Link to home
Start Free TrialLog in
Avatar of jdubai
jdubai

asked on

DMP File Analysis

Hi,

Would appreciate some assitance to analyze a dump file causing BSOD on a Windows Server 2003 R2 SP2 system.  Physical server and not a VM.  The main role of this server is a SQL database.   It's not occurring frequently.  The same error has occured twice in the last 6 months.  Considering it's a production SQL box it's still problematic to have it BSOD at all.  Thank you in advance

Dump file content follows - I bolded some items to highlight:

*** WARNING: Unable to verify checksum for ntkrnlmp.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_qfe.130106-1434
Machine Name:
Kernel base = 0xfffff800`01000000 PsLoadedModuleList = 0xfffff800`011d9280
Debug session time: Wed Nov 13 17:17:52.571 2013 (UTC - 7:00)
System Uptime: 154 days 23:01:37.797
*** WARNING: Unable to verify checksum for ntkrnlmp.exe
Loading Kernel Symbols
...............................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck E3, {fffffadf37144010, fffffadf3cc08040, 0, 2}

*** WARNING: Unable to verify checksum for Ntfs.sys
*** WARNING: Unable to verify checksum for fltMgr.sys

Probably caused by : ntkrnlmp.exe ( nt!ExReleaseResourceLite+160 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.

Arguments:
Arg1: fffffadf37144010, Address of resource
Arg2: fffffadf3cc08040, Address of thread
Arg3: 0000000000000000, Address of owner table if there is one
Arg4: 0000000000000002

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xE3

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800010b07ab to fffff8000102eb50

STACK_TEXT:  
fffffadf`2e6be838 fffff800`010b07ab : 00000000`000000e3 fffffadf`37144010 fffffadf`3cc08040 00000000`00000000 : nt!KeBugCheckEx
fffffadf`2e6be840 fffffadf`2d83a120 : fffffa80`023e4058 00000000`00000000 fffffadf`38995810 fffffadf`389957d0 : nt!ExReleaseResourceLite+0x160
fffffadf`2e6be880 fffffadf`2d83a13c : fffffadf`389957d0 fffffadf`2e6beba0 00000000`00000000 00000000`00000000 : Ntfs!NtfsReleaseAllResources+0x129
fffffadf`2e6be8b0 fffffadf`2d83a395 : fffffadf`389957d0 fffff800`010362a0 00000000`00000000 00000000`00000000 : Ntfs!NtfsCleanupIrpContext+0x40
fffffadf`2e6be8f0 fffffadf`2d8afc5c : fffffadf`389957d0 fffffadf`389957d0 00000000`00000000 fffffa80`023e4010 : Ntfs!NtfsCompleteRequest+0x4b
fffffadf`2e6be920 fffffadf`2d8af915 : fffffadf`389957d0 fffffa80`023e4110 fffffa80`023e4010 fffffadf`3b8921c8 : Ntfs!NtfsCommonClose+0x634
fffffadf`2e6be9c0 fffffadf`2d9bf962 : 00000000`00000001 fffffadf`37d74470 fffffadf`37d74470 fffffadf`3b852190 : Ntfs!NtfsFsdClose+0x392
fffffadf`2e6beab0 fffffadf`2d9bf582 : fffffadf`37d74470 fffffadf`2e6beba0 fffffadf`37d74470 fffffadf`39313b10 : fltMgr!FltpDispatch+0x1c2
fffffadf`2e6beb10 fffffadf`2d9bf91f : fffffadf`00000000 fffffadf`37d74470 fffffadf`37d74400 fffffadf`37d74470 : fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`2e6beb80 fffff800`012880a0 : fffffadf`36c63230 fffffadf`36c63230 fffffadf`36c63230 fffffadf`37d74470 : fltMgr!FltpDispatch+0x17f
fffffadf`2e6bebe0 fffff800`01291543 : 00000000`00000000 fffffadf`36c63230 00000000`00000000 fffffadf`36c63228 : nt!IopDeleteFile+0x301
fffffadf`2e6bec80 fffff800`010377ea : 00000000`00000000 fffff800`011d8220 fffff800`012914a0 fffffadf`3cc08040 : nt!ObpProcessRemoveObjectQueue+0x15e
fffffadf`2e6bed00 fffff800`0124f922 : fffffadf`3cc08040 00000000`00000080 fffffadf`3cc08040 fffffadf`2e2c36c0 : nt!ExpWorkerThread+0x13b
fffffadf`2e6bed70 fffff800`01020536 : fffffadf`2e2bb180 fffffadf`3cc08040 fffffadf`2e2c36c0 fffff800`011b9e00 : nt!PspSystemThreadStartup+0x3e
fffffadf`2e6bedd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ExReleaseResourceLite+160
fffff800`010b07ab cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExReleaseResourceLite+160

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  50ea2ecb

FAILURE_BUCKET_ID:  X64_0xE3_nt!ExReleaseResourceLite+160

BUCKET_ID:  X64_0xE3_nt!ExReleaseResourceLite+160

Followup: MachineOwner
---------
Avatar of nobus
nobus
Flag of Belgium image

some posts on the net link it to an update, some to an installed driver; that's about all i found
Avatar of jdubai
jdubai

ASKER

Thanks Nobus.  Any particular driver you found that was related to this error?  I also think I know which update you're referring to.  I found this from Microsoft:  http://support.microsoft.com/kb/899325

Unfortunately their hotfix for this particular Stop error says it's only for Windows Server 2003 SP1.  My system is 2003 R2 SP2, so it doesn't apply to me.
Bug Check 0xE3: This bug check reports due to driver issue,

You can try updating system drivers (Mother board, Graphics,etc),

First try updating / reinstalling Graphics driver.

Also run memory daignostic check, There may be chance of Memory overclocking.
what system, or pc model is this?
Avatar of jdubai

ASKER

Nobus,

It is a HP ProLiant DL585 G1 server.  

Thanks.
Avatar of jdubai

ASKER

Appreciate your responses.  We are going to do some further testing and troubleshooting this coming week.  I will report back when we know what the fix was and then finalize the solution with the expert responses received.  Many thanks!
Avatar of jdubai

ASKER

Change management wants us to run through general hardware diagnostics first (chkdsk, file checker and mem diags).  Will report back.
ASKER CERTIFIED SOLUTION
Avatar of nobus
nobus
Flag of Belgium image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of jdubai

ASKER

Thanks Nobus.  Having the RFC scheduled to perform what you recommended here.  Appreciate your assistance.  I'll update the thread when work is complete.
Avatar of jdubai

ASKER

Chkdsk found some minor errors.  So far there have been no further issues.  Thanks Nobus
good to know it's ok again