Avatar of Tamooz
TamoozFlag for Israel

asked on 

Event ID 6008

Hello All,
One of our servers (Archive server) is crushing while running some applications.
Its crushing while moving large files (15Gb) or running a backup through the Tape device. (HP LTO-4).
the servers has only 1 PSU (HEC 1200W) and 8 H.D (2T each) that are connected to a raid card (Adaptec) we are running raid 6
and also 2 hard drives that are connected to the mother board (Asus). also in a raid 0 mode
If we are not running the tape device or moving large files, nothing happens.
in the event viewer we cant find any reference to the crash, only event id 6008.

Your help will be appreciated
Windows Server 2003Server HardwareStorage Software

Avatar of undefined
Last Comment
Avatar of JonGarrettUK

Event 6008 is just an unexpected shutdown. This is normally caused by a hardware error and by the sounds of it its oing it when under load. So check that the CPU is not cooking and that RAM is seated correctly and the RAID card is OK.

I would suggest running the diagnostic tools available form the manufacturer of the server and posting any results gained from those.
Avatar of Pete Long
Pete Long
Flag of United Kingdom of Great Britain and Northern Ireland image

Blurred text
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Avatar of Pete Long
Pete Long
Flag of United Kingdom of Great Britain and Northern Ireland image

- also It seems you have HP kit? is this a proliant?

If so Install the Insight management tools (if not already installed (you can download the latest Proliant Support pack from HP to get it)
log into insight manager and see what the logs tell you

 - if you have already installed the HP tool check for the existence af the HP shut-down service and make sure this isn't the culprit

Good luck

Avatar of Tamooz
Flag of Israel image


this is what i get from the dmp file:

Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.


FAULTING_MODULE: 80800000 nt


EXCEPTION_RECORD:  ba6e052c -- (.exr 0xffffffffba6e052c)
ExceptionAddress: f728dbfe (Ntfs+0x00050bfe)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0035019b
Attempt to read from address 0035019b

CONTEXT:  ba6e0228 -- (.cxr 0xffffffffba6e0228)
eax=e33bef28 ebx=ba6e0758 ecx=000000be edx=00350033 esi=ba6e0804 edi=89e2f100
eip=f728dbfe esp=ba6e05f4 ebp=ba6e0604 iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
f728dbfe 668b8268010000  mov     ax,word ptr [edx+168h]   ds:0023:0035019b=????
Resetting default scope




LAST_CONTROL_TRANSFER:  from f7281c48 to f728dbfe

WARNING: Stack unwind information not available. Following frames may be wrong.
ba6e0604 f7281c48 e20373f8 e33bef28 ba6e0758 Ntfs+0x50bfe
ba6e0638 f72847ce 894b6530 89e2f808 e20373f8 Ntfs+0x44c48
ba6e0788 f7284ef8 894b6530 887d3880 ba6e07c8 Ntfs+0x477ce
ba6e088c 80840153 89e2f020 887d3880 8a70ad10 Ntfs+0x47ef8
ba6e08a0 f730a458 8883e930 8a70ad10 8a48bc18 nt!IofCallDriver+0x38
ba6e08cc 80840153 8a489e18 887d3880 887d3880 fltmgr!FltProcessFileLock+0x2086
ba6e08e0 8092e7fe 89dbe830 8888f6c0 00000000 nt!IofCallDriver+0x38
ba6e09c8 8093aa80 8a489e18 00000000 8a189508 nt!NtSetInformationFile+0xd28
ba6e0a00 8092c0be 89dbe830 00000000 8a189508 nt!NtOpenProcessToken+0x217
ba6e0a80 8092d78d 80001c88 ba6e0ac0 00000040 nt!ObAssignSecurity+0x494
ba6e0ad4 8092c64d 00000000 00000000 d0b40000 nt!ObOpenObjectByName+0xda
ba6e0b50 80931d12 ba6e0cd8 00000080 ba6e0ca8 nt!RtlEqualUnicodeString+0x207
ba6e0bac ba51c42f ba6e0cd8 00000080 ba6e0ca8 nt!IoCreateFile+0x51
ba6e0c1c ba51b835 89ce9b40 ba6e0cd8 00000080 srv+0x2442f
ba6e0cec ba51d5bb 89ce9b40 89ce9b40 80838a2d srv+0x23835
ba6e0d78 ba4fae87 89ce9b48 89da4020 ba5136c7 srv+0x255bb
ba6e0dac 8092083b 00da4020 00000000 00000000 srv+0x2e87
ba6e0ddc 8083fe9f ba513602 89da4020 00000000 nt!NtConnectPort+0x557
00000000 00000000 00000000 00000000 00000000 nt!KeQueryInterruptTime+0x1f2

f728dbfe 668b8268010000  mov     ax,word ptr [edx+168h]


SYMBOL_NAME:  Ntfs+50bfe

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  Ntfs.sys

STACK_COMMAND:  .cxr 0xffffffffba6e0228 ; kb


Followup: MachineOwner

0: kd> lmvm Ntfs
start    end        module name
f723d000 f72d2000   Ntfs       (no symbols)          
    Loaded symbol image file: Ntfs.sys
    Image path: Ntfs.sys
    Image name: Ntfs.sys
    Timestamp:        Sat Feb 17 08:27:23 2007 (45D6A04B)
    CheckSum:         00097DDD
    ImageSize:        00095000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> .exr 0xffffffffba6e052c
ExceptionAddress: f728dbfe (Ntfs+0x00050bfe)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0035019b
Attempt to read from address 0035019b
Avatar of JonGarrettUK

I would say thats a RAID card fault as its trying to write to NTFS. Possibly a driver update but I would be seeing if I had a RAID card knocking about.
Windows Server 2003
Windows Server 2003

Windows Server 2003 was based on Windows XP and was released in four editions: Web, Standard, Enterprise and Datacenter. It also had derivative versions for clusters, storage and Microsoft’s Small Business Server. Important upgrades included integrating Internet Information Services (IIS), improvements to Active Directory (AD) and Group Policy (GP), and the migration to Automated System Recovery (ASR).

Top Experts
Get a personalized solution from industry experts
Ask the experts
Read over 600 more reviews


IBM logoIntel logoMicrosoft logoUbisoft logoSAP logo
Qualcomm logoCitrix Systems logoWorkday logoErnst & Young logo
High performer badgeUsers love us badge
LinkedIn logoFacebook logoX logoInstagram logoTikTok logoYouTube logo