none
H3C CAS 云平台 windows 2003 多次蓝屏 RRS feed

  • Frage

  • 在eventlog 内查看系统多次意外重启(蓝屏)

    在4月1日前事件查看器中发现了 相当多的ntfs相关报错! 多达千条 4月之后不再报此错误

    截止到8月9日 蓝屏dump 日志如下:

    (1)首先之前蓝屏报错体现了如下组件或系统文件有关

    1 netkvm.sys

    2 某个关于NDIS的组件

    3 Pool_Corruption 组件

    4 Idle

     

    (2) 此次dump日志内容如下:

    Microsoft (R) Windows Debugger Version 10.0.18206.1001 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\okami\Desktop\办公\杀杀杀\Mini080918-05.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       srv*
    Symbol search path is: srv*
    Executable search path is: 
    Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
    Product: Server, suite: Enterprise TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
    Debug session time: Thu Aug  9 13:23:33.734 2018 (UTC + 8:00)
    System Uptime: 0 days 1:16:45.757
    Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
    Loading Kernel Symbols
    ...............................................................
    ..............................................
    Loading User Symbols
    Loading unloaded module list
    ....
    
    ************* Symbol Loading Error Summary **************
    Module name            Error
    ntkrnlpa               The system cannot find the file specified
    
    You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
    You should also verify that your symbol search path (.sympath) is correct.
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck C5, {0, d0000002, 1, 808921dd}
    
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
    
    
    Probably caused by : ntoskrnl.wrong.symbols.exe ( nt_wrong_symbols!45D69710256000 )
    
    Followup:     MachineOwner
    ---------
    
    eax=f772713c ebx=d0000002 ecx=00000001 edx=00000000 esi=f7727120 edi=00000000
    eip=8088c963 esp=b8e7e990 ebp=b8e7e9a8 iopl=0         nv up ei ng nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000286
    nt+0x8c963:
    8088c963 833da0628a8000  cmp     dword ptr [nt+0xa62a0 (808a62a0)],0 ds:0023:808a62a0=????????
    1: kd> !anaylez
    No export anaylez found
    1: kd> !anaylez -v
    No export anaylez found
    1: kd> !analyze
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck C5, {0, d0000002, 1, 808921dd}
    
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
    
    
    Probably caused by : ntoskrnl.wrong.symbols.exe ( nt_wrong_symbols!45D69710256000 )
    
    Followup:     MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_CORRUPTED_EXPOOL (c5)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is
    caused by drivers that have corrupted the system pool.  Run the driver
    verifier against any new (or suspect) drivers, and if that doesn't turn up
    the culprit, then use gflags to enable special pool.
    Arguments:
    Arg1: 00000000, memory referenced
    Arg2: d0000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 808921dd, address which referenced memory
    
    Debugging Details:
    ------------------
    
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
    
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_EPROCESS                                  ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KTHREAD                                   ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    
    KEY_VALUES_STRING: 1
    
    
    STACKHASH_ANALYSIS: 1
    
    TIMELINE_ANALYSIS: 1
    
    
    DUMP_CLASS: 1
    
    DUMP_QUALIFIER: 400
    
    SYSTEM_MANUFACTURER:  QEMU
    
    SYSTEM_PRODUCT_NAME:  Standard PC (i440FX + PIIX, 1996)
    
    SYSTEM_VERSION:  pc-i440fx-2.1
    
    BIOS_VENDOR:  SeaBIOS
    
    BIOS_VERSION:  rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org
    
    BIOS_DATE:  04/01/2014
    
    ADDITIONAL_DEBUG_TEXT:  
    You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
    
    WRONG_SYMBOLS_TIMESTAMP: 45d69710
    
    WRONG_SYMBOLS_SIZE: 256000
    
    FAULTING_MODULE: 80800000 nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  45d69710
    
    DUMP_TYPE:  2
    
    BUGCHECK_P1: 0
    
    BUGCHECK_P2: ffffffffd0000002
    
    BUGCHECK_P3: 1
    
    BUGCHECK_P4: ffffffff808921dd
    
    BUGCHECK_STR:  45D69710
    
    CURRENT_IRQL:  0
    
    FAULTING_IP: 
    nt+921dd
    808921dd ??              ???
    
