none
Win 2003 server 蓝屏 DMP文件错误分析结果:Symevent.sys(Symevent+78el) RRS feed

  • 问题

  •    Win 2003 server 蓝屏,总共发生5次,第一次发生在2012年2月份,第二次4月份,第三次6月30日,第四次7月10日,第五次7月16日。频率越来越高。

    重启服务器后系统自动创建错误日志,在小内存转储里面找到问题的DMP文件后,使用Windbg软件分析后的代码如下:

    Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
    Copyright (c) Microsoft Corporation. All rights reserved.
    Loading Dump File [C:\Documents and Settings\Administrator\桌面\efpm\Mini071012-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is: 
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x86 compatible
    Product: Server, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
    Debug session time: Tue Jul 10 11:53:14.517 2012 (GMT+8)
    System Uptime: 6 days 21:52:57.905
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ...................................................
    Loading User Symbols
    Loading unloaded module list
    ...............
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 1000007F, {8, f772ffe0, 0, 0}
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
    *** WARNING: Unable to verify timestamp for fltmgr.sys
    *** ERROR: Module load completed but symbols could not be loaded for fltmgr.sys
    *** WARNING: Unable to verify timestamp for SYMEVENT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
    *** WARNING: Unable to verify timestamp for Ntfs.sys
    *** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
    *** WARNING: Unable to verify timestamp for savrt.sys
    *** ERROR: Module load completed but symbols could not be loaded for savrt.sys
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Probably caused by : SYMEVENT.SYS ( SYMEVENT+78e1 )
    Followup: MachineOwner
    ---------

    其中最主要的信息是:Probably caused by : SYMEVENT.SYS ( SYMEVENT+78e1 )

    请高手帮忙分析下,是什么原因?能解决吗?如何解决? 非常感谢!

    操作系统:win2003 server r2 standard edition 英文版

    硬件:HPDL380G5

    2012年7月16日 7:22

答案

  • 您好!

    由于对于蓝屏问题进行排错的步骤比较复杂,很可能需要分析dump文件,我们无法在论坛中为您提供技术支持。为了让您的问题得到及时解决,我建议您使用微软为正版用户提供的8008203800技术支持专线,以便于更好的沟通和交流。以下我提供一些建议,仅供您参考:

    1. 我建议您尝试一次Clean Boot,如果启动的程序太多,这使系统资源消耗殆尽,使个别程序需要的数据在内存或虚拟内存中找不到,也会出现异常错误。

    Clean Boot具体步骤:

    a. 运行MSCONFIG

    b. 在常规下选择 选择性启动。

    c. 然后清除Process System.ini File, Process Win.ini FileLoad Startup Items 的复选框,但是保留使用原始Boot.ini

    d. 在服务下,先点隐藏所有windows 服务,然后选择 disable all

    e. 然后重新启动。观察问题是否依旧发生。

    2. 有些应用程序需调用特定版本的动态链接库DLL,如果在安装软件时,旧版本的DLL覆盖了新版本的DLL,或者删除应用程序时,误删了有用的DLL文件,就可能使上述调用失败,从而出现“蓝屏”。不妨重新安装试一试。如果安装了新的硬件常常出现“蓝屏”,那多半与主板的BIOS或驱动程序太旧有关,以致不能很好支持硬件。如果你的主板支持BIOS升级,应尽快升级到最新版本或安装最新的设备驱动程序。

    3. 硬件故障也会引起的蓝屏问题,建议您先卸载最近安装的硬件,察看问题是否依然存在。

    4. 到以下网站做一个病毒的在线扫描,这些在线扫描有时候是非常有用的,因为机器上的防病毒软件也有可能被感染,但是在线查毒的引擎不会被感染:
    Trend
    http://www.housecall.antivirus.com
    MacAfee:
    http://www.mcafee.com

    感谢您的理解和支持。


    如果您对我们的论坛在线支持服务有任何的意见或建议,请通过邮件告诉我们。
    Description: Description: TechNet 论坛好帮手立刻免费下载  TechNet 论坛好帮手

    2012年7月17日 8:49
    版主

全部回复

  • 楼主服务器上是不是安装了赛门铁克的相关软件?如果有请在安全模式下卸载,并观察下是否还会蓝屏。

    在IT的路上,You'll never walk alone

    2012年7月17日 1:29
  • 您好!

