Viewing 3 reply threads
  • Author
    Posts
    • #1558068
      Peter Line
      Participant
      Member Points: 321
      Rank: 2

      Hi, I have some BSOD events occurring on a Windows Server 2016, HP Microserver Gen 10 that I need some help to identify the cause of.  Normally using Win DBG you can see the ‘probably caused by’ at the bottom of the dump output, but for some reason that does not happen.

      Can someone please help me to identify what could be the cause of these intermittent BSOD crashes?  I will attach the latest for help.

       

       

    • #1558069
      Peter Line
      Participant
      Member Points: 321
      Rank: 2

      I can’t seem to upload a zipped version of the dump so here are a couple of outputs:

      The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000000a (0x0000000000000008, 0x0000000000000002, 0x0000000000000000, 0xfffff8033938492d). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 197615de-f68d-4666-bb51-040224f50ef5.\r\n

      Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
      Copyright (c) Microsoft Corporation. All rights reserved.

      Loading Dump File [C:\Windows\Minidump\080620-26484-01.dmp]
      Mini Kernel Dump File: Only registers and stack trace are available

      ************* Path validation summary **************
      Response Time (ms) Location
      Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
      Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
      Executable search path is:
      Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
      *** WARNING: Unable to verify timestamp for ntoskrnl.exe
      *************************************************************************
      *** ***
      *** ***
      *** Either you specified an unqualified symbol, or your debugger ***
      *** doesn’t have full symbol information. Unqualified symbol ***
      *** resolution is turned off by default. Please either specify a ***
      *** fully qualified symbol module!symbolname, or enable resolution ***
      *** of unqualified symbols by typing “.symopt- 100”. Note that ***
      *** enabling unqualified symbol resolution with network symbol ***
      *** server shares in the symbol path may cause the debugger to ***
      *** appear to hang for long periods of time when an incorrect ***
      *** symbol name is typed or the network symbol server is down. ***
      *** ***
      *** For some commands to work properly, your symbol path ***
      *** must point to .pdb files that have full type information. ***
      *** ***
      *** Certain .pdb files (such as the public OS symbols) do not ***
      *** contain the required information. Contact the group that ***
      *** provided you with these symbols if you need this command to ***
      *** work. ***
      *** ***
      *** Type referenced: nt!_MMPTE_TRANSITION ***
      *** ***
      *************************************************************************
      Windows 10 Kernel Version 14393 MP (2 procs) Free x64
      Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
      Built by: 14393.3808.amd64fre.rs1_release.200707-2105
      Machine Name:
      Kernel base = 0xfffff803

      3928b000 PsLoadedModuleList = 0xfffff803

      3958f0a0
      Debug session time: Thu Aug 6 06:06:27.523 2020 (UTC + 10:00)
      System Uptime: 9 days 20:49:09.685
      Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
      *** WARNING: Unable to verify timestamp for ntoskrnl.exe
      *************************************************************************
      *** ***
      *** ***
      *** Either you specified an unqualified symbol, or your debugger ***
      *** doesn’t have full symbol information. Unqualified symbol ***
      *** resolution is turned off by default. Please either specify a ***
      *** fully qualified symbol module!symbolname, or enable resolution ***
      *** of unqualified symbols by typing “.symopt- 100”. Note that ***
      *** enabling unqualified symbol resolution with network symbol ***
      *** server shares in the symbol path may cause the debugger to ***
      *** appear to hang for long periods of time when an incorrect ***
      *** symbol name is typed or the network symbol server is down. ***
      *** ***
      *** For some commands to work properly, your symbol path ***
      *** must point to .pdb files that have full type information. ***
      *** ***
      *** Certain .pdb files (such as the public OS symbols) do not ***
      *** contain the required information. Contact the group that ***
      *** provided you with these symbols if you need this command to ***
      *** work. ***
      *** ***
      *** Type referenced: nt!_MMPTE_TRANSITION ***
      *** ***
      *************************************************************************
      Loading Kernel Symbols
      .

      Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
      Run !sym noisy before .reload to track down problems loading symbols.

