Archive server) is crushing while running some applications.
Its crushing while moving large files (15Gb) or running a backup through the Tape device. (HP LTO-4).
the servers has only 1 PSU (HEC 1200W) and 8 H.D (2T each) that are connected to a raid card (Adaptec) we are running raid 6
and also 2 hard drives that are connected to the mother board (Asus). also in a raid 0 mode
If we are not running the tape device or moving large files, nothing happens.
in the event viewer we cant find any reference to the crash, only event id 6008.
Your help will be appreciated
Gilad.
One of our servers (Archive server) is crushing while running some applications.
Its crushing while moving large files (15Gb) or running a backup through the Tape device. (HP LTO-4).
the servers has only 1 PSU (HEC 1200W) and 8 H.D (2T each) that are connected to a raid card (Adaptec) we are running raid 6
and also 2 hard drives that are connected to the mother board (Asus). also in a raid 0 mode
If we are not running the tape device or moving large files, nothing happens.
in the event viewer we cant find any reference to the crash, only event id 6008.
Your help will be appreciated
Gilad.
Last Comment
ASKER CERTIFIED SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
- also It seems you have HP kit? is this a proliant?
If so Install the Insight management tools (if not already installed (you can download the latest Proliant Support pack from HP to get it)
log into insight manager and see what the logs tell you
- if you have already installed the HP tool check for the existence af the HP shut-down service and make sure this isn't the culprit
Good luck
Pete
If so Install the Insight management tools (if not already installed (you can download the latest Proliant Support pack from HP to get it)
log into insight manager and see what the logs tell you
- if you have already installed the HP tool check for the existence af the HP shut-down service and make sure this isn't the culprit
Good luck
Pete
ASKER
Hi,
this is what i get from the dmp file:
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
MODULE_NAME: Ntfs
FAULTING_MODULE: 80800000 nt
DEBUG_FLR_IMAGE_TIMESTAMP:
EXCEPTION_RECORD: ba6e052c -- (.exr 0xffffffffba6e052c)
ExceptionAddress: f728dbfe (Ntfs+0x00050bfe)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 0035019b
Attempt to read from address 0035019b
CONTEXT: ba6e0228 -- (.cxr 0xffffffffba6e0228)
eax=e33bef28 ebx=ba6e0758 ecx=000000be edx=00350033 esi=ba6e0804 edi=89e2f100
eip=f728dbfe esp=ba6e05f4 ebp=ba6e0604 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
Ntfs+0x50bfe:
f728dbfe 668b8268010000 mov ax,word ptr [edx+168h] ds:0023:0035019b=????
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x24
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from f7281c48 to f728dbfe
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
ba6e0604 f7281c48 e20373f8 e33bef28 ba6e0758 Ntfs+0x50bfe
ba6e0638 f72847ce 894b6530 89e2f808 e20373f8 Ntfs+0x44c48
ba6e0788 f7284ef8 894b6530 887d3880 ba6e07c8 Ntfs+0x477ce
ba6e088c 80840153 89e2f020 887d3880 8a70ad10 Ntfs+0x47ef8
ba6e08a0 f730a458 8883e930 8a70ad10 8a48bc18 nt!IofCallDriver+0x38
ba6e08cc 80840153 8a489e18 887d3880 887d3880 fltmgr!FltProcessFileLock+
ba6e08e0 8092e7fe 89dbe830 8888f6c0 00000000 nt!IofCallDriver+0x38
ba6e09c8 8093aa80 8a489e18 00000000 8a189508 nt!NtSetInformationFile+0x
ba6e0a00 8092c0be 89dbe830 00000000 8a189508 nt!NtOpenProcessToken+0x21
ba6e0a80 8092d78d 80001c88 ba6e0ac0 00000040 nt!ObAssignSecurity+0x494
ba6e0ad4 8092c64d 00000000 00000000 d0b40000 nt!ObOpenObjectByName+0xda
ba6e0b50 80931d12 ba6e0cd8 00000080 ba6e0ca8 nt!RtlEqualUnicodeString+0
ba6e0bac ba51c42f ba6e0cd8 00000080 ba6e0ca8 nt!IoCreateFile+0x51
ba6e0c1c ba51b835 89ce9b40 ba6e0cd8 00000080 srv+0x2442f
ba6e0cec ba51d5bb 89ce9b40 89ce9b40 80838a2d srv+0x23835
ba6e0d78 ba4fae87 89ce9b48 89da4020 ba5136c7 srv+0x255bb
ba6e0dac 8092083b 00da4020 00000000 00000000 srv+0x2e87
ba6e0ddc 8083fe9f ba513602 89da4020 00000000 nt!NtConnectPort+0x557
00000000 00000000 00000000 00000000 00000000 nt!KeQueryInterruptTime+0x
FOLLOWUP_IP:
Ntfs+50bfe
f728dbfe 668b8268010000 mov ax,word ptr [edx+168h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs+50bfe
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: Ntfs.sys
STACK_COMMAND: .cxr 0xffffffffba6e0228 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
0: kd> lmvm Ntfs
start end module name
f723d000 f72d2000 Ntfs (no symbols)
Loaded symbol image file: Ntfs.sys
Image path: Ntfs.sys
Image name: Ntfs.sys
Timestamp: Sat Feb 17 08:27:23 2007 (45D6A04B)
CheckSum: 00097DDD
ImageSize: 00095000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> .exr 0xffffffffba6e052c
ExceptionAddress: f728dbfe (Ntfs+0x00050bfe)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 0035019b
Attempt to read from address 0035019b
this is what i get from the dmp file:
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
MODULE_NAME: Ntfs
FAULTING_MODULE: 80800000 nt
DEBUG_FLR_IMAGE_TIMESTAMP:
EXCEPTION_RECORD: ba6e052c -- (.exr 0xffffffffba6e052c)
ExceptionAddress: f728dbfe (Ntfs+0x00050bfe)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 0035019b
Attempt to read from address 0035019b
CONTEXT: ba6e0228 -- (.cxr 0xffffffffba6e0228)
eax=e33bef28 ebx=ba6e0758 ecx=000000be edx=00350033 esi=ba6e0804 edi=89e2f100
eip=f728dbfe esp=ba6e05f4 ebp=ba6e0604 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
Ntfs+0x50bfe:
f728dbfe 668b8268010000 mov ax,word ptr [edx+168h] ds:0023:0035019b=????