    CPU_COUNT: 4
    
    CPU_MHZ: 895
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: f
    
    CPU_MODEL: 6
    
    CPU_STEPPING: 3
    
    CPU_MICROCODE: 0,0,0,0 (F,M,S,R)  SIG: 1'00000000 (cache) 0'00000000 (init)
    
    CUSTOMER_CRASH_COUNT:  5
    
    ANALYSIS_SESSION_HOST:  DESKTOP-GOIBQT8
    
    ANALYSIS_SESSION_TIME:  08-09-2018 15:43:41.0410
    
    ANALYSIS_VERSION: 10.0.18206.1001 amd64fre
    
    LAST_CONTROL_TRANSFER:  from 808921dd to 8088c963
    
    STACK_TEXT:  
    WARNING: Stack unwind information not available. Following frames may be wrong.
    b8e7e9a8 808921dd badb0d00 8be51000 8cae9718 nt+0x8c963
    b8e7ea54 808928c3 808aeae0 8c32b000 8bed5f00 nt+0x921dd
    b8e7eaac f720cf14 8bed5f00 63694d46 00000000 nt+0x928c3
    b8e7eac8 f720f03f 8bed5f00 00000000 8c2f16f7 fltMgr+0x1f14
    b8e7eae0 f720f4f1 8bed5f5c 8c2f1588 b8e7eb20 fltMgr+0x403f
    b8e7eaf0 8081e103 8ca31020 8c2f1588 8bed5f00 fltMgr+0x44f1
    b8e7eb20 f7b501dc e2afa6c8 0000000e b8e7eb94 nt+0x1e103
    b8e7eb30 f7b9b678 8c9b4ef8 8c2f1588 00000000 Ntfs+0x61dc
    b8e7eb94 f7b53fd8 8c9b4ef8 8c2f1588 8caec188 Ntfs+0x51678
    b8e7ebfc 8081df65 8cae9718 8c2f1588 8c2f1588 Ntfs+0x9fd8
    b8e7ec10 f720fd28 8bed5f00 8cce4638 00000000 nt+0x1df65
    b8e7ec3c 8081df65 8caec188 8c2f1588 8c2f1588 fltMgr+0x4d28
    b8e7ec50 f720fb25 8ca31020 8c2f1588 8c3cf2c0 nt+0x1df65
    b8e7ec74 f720fcf5 b8e7ec94 8ca31020 00000000 fltMgr+0x4b25
    b8e7ecac 8081df65 8ca31020 8c2f1588 8c6217a0 fltMgr+0x4cf5
    b8e7ecc0 808f1081 b8e7ed64 00f2fac4 808f0ae2 nt+0x1df65
    b8e7ed48 8088978c 000006e8 00f2fae8 00f2faf0 nt+0xf1081
    b8e7ed64 7c9585ec badb0d00 00f2fab0 00000000 nt+0x8978c
    b8e7ed68 badb0d00 00f2fab0 00000000 00000000 0x7c9585ec
    b8e7ed6c 00f2fab0 00000000 00000000 00000000 0xbadb0d00
    b8e7ed70 00000000 00000000 00000000 00000000 0xf2fab0
    
    
    THREAD_SHA1_HASH_MOD_FUNC:  c705996dbe96129d1410883bbbe62705772023a0
    
    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  ed56162c73778ec7ccfd766145989bd3cf831379
    
    THREAD_SHA1_HASH_MOD:  c705996dbe96129d1410883bbbe62705772023a0
    
    FOLLOWUP_IP: 
    nt+921dd
    808921dd ??              ???
    
    SYMBOL_STACK_INDEX:  1
    
    FOLLOWUP_NAME:  MachineOwner
    
    STACK_COMMAND:  .thread ; .cxr ; kb
    
    EXCEPTION_CODE: (Win32) 0x45d69710 (1171691280) - <Unable to get error code text>
    
