Solved

Server Crash - MEMORY.DMP file review

Posted on 2015-01-07
6
168 Views
Last Modified: 2015-02-03
Guys,
Can someone help me identify what's causing the server to crash based on the memory.dmp extract below. The server is 2008 R2 Standard SP1 (64B OS).

Looks like its referring to "PROCESS_NAME:  Focus2_EELxml_" as the failure point but this process has been running fine on similar servers (2008 R2 64B SP1) for 2 years expect for this new server.


2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory.  The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff88001e65038, Virtual address for the attempted execute.
Arg2: 8000000002f68963, PTE contents.
Arg3: fffff8800a086ea0, (reserved)
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xFC

PROCESS_NAME:  Focus2_EELxml_

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) x86fre

TRAP_FRAME:  fffff8800a086ea0 -- (.trap 0xfffff8800a086ea0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800a0882a0 rbx=0000000000000000 rcx=fffffa800e4b4930
rdx=fffff8a0004e6a90 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001cd3500 rsp=fffff8800a087030 rbp=fffff8a00161db40
 r8=fffff8a00161db40  r9=fffff8800a087d80 r10=fffffffffffffffb
r11=fffff88001e5e100 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz na pe nc
nt!KiPageFault:
fffff800`01cd3500 55              push    rbp
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001d533a7 to fffff80001cd5540

STACK_TEXT:  
fffff880`0a086d38 fffff800`01d533a7 : 00000000`000000fc fffff880`01e65038 80000000`02f68963 fffff880`0a086ea0 : nt!KeBugCheckEx
fffff880`0a086d40 fffff800`01cd366e : 00000000`00000008 fffff880`01e65038 ffffc0ff`0300f000 fffffa80`0e4b4930 : nt! ?? ::FNODOBFM::`string'+0x4490c
fffff880`0a086ea0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault+0x16e
fffff880`0a087030 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087060 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087090 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0870c0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0870f0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087120 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087150 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087180 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0871b0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0871e0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087210 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087240 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087270 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0872a0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0872d0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087300 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087330 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087360 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087390 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0873c0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0873f0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087420 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087450 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087480 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0874b0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0874e0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087510 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087540 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087570 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0875a0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0875d0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087600 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087630 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087660 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087690 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0876c0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0876f0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087720 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087750 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087780 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0877b0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0877e0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087810 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087840 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087870 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0878a0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0878d0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087900 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087930 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087960 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087990 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0879c0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a0879f0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087a20 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087a50 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087a80 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087ab0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087ae0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087b10 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087b40 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087b70 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087ba0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087bd0 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087c00 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087c30 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087c60 fffff800`01cd3500 : 00000000`00000010 fffff800`01cd3500 00000000`00000010 00000000`00010082 : nt!KiPageFault
fffff880`0a087c90 fffff800`01cd3500 : 00000000`00000010 fffff880`01429a60 00000000`00000010 00000000`00010282 : nt!KiPageFault
fffff880`0a087cc0 fffff880`01429a60 : fffff880`014be21f fffffa80`0e4b4930 fffff8a0`0161db40 fffff8a0`074471b8 : nt!KiPageFault
fffff880`0a087cf8 fffff880`014be21f : fffffa80`0e4b4930 fffff8a0`0161db40 fffff8a0`074471b8 00000000`00000001 : Ntfs!NtfsFindExistingLcb
fffff880`0a087d00 fffff880`014bc3e2 : fffffa80`0e4b4930 fffffa80`0a29a358 fffff8a0`002b4b10 ffffc6c9`822a1701 : Ntfs!NtfsFindPrefixHashEntry+0xaea
fffff880`0a087e30 fffff880`014b9d63 : fffffa80`0e4b4930 fffffa80`0b890840 fffff880`0a088010 fffff880`0a088048 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0a087f00 fffff880`0142448d : fffffa80`0e4b4930 fffffa80`0b890840 fffff880`0a0882a0 fffff8a0`0161de00 : Ntfs!NtfsCommonCreate+0x3d3


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4490c
fffff800`01d533a7 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4490c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5315a462

IMAGE_VERSION:  6.1.7601.22616

FAILURE_BUCKET_ID:  X64_0xFC_nt!_??_::FNODOBFM::_string_+4490c

BUCKET_ID:  X64_0xFC_nt!_??_::FNODOBFM::_string_+4490c

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xfc_nt!_??_::fnodobfm::_string_+4490c

FAILURE_ID_HASH:  {a1fb4766-acdb-326f-5325-fdc2a1bb4704}

Followup: MachineOwner
---------

Open in new window

0
Comment
Question by:itsmehar
  • 4
  • 2
6 Comments
 
LVL 3

Expert Comment

by:Bahloul
ID: 40537469
Hi,

There is no a specific reason could defined why the issue occurs but you can prevent system from shutdown if crashes that will give you more chance to digging the root cause may be an application or certain service you can do it if you noticed the server is up normal

right click on my computer > properties > advanced > Start up and Recovery > settings > system failure  then clear automatic restart options

i faced this case 2 times and the above configuration helps me to stop it .

Bahloul.
0
 

Author Comment

by:itsmehar
ID: 40537698
Thanks but How will that help me identify why the server is blue screaming? I need help understanding that memory dump.
0
 
LVL 3

Expert Comment

by:Bahloul
ID: 40537828
Blue screan will define it in most cases may be software or hardware driver update cause the same issue at this moment you must rollback or restart in the last known good configuration mode for software you have to investigate and monitor some cases removing it from strartup fix it and so on.

Bahloul.
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 

Accepted Solution

by:
itsmehar earned 0 total points
ID: 40578638
We were hitting a known issue with our version of VMware/Intel. Below is some documentation in case someone else has the same issue:

"Windows 2008 R2 and Solaris 10 64-bit virtual machines blue screen or kernel panic when running on ESXi 5.x with an Intel E5 v2 series processor (2073791)"
0
 

Author Comment

by:itsmehar
ID: 40578639
0
 

Author Closing Comment

by:itsmehar
ID: 40585869
none of the comments provided were adequate
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

by Nathan Brom/Bromy2004 Introduction There are numerous websites out there for any different type of program you can imagine.  Of those, you'll need to decide which ones are legitimate and aren't trying to steal your money or infect your comput…
Ever notice how you can't use a new drive in Windows without having Windows assigning a Disk Signature?  Ever have a signature collision problem (especially with Virtual Machines?)  This article is intended to help you understand what's going on and…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now