Server 2012 R2 BugCheck Event ID 1001

New base load of Server 2012 R2 has run fine for months. On two seperate days the server rebooted all day long then quite at the end of that day. Event 1001, BugCheck then MEMORY.DMP. Issue occured only on 2 days and not even once in between. It is a vmware server.

Amber S. Krause
Wauna_ITAsked:
Who is Participating?
 
Seth SimmonsSr. Systems AdministratorCommented:
what is the stop code in the event log?
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
What's changed on the VM?

Are you running a supported version of ESXi for Windows 2012 R2 ?
0
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

 
Tony GiangrecoCommented:
Can you upload the dump file?
0
 
Ratnesh MishraCommented:
Compress and upload the memory.dmp file to give you proper reason for the bugcheck.
Event id 1001 is generalized event for bugcheck if you can provide us the details of event. That will give a reference ,what had happened.
0
 
Wauna_ITAuthor Commented:
Here is the BugCheck message with stop code: The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000109 (0xa3a01f58935f9760, 0xb3b72bdee5df99eb, 0x00000001c0000103, 0x0000000000000007). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 041114-16218-01.

Nothing had changed on the VM and I am running 20 production servers in the vm environment with no issues on the same days. I am running ESXi 5.1.

I am attaching the MEMORY.DMP file.

Thank you - Amber S. Krause
0
 
Seth SimmonsSr. Systems AdministratorCommented:
do you have vmware tools installed?

a stop 0x109 is CRITICAL_STRUCTURE_CORRUPTION
the fourth parameter is 0x7 which is a critical MSR modification

it could be caused by a driver or hardware corruption - specifically memory
i did find a vmware article referring to this issue though it's for older versions of esx with P4 cpu and may not apply here

http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=1008749&sliceId=1&docTypeID=DT_KB_1_1&dialogID=74787167&stateId=0

what software is installed?  something could have tried to modify the kernel

this should provide more technical insight on the stop code

Debugging Stop 0x109 - Kernel Patch Protection
http://bsodtutorials.blogspot.com/2013/10/debugging-stop-0x109-kernel-patch.html

Processor MSRs
http://uninformed.org/index.cgi?v=3&a=3&p=10

if you are able to post the memory dump it might be helpful
0
 
Wauna_ITAuthor Commented:
I do have vmware tools installed.

I am posting the mini dump to see if it is sufficient for your needs. Let me know if it isn't and I will figure out how to compress the MEMORY.DMP

Amber Krause
041114-24187-01.dmp
0
 
Wauna_ITAuthor Commented:
I have passed this recommendation onto my vm support team:

http://support.microsoft.com/kb/2902739

Thank you - Amber Krause
0
 
Ratnesh MishraCommented:
Great , would certainly be waiting for the feedback .
0
 
Seth SimmonsSr. Systems AdministratorCommented:
the article says it's fixed in 5.0 update 3 though she has 5.1 so it would be interesting what the support team comes back with
0
 
Wauna_ITAuthor Commented:
Other suggestions are welcome. Thanks Amber Krause
0
 
Tony GiangrecoCommented:
I would check for any updates that are available for the following:

System Bios
Raid Firmware
Raid drivers
BMC firmware (if it's a Dell server)
Chipset drivers
Audio & Video drivers
Hard drive firmware
OMSA upgrade (if it's a Dell server)
0
 
Tony GiangrecoCommented:
Have you resolved this issue? Have our suggestions helped?
0
 
Wauna_ITAuthor Commented:
Your suggestions have pointed me in an appropriate direction. I am relying on my vm team from here. You can close my case. Thanks for the follow up.
0
 
Seth SimmonsSr. Systems AdministratorCommented:
if you are looking at an alternate source for support then you can either delete this question or wait for a solution from your support group and select one of the comments here if in fact it did point to the solution
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.