      ……………………………………………………..
      ……………………………………………………….
      ……………………
      Loading User Symbols
      Loading unloaded module list
      ………….

      ************* Symbol Loading Error Summary **************
      Module name Error
      ntoskrnl The system cannot find the file specified

      You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
      You should also verify that your symbol search path (.sympath) is correct.
      For analysis of this file, run !analyze -v
      1: kd> !analyze -v
      *******************************************************************************
      * *
      * Bugcheck Analysis *
      * *
      *******************************************************************************

      IRQL_NOT_LESS_OR_EQUAL (a)
      An attempt was made to access a pageable (or completely invalid) address at an
      interrupt request level (IRQL) that is too high. This is usually
      caused by drivers using improper addresses.
      If a kernel debugger is available get the stack backtrace.
      Arguments:
      Arg1: 0000000000000008, memory referenced
      Arg2: 0000000000000002, IRQL
      Arg3: 0000000000000000, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
      Arg4: fffff8033938492d, address which referenced memory

      Debugging Details:
      ——————

      ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

      *************************************************************************
      *** ***
      *** ***
      *** Either you specified an unqualified symbol, or your debugger ***
      *** doesn’t have full symbol information. Unqualified symbol ***
      *** resolution is turned off by default. Please either specify a ***
      *** fully qualified symbol module!symbolname, or enable resolution ***
      *** of unqualified symbols by typing “.symopt- 100”. Note that ***
      *** enabling unqualified symbol resolution with network symbol ***
      *** server shares in the symbol path may cause the debugger to ***
      *** appear to hang for long periods of time when an incorrect ***
      *** symbol name is typed or the network symbol server is down. ***
      *** ***
      *** For some commands to work properly, your symbol path ***
      *** must point to .pdb files that have full type information. ***
      *** ***
      *** Certain .pdb files (such as the public OS symbols) do not ***
      *** contain the required information. Contact the group that ***
      *** provided you with these symbols if you need this command to ***
      *** work. ***
      *** ***
      *** Type referenced: nt!_EPROCESS ***
      *** ***
      *************************************************************************
      *************************************************************************
      *** ***
      *** ***
      *** Either you specified an unqualified symbol, or your debugger ***
      *** doesn’t have full symbol information. Unqualified symbol ***
      *** resolution is turned off by default. Please either specify a ***
      *** fully qualified symbol module!symbolname, or enable resolution ***
      *** of unqualified symbols by typing “.symopt- 100”. Note that ***
      *** enabling unqualified symbol resolution with network symbol ***
      *** server shares in the symbol path may cause the debugger to ***
      *** appear to hang for long periods of time when an incorrect ***
      *** symbol name is typed or the network symbol server is down. ***
      *** ***
      *** For some commands to work properly, your symbol path ***
      *** must point to .pdb files that have full type information. ***
      *** ***
      *** Certain .pdb files (such as the public OS symbols) do not ***
      *** contain the required information. Contact the group that ***
      *** provided you with these symbols if you need this command to ***
      *** work. ***
      *** ***
      *** Type referenced: nt!_KPRCB ***
      *** ***
      *************************************************************************
      *************************************************************************
      *** ***
      *** ***
      *** Either you specified an unqualified symbol, or your debugger ***
      *** doesn’t have full symbol information. Unqualified symbol ***
      *** resolution is turned off by default. Please either specify a ***
      *** fully qualified symbol module!symbolname, or enable resolution ***
      *** of unqualified symbols by typing “.symopt- 100”. Note that ***
      *** enabling unqualified symbol resolution with network symbol ***
      *** server shares in the symbol path may cause the debugger to ***
      *** appear to hang for long periods of time when an incorrect ***
      *** symbol name is typed or the network symbol server is down. ***
      *** ***
      *** For some commands to work properly, your symbol path ***
      *** must point to .pdb files that have full type information. ***
      *** ***
      *** Certain .pdb files (such as the public OS symbols) do not ***
      *** contain the required information. Contact the group that ***
      *** provided you with these symbols if you need this command to ***
      *** work. ***
      *** ***
