none
服务器隔一段时间自动重启 RRS feed

  • 问题

  • 服务器:Windows server 2012

    日志如下:

    Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Users\WYF\Desktop\MEMORY.DMP]
    Kernel Bitmap Dump File: Only kernel address space is available

    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe -
    Windows 8 Kernel Version 9600 MP (12 procs) Free x64
    Product: Server, suite: TerminalServer DataCenter
    Built by: 9600.16384.amd64fre.winblue_rtm.130821-1623
    Machine Name:
    Kernel base = 0xfffff800`34810000 PsLoadedModuleList = 0xfffff800`34ad79b0
    Debug session time: Fri Feb 15 07:56:29.506 2019 (UTC + 8:00)
    System Uptime: 0 days 0:43:12.541
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe -
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ....
    Loading User Symbols

    Loading unloaded module list
    .....

    ************* Symbol Loading Error Summary **************
    Module name            Error
    ntkrnlmp               The system cannot find the file specified

    You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
    You should also verify that your symbol search path (.sympath) is correct.
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck D1, {ffffffffffdff3b0, 2, 0, fffff80002087a36}

    *** ERROR: Module load completed but symbols could not be loaded for srv.sys
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for srvnet.sys -
    *** ERROR: Module load completed but symbols could not be loaded for afd.sys
    *** ERROR: Module load completed but symbols could not be loaded for tcpip.sys
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for NDIS.SYS -
    *** ERROR: Module load completed but symbols could not be loaded for b57nd60a.sys
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    Probably caused by : srvnet.sys ( srvnet!SrvLibIsDottedQuadAddress+342 )

    Followup: MachineOwner
    ---------

    2019年2月15日 6:23

全部回复

  • 您好 王逸,

     

    在我们开始排查之前,请让我知道更多的信息来澄清我们的问题,您是否介意在方便的时候收集以下信息?感谢您的时间和努力。

    1. 在这个问题发生之前,最近安装/修改过任何软件/硬件吗?

    2. 检查您是否在使用最新的硬件驱动程序和最新更新。

     

    另外,根据您目前贴出来的信息,报的错是Bug Check 0xD1: DRIVER_IRQL_NOT_LESS_OR_EQUAL,这表明内核模式驱动程序试图在过高的进程IRQL中访问可分页内存。这种错误检查通常是由使用不正确地址的驱动程序引起的。我们也可以通过下列步骤排查一下可能的原因:

    1.检查Event Viewer中的系统日志,查看可能有助于识别导致此错误检查的设备或驱动程序的附加错误消息

    2.如果在错误检查消息中识别了驱动程序,则禁用该驱动程序或与制造商检查驱动程序更新。

    3.确认所安装的任何新硬件与已安装的Windows版本兼容。

    4.Minidump可能只包含有限的信息来分析当前的问题,请参考以下截图收集full dump来分析当前的问题。您可以上传至网络上的共享路径,以供参考分析。


    如果还有其他问题,请随时回复,感谢您选择微软。

     

    Best regards,

    Zoe Mo


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    2019年2月18日 9:51