Avatar of jdubai
jdubai
 asked on

DMP File Analysis

Hi,

Would appreciate some assitance to analyze a dump file causing BSOD on a Windows Server 2003 R2 SP2 system.  Physical server and not a VM.  The main role of this server is a SQL database.   It's not occurring frequently.  The same error has occured twice in the last 6 months.  Considering it's a production SQL box it's still problematic to have it BSOD at all.  Thank you in advance

Dump file content follows - I bolded some items to highlight:

*** WARNING: Unable to verify checksum for ntkrnlmp.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_qfe.130106-1434
Machine Name:
Kernel base = 0xfffff800`01000000 PsLoadedModuleList = 0xfffff800`011d9280
Debug session time: Wed Nov 13 17:17:52.571 2013 (UTC - 7:00)
System Uptime: 154 days 23:01:37.797
*** WARNING: Unable to verify checksum for ntkrnlmp.exe
Loading Kernel Symbols
...............................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck E3, {fffffadf37144010, fffffadf3cc08040, 0, 2}

*** WARNING: Unable to verify checksum for Ntfs.sys
*** WARNING: Unable to verify checksum for fltMgr.sys

Probably caused by : ntkrnlmp.exe ( nt!ExReleaseResourceLite+160 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.

Arguments:
Arg1: fffffadf37144010, Address of resource
Arg2: fffffadf3cc08040, Address of thread
Arg3: 0000000000000000, Address of owner table if there is one
Arg4: 0000000000000002

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xE3

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800010b07ab to fffff8000102eb50

STACK_TEXT:  
fffffadf`2e6be838 fffff800`010b07ab : 00000000`000000e3 fffffadf`37144010 fffffadf`3cc08040 00000000`00000000 : nt!KeBugCheckEx
fffffadf`2e6be840 fffffadf`2d83a120 : fffffa80`023e4058 00000000`00000000 fffffadf`38995810 fffffadf`389957d0 : nt!ExReleaseResourceLite+0x160
fffffadf`2e6be880 fffffadf`2d83a13c : fffffadf`389957d0 fffffadf`2e6beba0 00000000`00000000 00000000`00000000 : Ntfs!NtfsReleaseAllResources+0x129
fffffadf`2e6be8b0 fffffadf`2d83a395 : fffffadf`389957d0 fffff800`010362a0 00000000`00000000 00000000`00000000 : Ntfs!NtfsCleanupIrpContext+0x40
fffffadf`2e6be8f0 fffffadf`2d8afc5c : fffffadf`389957d0 fffffadf`389957d0 00000000`00000000 fffffa80`023e4010 : Ntfs!NtfsCompleteRequest+0x4b
fffffadf`2e6be920 fffffadf`2d8af915 : fffffadf`389957d0 fffffa80`023e4110 fffffa80`023e4010 fffffadf`3b8921c8 : Ntfs!NtfsCommonClose+0x634
fffffadf`2e6be9c0 fffffadf`2d9bf962 : 00000000`00000001 fffffadf`37d74470 fffffadf`37d74470 fffffadf`3b852190 : Ntfs!NtfsFsdClose+0x392
fffffadf`2e6beab0 fffffadf`2d9bf582 : fffffadf`37d74470 fffffadf`2e6beba0 fffffadf`37d74470 fffffadf`39313b10 : fltMgr!FltpDispatch+0x1c2
fffffadf`2e6beb10 fffffadf`2d9bf91f : fffffadf`00000000 fffffadf`37d74470 fffffadf`37d74400 fffffadf`37d74470 : fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`2e6beb80 fffff800`012880a0 : fffffadf`36c63230 fffffadf`36c63230 fffffadf`36c63230 fffffadf`37d74470 : fltMgr!FltpDispatch+0x17f
fffffadf`2e6bebe0 fffff800`01291543 : 00000000`00000000 fffffadf`36c63230 00000000`00000000 fffffadf`36c63228 : nt!IopDeleteFile+0x301
fffffadf`2e6bec80 fffff800`010377ea : 00000000`00000000 fffff800`011d8220 fffff800`012914a0 fffffadf`3cc08040 : nt!ObpProcessRemoveObjectQueue+0x15e
fffffadf`2e6bed00 fffff800`0124f922 : fffffadf`3cc08040 00000000`00000080 fffffadf`3cc08040 fffffadf`2e2c36c0 : nt!ExpWorkerThread+0x13b
fffffadf`2e6bed70 fffff800`01020536 : fffffadf`2e2bb180 fffffadf`3cc08040 fffffadf`2e2c36c0 fffff800`011b9e00 : nt!PspSystemThreadStartup+0x3e
fffffadf`2e6bedd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ExReleaseResourceLite+160
fffff800`010b07ab cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExReleaseResourceLite+160

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  50ea2ecb

FAILURE_BUCKET_ID:  X64_0xE3_nt!ExReleaseResourceLite+160

BUCKET_ID:  X64_0xE3_nt!ExReleaseResourceLite+160

Followup: MachineOwner
---------
Microsoft Legacy OS

Avatar of undefined
Last Comment
nobus

8/22/2022 - Mon
nobus

some posts on the net link it to an update, some to an installed driver; that's about all i found
jdubai

ASKER
Thanks Nobus.  Any particular driver you found that was related to this error?  I also think I know which update you're referring to.  I found this from Microsoft:  http://support.microsoft.com/kb/899325

Unfortunately their hotfix for this particular Stop error says it's only for Windows Server 2003 SP1.  My system is 2003 R2 SP2, so it doesn't apply to me.
Manjunath Sullad

Bug Check 0xE3: This bug check reports due to driver issue,

You can try updating system drivers (Mother board, Graphics,etc),

First try updating / reinstalling Graphics driver.

Also run memory daignostic check, There may be chance of Memory overclocking.
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
nobus

what system, or pc model is this?
jdubai

ASKER
Nobus,

It is a HP ProLiant DL585 G1 server.  

Thanks.
jdubai

ASKER
Appreciate your responses.  We are going to do some further testing and troubleshooting this coming week.  I will report back when we know what the fix was and then finalize the solution with the expert responses received.  Many thanks!
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
nobus

jdubai

ASKER
Change management wants us to run through general hardware diagnostics first (chkdsk, file checker and mem diags).  Will report back.
ASKER CERTIFIED SOLUTION
nobus

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
jdubai

ASKER
Thanks Nobus.  Having the RFC scheduled to perform what you recommended here.  Appreciate your assistance.  I'll update the thread when work is complete.
Your help has saved me hundreds of hours of internet surfing.
fblack61
jdubai

ASKER
Chkdsk found some minor errors.  So far there have been no further issues.  Thanks Nobus
nobus

good to know it's ok again