Answered by:
DUMP Analysis

Question
-
Hi All,
Am facing a repeated unexpected shutdown of one server 2003 R2 Sp1 , I have configured Minidump on the server and analysed the minidumb. The Last cause i could find is
"BSOD - NDIS.sys is probable cause"
Loading Dump File [C:\Documents and Settings\Administrator\Desktop\Toolket\Minidump\Mini052009-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed May 20 15:44:13.508 2009 (GMT+10)
System Uptime: 9 days 5:09:51.171
Loading Kernel Symbols
...............................................................
........................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000C5, {a4, 2, 1, 808933b7}
Probably caused by : NDIS.sys ( NDIS!ndisWorkerThread+4a )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 000000a4, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 808933b7, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExAllocatePoolWithTag+83f
808933b7 897004 mov dword ptr [eax+4],esi
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 80938559 to 808933b7
STACK_TEXT:
bae8db8c 80938559 00000000 00000000 e5726854 nt!ExAllocatePoolWithTag+0x83f
bae8dbb0 80938c79 858acfa0 8cfe1c00 00000000 nt!ObpAllocateObject+0xc9
bae8dbe4 80948dd3 8cfe1c00 8d1616f8 00000000 nt!ObCreateObject+0x129
bae8dd4c 80949ea9 bae8ddb4 001f03ff 00000000 nt!PspCreateThread+0xb9
bae8dd80 baf3e058 bae8ddb4 001f03ff 00000000 nt!PsCreateSystemThread+0x33
bae8ddac 80948bb2 00003690 00000000 00000000 NDIS!ndisWorkerThread+0x4a
bae8dddc 8088d4d2 baf3e005 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
NDIS!ndisWorkerThread+4a
baf3e058 85c0 test eax,eax
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: NDIS!ndisWorkerThread+4a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: NDIS
IMAGE_NAME: NDIS.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 42435dfa
FAILURE_BUCKET_ID: 0xC5_2_NDIS!ndisWorkerThread+4a
BUCKET_ID: 0xC5_2_NDIS!ndisWorkerThread+4a
Followup: MachineOwner- Moved by Kukjin LeeMicrosoft employee Thursday, May 21, 2009 2:18 AM to find a right forum (From:Windows Perfmon and Diagnostic Tools)
Thursday, May 21, 2009 1:50 AM
Answers
-
Pick a forum here: http://social.technet.microsoft.com/Forums/en-US/category/windowsserver
Ed Price (a.k.a User Ed), SQL Server Customer Program Manager (Blog, Small Basic, Wiki Ninjas, Wiki)
Answer an interesting question? Create a wiki article about it!- Proposed as answer by Ed Price - MSFTMicrosoft employee Sunday, April 14, 2013 4:45 AM
- Marked as answer by Zoltán HorváthMVP Sunday, April 21, 2013 6:40 AM
Sunday, April 14, 2013 4:45 AM
All replies
-
Thank you for visiting the Microsoft forum. This forum focuses on Perfmon and diagnostic tools. I am moving your question to the moderator forum ("Where is the forum for..?"). The owner of the forum will direct you to a right forum.
Thanks.
Kukjin LeeThursday, May 21, 2009 2:18 AM -
Pick a forum here: http://social.technet.microsoft.com/Forums/en-US/category/windowsserver
Ed Price (a.k.a User Ed), SQL Server Customer Program Manager (Blog, Small Basic, Wiki Ninjas, Wiki)
Answer an interesting question? Create a wiki article about it!- Proposed as answer by Ed Price - MSFTMicrosoft employee Sunday, April 14, 2013 4:45 AM
- Marked as answer by Zoltán HorváthMVP Sunday, April 21, 2013 6:40 AM
Sunday, April 14, 2013 4:45 AM