none
Windows Server 2003 - Regular Shutdown with Event ID 1003 RRS feed

  • 问题

  • Our Windows Server 2003 does a regular shotwdown -> once a month up to once every week.
    We cant find a solution to that problem and need help. apreceating your thoughts about
    that specific error.

    Source System Error
    Category 102
    Event ID 1003

    Description:

    Error code 0000000a, parameter1 00000008, parameter2 d0000002, parameter3 00000000, parameter4 808522f6.

    0000: 53 79 73 74 65 6d 20 45   System E
    0008: 72 72 6f 72 20 20 45 72   rror  Er
    0010: 72 6f 72 20 63 6f 64 65   ror code
    0018: 20 30 30 30 30 30 30 30    0000000
    0020: 61 20 20 50 61 72 61 6d   a  Param
    0028: 65 74 65 72 73 20 30 30   eters 00
    0030: 30 30 30 30 30 38 2c 20   000008,
    0038: 64 30 30 30 30 30 30 32   d0000002
    0040: 2c 20 30 30 30 30 30 30   , 000000
    0048: 30 30 2c 20 38 30 38 35   00, 8085
    0050: 32 32 66 36               22f6   

    regards

    Many Thanks .

    2012年8月6日 6:03

答案

  • 您好!

    我们建议您尝试以下步骤进行排错:

    1. 到微软网站下载并安装系统补丁。

    2. 请暂时卸载最近安装的第三方软件,查看问题是否依然存在。

    3. 建议您尝试一次Clean Boot

    a. 运行MSCONFIG

    b. 在常规下选择 选择性启动

    c. 然后清除Process System.ini File, Process Win.ini FileLoad Startup Items 的复选框,但是保留使用原始Boot.ini

    d. 在服务下,先点隐藏所有windows 服务,然后选择 disable all.

    e. 然后重新启动。观察问题是否依旧发生。

    希望我的回答对您有所帮助,如果有什么不清楚的地方,请您告诉我。


    如果您对我们的论坛在线支持服务有任何的意见或建议,请通过邮件告诉我们。
    Description: Description: TechNet 论坛好帮手立刻免费下载  TechNet 论坛好帮手

    • 已标记为答案 泡泡熊 2012年8月23日 4:07
    2012年8月7日 9:09
    版主

全部回复

  • It need domp file to analyze the the reason why the server always restart

    And if u will , u can disable automatic updates and unistall anti-virus to confirm this would not happen!


    ITPRO 的价值在于分享,程序开发人员的价值在于创造,架构师分析师的价值在于分析出客户潜在需求,项目经理的价值就是搞定客户! ___________________________________________________________ MSN:fogyisland_x@htomai.com QQ:10853913 Blog:http://blog.csdn.net/fogyisland2000 技术超级500人群:66140619 Linkedin:http://cn.linkedin.com/pub/peng-xu/2a/358/22 新浪微博账号:fogyisland 求粉 如果一个人将知识带入坟墓,他是可耻的。所以知识需要分享!

    2012年8月6日 8:26
    版主
  • 谢谢你的提示,看了各种LOG,应该是symantec anti-virus 的全盘扫描任务启动导致机器蓝屏而异常重起的。搞不明白,就一个anti-virus 的全盘扫描,会导致机器异常重起!DMP文件搞不懂啊,让你见笑了~
    2012年8月6日 9:49
  • 您好!

    我们建议您尝试以下步骤进行排错:

    1. 到微软网站下载并安装系统补丁。

    2. 请暂时卸载最近安装的第三方软件,查看问题是否依然存在。

    3. 建议您尝试一次Clean Boot

    a. 运行MSCONFIG

    b. 在常规下选择 选择性启动

    c. 然后清除Process System.ini File, Process Win.ini FileLoad Startup Items 的复选框,但是保留使用原始Boot.ini

    d. 在服务下,先点隐藏所有windows 服务,然后选择 disable all.

    e. 然后重新启动。观察问题是否依旧发生。

    希望我的回答对您有所帮助,如果有什么不清楚的地方,请您告诉我。


    如果您对我们的论坛在线支持服务有任何的意见或建议,请通过邮件告诉我们。
    Description: Description: TechNet 论坛好帮手立刻免费下载  TechNet 论坛好帮手

    • 已标记为答案 泡泡熊 2012年8月23日 4:07
    2012年8月7日 9:09
    版主
  • 你好,自动重启的问题又出现了,和之前还是一样的ERROR,我截取了他的DUMP文件,可否帮忙看一下?有没有解决方法?