    由于对于蓝屏问题进行排错的步骤比较复杂,很可能需要分析dump文件,我们无法在论坛中为您提供技术支持。为了让您的问题得到及时解决,我建议您使用微软为正版用户提供的8008203800技术支持专线,以便于更好的沟通和交流。以下我提供一些建议,仅供您参考:

    1. 我建议您尝试一次Clean Boot,如果启动的程序太多,这使系统资源消耗殆尽,使个别程序需要的数据在内存或虚拟内存中找不到,也会出现异常错误。

    Clean Boot具体步骤:

    a. 运行MSCONFIG

    b. 在常规下选择 选择性启动。

    c. 然后清除Process System.ini File, Process Win.ini FileLoad Startup Items 的复选框,但是保留使用原始Boot.ini

    d. 在服务下,先点隐藏所有windows 服务,然后选择 disable all

    e. 然后重新启动。观察问题是否依旧发生。

    2. 有些应用程序需调用特定版本的动态链接库DLL,如果在安装软件时,旧版本的DLL覆盖了新版本的DLL,或者删除应用程序时,误删了有用的DLL文件,就可能使上述调用失败,从而出现“蓝屏”。不妨重新安装试一试。如果安装了新的硬件常常出现“蓝屏”,那多半与主板的BIOS或驱动程序太旧有关,以致不能很好支持硬件。如果你的主板支持BIOS升级,应尽快升级到最新版本或安装最新的设备驱动程序。

    3. 硬件故障也会引起的蓝屏问题,建议您先卸载最近安装的硬件,察看问题是否依然存在。

    4. 到以下网站做一个病毒的在线扫描,这些在线扫描有时候是非常有用的,因为机器上的防病毒软件也有可能被感染,但是在线查毒的引擎不会被感染:
    Trend
    http://www.housecall.antivirus.com
    MacAfee:
    http://www.mcafee.com

    感谢您的理解和支持。


    如果您对我们的论坛在线支持服务有任何的意见或建议,请通过邮件告诉我们。
    Description: Description: TechNet 论坛好帮手立刻免费下载  TechNet 论坛好帮手

    2012年7月17日 8:49
    版主
  •    Win 2003 server 蓝屏,总共发生5次,第一次发生在2012年2月份,第二次4月份,第三次6月30日,第四次7月10日,第五次7月16日。频率越来越高。

    重启服务器后系统自动创建错误日志,在小内存转储里面找到问题的DMP文件后,使用Windbg软件分析后的代码如下:

    Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
    Copyright (c) Microsoft Corporation. All rights reserved.
    Loading Dump File [C:\Documents and Settings\Administrator\桌面\efpm\Mini071012-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is: 
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x86 compatible
    Product: Server, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
    Debug session time: Tue Jul 10 11:53:14.517 2012 (GMT+8)
    System Uptime: 6 days 21:52:57.905
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ...................................................
    Loading User Symbols
    Loading unloaded module list
    ...............
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 1000007F, {8, f772ffe0, 0, 0}
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
    *** WARNING: Unable to verify timestamp for fltmgr.sys
    *** ERROR: Module load completed but symbols could not be loaded for fltmgr.sys
    *** WARNING: Unable to verify timestamp for SYMEVENT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
    *** WARNING: Unable to verify timestamp for Ntfs.sys
    *** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
    *** WARNING: Unable to verify timestamp for savrt.sys
    *** ERROR: Module load completed but symbols could not be loaded for savrt.sys
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Probably caused by : SYMEVENT.SYS ( SYMEVENT+78e1 )
    Followup: MachineOwner
    ---------

    其中最主要的信息是:Probably caused by : SYMEVENT.SYS ( SYMEVENT+78e1 )

    请高手帮忙分析下,是什么原因?能解决吗?如何解决? 非常感谢!

    操作系统:win2003 server r2 standard edition 英文版

    硬件:HPDL380G5

    兄弟啊,你连symbol都没配。。。这。。。

    .symfix然后.reload一把再analyze -v吧。。。(前提你能上网哦,.symfix会帮你指向Microsoft Public Symbol)

    2012年7月19日 3:04