      *** Type referenced: nt!_KPRCB ***
      *** ***
      *************************************************************************
      *************************************************************************
      *** ***
      *** ***
      *** Either you specified an unqualified symbol, or your debugger ***
      *** doesn’t have full symbol information. Unqualified symbol ***
      *** resolution is turned off by default. Please either specify a ***
      *** fully qualified symbol module!symbolname, or enable resolution ***
      *** of unqualified symbols by typing “.symopt- 100”. Note that ***
      *** enabling unqualified symbol resolution with network symbol ***
      *** server shares in the symbol path may cause the debugger to ***
      *** appear to hang for long periods of time when an incorrect ***
      *** symbol name is typed or the network symbol server is down. ***
      *** ***
      *** For some commands to work properly, your symbol path ***
      *** must point to .pdb files that have full type information. ***
      *** ***
      *** Certain .pdb files (such as the public OS symbols) do not ***
      *** contain the required information. Contact the group that ***
      *** provided you with these symbols if you need this command to ***
      *** work. ***
      *** ***
      *** Type referenced: nt!_KPRCB ***
      *** ***
      *************************************************************************
      *************************************************************************
      *** ***
      *** ***
      *** Either you specified an unqualified symbol, or your debugger ***
      *** doesn’t have full symbol information. Unqualified symbol ***
      *** resolution is turned off by default. Please either specify a ***
      *** fully qualified symbol module!symbolname, or enable resolution ***
      *** of unqualified symbols by typing “.symopt- 100”. Note that ***
      *** enabling unqualified symbol resolution with network symbol ***
      *** server shares in the symbol path may cause the debugger to ***
      *** appear to hang for long periods of time when an incorrect ***
      *** symbol name is typed or the network symbol server is down. ***
      *** ***
      *** For some commands to work properly, your symbol path ***
      *** must point to .pdb files that have full type information. ***
      *** ***
      *** Certain .pdb files (such as the public OS symbols) do not ***
      *** contain the required information. Contact the group that ***
      *** provided you with these symbols if you need this command to ***
      *** work. ***
      *** ***
      *** Type referenced: nt!_KPRCB ***
      *** ***
      *************************************************************************
      *************************************************************************
      *** ***
      *** ***
      *** Either you specified an unqualified symbol, or your debugger ***
      *** doesn’t have full symbol information. Unqualified symbol ***
      *** resolution is turned off by default. Please either specify a ***
      *** fully qualified symbol module!symbolname, or enable resolution ***
      *** of unqualified symbols by typing “.symopt- 100”. Note that ***
      *** enabling unqualified symbol resolution with network symbol ***
      *** server shares in the symbol path may cause the debugger to ***
      *** appear to hang for long periods of time when an incorrect ***
      *** symbol name is typed or the network symbol server is down. ***
      *** ***
      *** For some commands to work properly, your symbol path ***
      *** must point to .pdb files that have full type information. ***
      *** ***
      *** Certain .pdb files (such as the public OS symbols) do not ***
      *** contain the required information. Contact the group that ***
      *** provided you with these symbols if you need this command to ***
      *** work. ***
      *** ***
      *** Type referenced: nt!_KTHREAD ***
      *** ***
      *************************************************************************

       

      avatar
    • #1558083
      Ingmar Koecher
      Participant
      Member Points: 61
      Rank: 1

      It’s a bit difficult to determine the cause from the windbg output, but since it’s likely a driver issue … have you verified that you have the latest drivers and firmware installed for the various hardware components on your HP server?

      avataravatar
    • #1558084
      Peter Line
      Participant
      Member Points: 321
      Rank: 2

      Hi Ingmar, yes I agree with that statement RE: Hard to determine cause from the output!

      And yes, I did go through device manager and manually request latest updates for each individual driver requirement. Also ran a manual firmware update on the server to ensure latest installed.

      I’m wondering if it could a (lack of) memory issue?  It’s got only 8GB installed and it’s running everything – it’s a DC, file and print, back ups (storage craft). Seems to sit frequently on 85-90% used memory.

      avatar
Viewing 3 reply threads
  • You must be logged in to reply to this topic.
© 4sysops 2006 - 2022

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account