    Microsoft (R) Windows Debugger  Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\DUMP FILE\H3NGDCSHP02\MEMORY\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (12 procs) Free x86 compatible
    Product: Server, suite: TerminalServer SingleUserTS
    Built by: 3790.srv03_sp2_gdr.101019-0340
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
    Debug session time: Sat Sep  1 04:04:10.290 2012 (GMT+8)
    System Uptime: 74 days 3:50:15.004
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
    Loading Kernel Symbols
    ............................................................................................................
    Loading User Symbols

    Loading unloaded module list
    ..................................................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {2, a1ce, 182b58, 8}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    Probably caused by : ntkrpamp.exe ( nt!NtFreeVirtualMemory+e991 )

    Followup: MachineOwner
    ---------

    11: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc).  If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000002, A list entry was corrupt
    Arg2: 0000a1ce, entry in list being removed
    Arg3: 00182b58, highest physical page number
    Arg4: 00000008, reference count of entry being removed

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************

    MODULE_NAME: nt

    FAULTING_MODULE: 80800000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  4cbda48f

    DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

    BUGCHECK_STR:  0x4E

    LAST_CONTROL_TRANSFER:  from 80865f91 to 80827c83

    STACK_TEXT: 
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f790a510 80865f91 0000004e 00000002 0000a1ce nt!KeBugCheckEx+0x1b
    f790a55c 8081194d de6d4000 00000001 e13841a0 nt!NtFreeVirtualMemory+0xe991
    f790a5a4 808b6557 89cca500 e13841a0 00001000 nt!CcSetFileSizes+0x3ab
    f790a608 f7b1e7e0 89cca500 e13841a0 00001000 nt!CcPreparePinWrite+0x41
    f790a680 f7b1e933 e1384160 e1460000 00003b60 Ntfs!LfsGetLbcb+0x3f
    f790a694 f7b1dce4 e1384160 000022e8 e1460000 Ntfs!LfsPrepareLfcbForLogRecord+0x4a
    f790a6e4 f7b1e6f7 e1384160 e146b1d8 00000002 Ntfs!LfsWriteLogRecordIntoLogPage+0x5c
    f790a7c0 f7b1e1ba e146b1d8 00000002 f790a890 Ntfs!LfsWrite+0x305
    f790a950 f7b156db f790ac28 89ccccf0 00000000 Ntfs!NtfsWriteLog+0x75e
    f790abf4 f7b14b2d f790ac28 89ccc100 00000000 Ntfs!NtfsCheckpointVolume+0xff5
    f790ad80 80880499 00000000 00000000 8bd73020 Ntfs!NtfsCheckpointAllVolumes+0xd2
    f790adac 80949c88 00000000 00000000 00000000 nt!ExQueueWorkItem+0x1e3
    f790addc 8088e0e2 808803ae 00000000 00000000 nt!PsRemoveCreateThreadNotifyRoutine+0x21e
    00000000 00000000 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x572


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!NtFreeVirtualMemory+e991
    80865f91 33c0            xor     eax,eax

    SYMBOL_STACK_INDEX:  1

    FOLLOWUP_NAME:  MachineOwner

    IMAGE_NAME:  ntkrpamp.exe

    SYMBOL_NAME:  nt!NtFreeVirtualMemory+e991

    BUCKET_ID:  WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    11: kd> lmvm nt
    start    end        module name
    80800000 80a5a000   nt         (export symbols)       ntkrpamp.exe
        Loaded symbol image file: ntkrpamp.exe
        Image path: ntkrpamp.exe
        Image name: ntkrpamp.exe
        Timestamp:        Tue Oct 19 22:00:47 2010 (4CBDA48F)
        CheckSum:         0023FE46
        ImageSize:        0025A000
        File version:     5.2.3790.4789
        Product version:  5.2.3790.4789
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        1.0 App
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     ntkrpamp.exe
        OriginalFilename: ntkrpamp.exe
        ProductVersion:   5.2.3790.4789
        FileVersion:      5.2.3790.4789 (srv03_sp2_gdr.101019-0340)
        FileDescription:  NT Kernel & System
        LegalCopyright:   © Microsoft Corporation. All rights reserved.

    2012年9月3日 7:22