    EXCEPTION_CODE_STR:  45D69710
    
    EXCEPTION_STR:  WRONG_SYMBOLS
    
    PROCESS_NAME:  ntoskrnl.wrong.symbols.exe
    
    IMAGE_NAME:  ntoskrnl.wrong.symbols.exe
    
    MODULE_NAME: nt_wrong_symbols
    
    SYMBOL_NAME:  nt_wrong_symbols!45D69710256000
    
    BUCKET_ID:  WRONG_SYMBOLS_X86_TIMESTAMP_070217-054800
    
    DEFAULT_BUCKET_ID:  WRONG_SYMBOLS_X86_TIMESTAMP_070217-054800
    
    PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS
    
    FAILURE_BUCKET_ID:  WRONG_SYMBOLS_X86_TIMESTAMP_070217-054800_45D69710_nt_wrong_symbols!45D69710256000
    
    TARGET_TIME:  2018-08-09T05:23:33.000Z
    
    OSBUILD:  3790
    
    OSSERVICEPACK:  2000
    
    SERVICEPACK_NUMBER: 2
    
    OS_REVISION: 0
    
    SUITE_MASK:  274
    
    PRODUCT_TYPE:  3
    
    OSPLATFORM_TYPE:  x86
    
    OSNAME:  Windows Server 2003
    
    OSEDITION:  Windows Server 2003 Server (Service Pack 2) Enterprise TerminalServer SingleUserTS
    
    OS_LOCALE:  
    
    USER_LCID:  0
    
    OSBUILD_TIMESTAMP:  2007-02-17 13:48:00
    
    ANALYSIS_SESSION_ELAPSED_TIME:  f2
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:wrong_symbols_x86_timestamp_070217-054800_45d69710_nt_wrong_symbols!45d69710256000
    
    FAILURE_ID_HASH:  {c9bc7d79-7381-ab81-6881-5d3df90751ad}
    
    Followup:     MachineOwner
    ---------


    Donnerstag, 9. August 2018 08:09

Antworten

  • 你的 WinDBG 分析工具没有正确设置 Symbol 因此没有得到准确的分析结果,但是从 0x000000C5 错误提示看,一般是硬件兼容性问题或者硬件设备驱动程序不正确引起,包括虚拟设备驱动。

    鉴于之前经常出现 NTFS 报错,怀疑可能是磁盘的问题,看看服务器硬盘灯有没有报警。


    Alexis Zhang

    http://mvp.microsoft.com/zh-cn/mvp/Jie%20Zhang-4000545
    http://blogs.itecn.net/blogs/alexis

    推荐以 NNTP Bridge 桥接新闻组方式访问论坛。

    本帖是回复帖,原帖作者是楼上的 <Fan Yang2011>;

    | 在4月1日前事件查看器中发现了 相当多的ntfs相关报错! 多达千条 4月之后不再报此错误
    | 截止到8月9日 蓝屏dump 日志如下:

    Freitag, 10. August 2018 11:42
    Moderator

Alle Antworten

  • 你的 WinDBG 分析工具没有正确设置 Symbol 因此没有得到准确的分析结果,但是从 0x000000C5 错误提示看,一般是硬件兼容性问题或者硬件设备驱动程序不正确引起,包括虚拟设备驱动。

    鉴于之前经常出现 NTFS 报错,怀疑可能是磁盘的问题,看看服务器硬盘灯有没有报警。


    Alexis Zhang

    http://mvp.microsoft.com/zh-cn/mvp/Jie%20Zhang-4000545
    http://blogs.itecn.net/blogs/alexis

    推荐以 NNTP Bridge 桥接新闻组方式访问论坛。

    本帖是回复帖,原帖作者是楼上的 <Fan Yang2011>;

    | 在4月1日前事件查看器中发现了 相当多的ntfs相关报错! 多达千条 4月之后不再报此错误
    | 截止到8月9日 蓝屏dump 日志如下:

    Freitag, 10. August 2018 11:42
    Moderator
  • 这个问题后来解决了吗?


    Alexis Zhang

    http://mvp.microsoft.com/zh-cn/mvp/Jie%20Zhang-4000545
    http://blogs.itecn.net/blogs/alexis

    推荐以 NNTP Bridge 桥接新闻组方式访问论坛。

    本帖是回复帖,原帖作者是楼上的 <Fan Yang2011>;

    | 在eventlog 内查看系统多次意外重启(蓝屏)
    | 在4月1日前事件查看器中发现了 相当多的ntfs相关报错! 多达千条 4月之后不再报此错误

    Montag, 3. September 2018 12:16
    Moderator