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x24
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from f7281c48 to f728dbfe
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
ba6e0604 f7281c48 e20373f8 e33bef28 ba6e0758 Ntfs+0x50bfe
ba6e0638 f72847ce 894b6530 89e2f808 e20373f8 Ntfs+0x44c48
ba6e0788 f7284ef8 894b6530 887d3880 ba6e07c8 Ntfs+0x477ce
ba6e088c 80840153 89e2f020 887d3880 8a70ad10 Ntfs+0x47ef8
ba6e08a0 f730a458 8883e930 8a70ad10 8a48bc18 nt!IofCallDriver+0x38
ba6e08cc 80840153 8a489e18 887d3880 887d3880 fltmgr!FltProcessFileLock+
ba6e08e0 8092e7fe 89dbe830 8888f6c0 00000000 nt!IofCallDriver+0x38
ba6e09c8 8093aa80 8a489e18 00000000 8a189508 nt!NtSetInformationFile+0x
ba6e0a00 8092c0be 89dbe830 00000000 8a189508 nt!NtOpenProcessToken+0x21
ba6e0a80 8092d78d 80001c88 ba6e0ac0 00000040 nt!ObAssignSecurity+0x494
ba6e0ad4 8092c64d 00000000 00000000 d0b40000 nt!ObOpenObjectByName+0xda
ba6e0b50 80931d12 ba6e0cd8 00000080 ba6e0ca8 nt!RtlEqualUnicodeString+0
ba6e0bac ba51c42f ba6e0cd8 00000080 ba6e0ca8 nt!IoCreateFile+0x51
ba6e0c1c ba51b835 89ce9b40 ba6e0cd8 00000080 srv+0x2442f
ba6e0cec ba51d5bb 89ce9b40 89ce9b40 80838a2d srv+0x23835
ba6e0d78 ba4fae87 89ce9b48 89da4020 ba5136c7 srv+0x255bb
ba6e0dac 8092083b 00da4020 00000000 00000000 srv+0x2e87
ba6e0ddc 8083fe9f ba513602 89da4020 00000000 nt!NtConnectPort+0x557
00000000 00000000 00000000 00000000 00000000 nt!KeQueryInterruptTime+0x
FOLLOWUP_IP:
Ntfs+50bfe
f728dbfe 668b8268010000 mov ax,word ptr [edx+168h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs+50bfe
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: Ntfs.sys
STACK_COMMAND: .cxr 0xffffffffba6e0228 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
0: kd> lmvm Ntfs
start end module name
f723d000 f72d2000 Ntfs (no symbols)
Loaded symbol image file: Ntfs.sys
Image path: Ntfs.sys
Image name: Ntfs.sys
Timestamp: Sat Feb 17 08:27:23 2007 (45D6A04B)
CheckSum: 00097DDD
ImageSize: 00095000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> .exr 0xffffffffba6e052c
ExceptionAddress: f728dbfe (Ntfs+0x00050bfe)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 0035019b
Attempt to read from address 0035019b
I would say thats a RAID card fault as its trying to write to NTFS. Possibly a driver update but I would be seeing if I had a RAID card knocking about.
Windows Server 2003
Windows Server 2003 was based on Windows XP and was released in four editions: Web, Standard, Enterprise and Datacenter. It also had derivative versions for clusters, storage and Microsoft’s Small Business Server. Important upgrades included integrating Internet Information Services (IIS), improvements to Active Directory (AD) and Group Policy (GP), and the migration to Automated System Recovery (ASR).
129K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
TRUSTED BY
I would suggest running the diagnostic tools available form the manufacturer of the server and posting any results gained from those.