登入
Microsoft.com
 
Microsoft
 
 
 

locked
Windows Server 2003 Unexpected Shutdown RRS feed

 > 

  • 問題

  • Question
    登入以投票
    0
    登入以投票
    My windows 2003 server unexpected shutdown last week. I check the memory dump file, found below information:

    BugCheck 7E, {c0000005, 80819fe8, f7912ac8, f79127c4}
    Probably caused by : ntkrpamp.exe

    I search from Microsoft but only found some related to windows XP. Grateful if anyone could help on this issue. It occurs 2 times within a month.

    Below is the memory dump file:

    Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\cicadmin\桌面\新資料夾\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    WARNING: Whitespace at end of path element
    Symbol search path is: http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
    Product: Server, suite: TerminalServer SingleUserTS
    Built by: 3790.srv03_sp2_gdr.090805-1438
    Machine Name:
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
    Debug session time: Fri Apr 15 16:49:04.386 2011 (UTC + 8:00)
    System Uptime: 34 days 19:07:48.765
    Loading Kernel Symbols
    ...............................................................
    ...........................................................
    Loading User Symbols

    Loading unloaded module list
    ..................................................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 7E, {c0000005, 80819fe8, f7912ac8, f79127c4}

    Probably caused by : ntkrpamp.exe ( nt!FsRtlLookupPerStreamContextInternal+4a )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 80819fe8, The address that the exception occurred at
    Arg3: f7912ac8, Exception Record Address
    Arg4: f79127c4, Context Record Address

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    FAULTING_IP:
    nt!FsRtlLookupPerStreamContextInternal+4a
    80819fe8 395008 cmp dword ptr [eax+8],edx

    EXCEPTION_RECORD: f7912ac8 -- (.exr 0xfffffffff7912ac8)
    ExceptionAddress: 80819fe8 (nt!FsRtlLookupPerStreamContextInternal+0x0000004a)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 00000008
    Attempt to read from address 00000008

    CONTEXT: f79127c4 -- (.cxr 0xfffffffff79127c4)
    eax=00000000 ebx=85ea71b0 ecx=e9f99bd4 edx=8a871828 esi=e9f99ba8 edi=00000000
    eip=80819fe8 esp=f7912b90 ebp=f7912b9c iopl=0 nv up ei pl nz ac po cy
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010213
    nt!FsRtlLookupPerStreamContextInternal+0x4a:
    80819fe8 395008 cmp dword ptr [eax+8],edx ds:0023:00000008=????????
    Resetting default scope

    PROCESS_NAME: System

    CURRENT_IRQL: 1

    ERROR_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    EXCEPTION_PARAMETER1: 00000000

    EXCEPTION_PARAMETER2: 00000008

    READ_ADDRESS: 00000008

    FOLLOWUP_IP:
    nt!FsRtlLookupPerStreamContextInternal+4a
    80819fe8 395008 cmp dword ptr [eax+8],edx

    BUGCHECK_STR: 0x7E

    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

    LAST_CONTROL_TRANSFER: from f7866884 to 80819fe8

    STACK_TEXT:
    f7912b9c f7866884 e9f99ba8 8a871828 00000000 nt!FsRtlLookupPerStreamContextInternal+0x4a
    f7912c00 f7878f43 8a871828 874a9a70 00000000 fltMgr!FltpGetStreamListCtrl+0x5a
    f7912c1c f7861337 8a871828 874a9a70 f7912cc0 fltMgr!FltpCleanupStreamListCtrlForFileObjectClose+0x17
    f7912c78 f7862f2a 00912cc0 870c8d08 f7912cc0 fltMgr!FltpPerformPreCallbacks+0x141
    f7912c8c f78638d2 f7912cc0 00000000 8a75f150 fltMgr!FltpPassThroughInternal+0x32
    f7912ca8 f7863ce3 f7912cc0 874a9a70 8aa9ae88 fltMgr!FltpPassThrough+0x1c2
    f7912cd8 8081df85 8a75f150 870c8b78 870c8b88 fltMgr!FltpDispatch+0x10d
    f7912cec 808f98e0 00000000 00000000 00000000 nt!IofCallDriver+0x45
    f7912d24 80933918 004a9a70 80a5ff00 874a9a58 nt!IopDeleteFile+0x13a
    f7912d40 8086c981 874a9a70 00000000 87de62f8 nt!ObpRemoveObjectRoutine+0xdc
    f7912d60 80841ded 80a5e540 87de62f8 808ab4d4 nt!ObfDereferenceObject+0x67
    f7912d8c 80843ab4 e888a0d0 00000000 8b37b2d0 nt!MiSegmentDelete+0xd3
    f7912dac 80949b80 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0xa6
    f7912ddc 8088e092 80843a0e 00000000 00000000 nt!PspSystemThreadStartup+0x2e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!FsRtlLookupPerStreamContextInternal+4a

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a799091

    STACK_COMMAND: .cxr 0xfffffffff79127c4 ; kb

    FAILURE_BUCKET_ID: 0x7E_nt!FsRtlLookupPerStreamContextInternal+4a

    BUCKET_ID: 0x7E_nt!FsRtlLookupPerStreamContextInternal+4a

    Followup: MachineOwner
    2011年4月21日 上午 03:40

解答

  • Question
    登入以投票
    0
    登入以投票

    Dear Customer,

     

    Thank you for your post.

     

    Based on the current information, I cannot determine the cause of the issue. I'd like to provide the following info for your reference:

     

    Info 1.

     

    Since this issue always caused by third party application, please perform a Clean Boot to see whether the problem persists.

     

         1. Click Start->Run...->type msconfig and press Enter

         2. Click Services tab and select Hide All Microsoft Services and Disable All third party Services.

         3. Click Startup tab and Disable All startup items

         4. Click OK and choose Restart

         5. After reboot, check whether the problem still occurs

         6. If there are no more problems, please use the above steps to enable services and startup items one by one in order to figure out the root cause of this issue.

     

    Info 2.

     

    Please send the application and system event log directly to the forum.

     

    Info 3.

     

    Please make sure that you've installed all security updates from Microsoft Update, and then check whether this issue  persists.

     

    Thanks for your cooperation and understanding.

     

     

    如果您对我们的论坛在线支持服务有任何的意见或建议，请通过邮件告诉我们。
    Description: Description: TechNet 论坛好帮手立刻免费下载  TechNet 论坛好帮手

    Tom Zhang – MSFT
    2011年4月27日 上午 09:31
    版主