Solved

New Windows 2008 R2 blue screen

Posted on 2011-09-13
18
2,646 Views
Last Modified: 2012-05-12
I have a brand new server that starting crashing with bluescreen error.  The server reboots and on reboot gives the following error:

Problem signature:
  Problem Event Name:      BlueScreen
  OS Version:      6.1.7601.2.1.0.272.7
  Locale ID:      1033

Additional information about the problem:
  BCCode:      50
  BCP1:      FFFFF8A010C73008
  BCP2:      0000000000000000
  BCP3:      FFFFF880013812E6
  BCP4:      0000000000000000
  OS Version:      6_1_7601
  Service Pack:      1_0
  Product:      272_2

Files that help describe the problem:
  C:\Windows\Minidump\091311-33015-01.dmp
  C:\Users\Administrator\AppData\Local\Temp\2\WER-3053906-0.sysdata.xml

I have attached the dump file.  The server is actually a vmware vm (esxi 4.1).  This is the only vm running on the host.  There is a second host, identical hardware running a second windows 2008 r2 vm.  The two vms are on the same domain runing almost the same roles (ad, dns, dhcp, iis); the only difference is the one that is crashing is also a file and print server.  The second host/vm has no problems.

Hardware is HP Proliant DL380 G7, storage are hp drives in the server.  I have not spent that much time troubleshooting so sorry for the lack of info; I need to get this solved asap so i am posting before fully troubleshooting.  Any help is appreciated 091311-33015-01.dmp
0
Comment
Question by:jcwilets
  • 11
  • 4
  • 3
18 Comments
 
LVL 10

Accepted Solution

by:
cbmm earned 500 total points
Comment Utility
SystemRoot\system32\DRIVERS\zmsfsfltr.sys...

Seems to be the culprit
0
 

Author Comment

by:jcwilets
Comment Utility
can you explain a bit more
0
 
LVL 10

Expert Comment

by:cbmm
Comment Utility
sure, browse to to C:\Windows\System32\drivers and locate the file named zmsfsfltr.sys. the file may be hidden, so you may need to view all hidden files. right click the file--go to properties--go to details--take a screen shot of the info and post here.
0
 

Author Comment

by:jcwilets
Comment Utility
See attached.  Looks like the driver is part of the zenith infotech backup and data recovery solution.  Basically there is another server that takes realtime images of the servers, there is an agent on the windows servers that connect them to the backup server.  I checked the second domain controller and it has this driver as well (it is being backed up in the same solution.  This is the bdr solution if it helps:
http://www.zenithinfotech.com/solutions/smartstyle%20computing/mirrorcloud.aspx Driver details Driver details
0
 

Author Comment

by:jcwilets
Comment Utility
not sure why it added it twice
0
 

Author Comment

by:jcwilets
Comment Utility
what led you to this the driver
0
 
LVL 16

Expert Comment

by:danm66
Comment Utility
how often does it crash?  Is there a correlation to the crash occurrences and any other operation?
0
 

Author Comment

by:jcwilets
Comment Utility
see picture (unexpected shutdown event).  Looks like about once every other day, random times Unexpected shutdown
0
 

Author Comment

by:jcwilets
Comment Utility
Just installed the debugging tools; looks like the zmsfsfltr.sys driver.  Now what to do about it, any ideas?  Why would an almost identical setup on the other server not have the same problem?
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 
LVL 16

Expert Comment

by:danm66
Comment Utility
Suppose it could be a corrupt dll or another file.  Were there any other backup apps installed on the server?

Are the esx host build numbers identical?

First uninstall the zenith software after confirming that both servers are using the same versions by checking the file properties.  Let it run for a couple of days to confirm that it's the culprit and make other temporary backup arrangements
0
 

Author Comment

by:jcwilets
Comment Utility
Everything is identical between the servers.  Will try disabling the backup for a couple of days to see.  Will call support as well for the product although that usually leads to frustration.
0
 
LVL 16

Expert Comment

by:danm66
Comment Utility
I was looking at zenith for remote site backups a few months back, so I'd love to know how responsive their support is.
0
 
LVL 10

Expert Comment

by:cbmm
Comment Utility
Is the zmsfsfltr.sys file the same version on both servers? Maybe add an exclusion for your anti-virus software to not scan this file? just an idea
0
 

Author Comment

by:jcwilets
Comment Utility
I am testing with the services off for a couple days; Will contact support tomorrow as well.  I will post back what I find
0
 

Author Comment

by:jcwilets
Comment Utility
So the crash did occur again with the services off, so no go there.  BTW, support from Zenith is terrible.  I have not decided yet to scrap the product entirely but I am getting close based on the lack of support.  There is no phone number to call so you have to start a logmein session from an online support request.  This is all fine except I never get a tech in the logmein session which times out after about ten minutes saying there is no one available.  Just to test, on two separate days i kept starting support sessions my entire workday and never once did I get a tech - pretty poor support for a disaster and recovery solution.

Anyway back to the problem, I did add the problem file to the AV exclusions (Trend WFBS) and it has not crashed since 9/15.  The logs show a consistent crash about once every two days so it is looking better.  I will be convinced after a week or so.  Will post back
0
 

Author Comment

by:jcwilets
Comment Utility
Back to the drawing board.  Server crashed a couple hours after the last post
0
 
LVL 16

Expert Comment

by:danm66
Comment Utility
Did you check the dump file to see what file was the cause this last time?  sounds like a memory leak in another component that was exacerbated by the Zenith service.

2008 (r1) had an issue with one of the svchost processes but it doesn't appear that R2 has the same issue http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/76931dd2-6262-49be-b8bd-5e0a594c78ae  
0
 

Author Closing Comment

by:jcwilets
Comment Utility
Closing the question and awarding the points for pointing out the source of the problem.  I was unable to actually resolve the issue so decided to remove the Zenith software and come up with a different solution for backup and data recovery.  As a company we actually decided to drop Zenith as a BDR solution.  Mostly due to bad/unresponsive tech support.  The product was also more complicated than needed and not intuitive at all.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Last article we focus in how to VMware: How to create and use VMs TAGs – Part 1 so before follow this article and perform the next tasks, you should read the first article how to create the TAG before using them in Veeam Backup Jobs.
In this article, I will show you HOW TO: Create your first Windows Virtual Machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, the Windows OS we will install is Windows Server 2016.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now