#1
  1. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Jan 2013
    Posts
    14
    Rep Power
    0

    Win2K advance Server Crashed sporadically


    This is what I got from windebug MiniDump
    Please help!!!


    Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINNT\Minidump\Mini011013-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\Symbols
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: symbols timestamp is wrong 0x45ec3c9d 0x384d9b17 for ntoskrnl.exe
    Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible
    Machine Name:
    Kernel base = 0x80400000 PsLoadedModuleList = 0x80488fa0
    Debug session time: Thu Jan 10 18:17:08.918 2013 (GMT-8)
    System Uptime: not available
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: symbols timestamp is wrong 0x45ec3c9d 0x384d9b17 for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ........................................
    Loading User Symbols
    Loading unloaded module list
    ...........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {9dabc104, 2, 1, 8045ed5e}

    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    Probably caused by : ntoskrnl.exe ( nt!_woutput+c9 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 9dabc104, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 8045ed5e, address which referenced memory

    Debugging Details:
    ------------------

    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************

    WRITE_ADDRESS: unable to read from 8047edb4
    unable to read from 8047e864
    unable to read from 8047e738
    unable to read from 8046a85c
    unable to read from 8047e750
    unable to read from 8047e860
    unable to read from 80471038
    unable to read from 8047e8dc
    unable to read from 8047ed80
    9dabc104

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!_woutput+c9
    8045ed5e ?? ???

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    LAST_CONTROL_TRANSFER: from 00000000 to 8046e15c

    STACK_TEXT:
    ebc83bc4 00000000 9dabc104 00000002 00000001 nt!KiDoubleFaultStack+0x111c


    STACK_COMMAND: .bugcheck ; kb

    FOLLOWUP_IP:
    nt!_woutput+c9
    8045ed5e ?? ???

    SYMBOL_NAME: nt!_woutput+c9

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 45ec3c9d

    FAILURE_BUCKET_ID: 0xA_nt!_woutput+c9

    BUCKET_ID: 0xA_nt!_woutput+c9

    Followup: MachineOwner
    ---------
  2. #2
  3. Devshed Beginner (1000 - 1499 posts)

    Join Date
    Jan 2004
    Location
    New Springfield, OH
    Posts
    1,177
    Rep Power
    1469
    That bugcheck has to do with either a faulty driver, service, or incorrect BIOS settings.

    Have you updated anything recently or installed any new programs?

    Start by checking event logs around the time of the restart to see if any device drivers or services are showing errors. This will typically begin pointing you in the right direction. You should also check to see if Windows Update has installed any new updates recently. (Not likely the case given the age of your system.)

    I would also restart your system and watch the BIOS message or enter CMOS setup to see if your BIOS has the correct time and date. If not, this could indicate a failing CMOS battery that has allowed your BIOS settings to revert to system defaults.

    If you haven't updated anything or installed any programs, and none of the above show anything, then you should test your RAM and hard drive. Inability to write to the page file can also cause this error under very specific circumstances. Again, given the age of the system, I would not rule out hardware failure as a possibility.
    Don't like me? Click it.

    Scripting problems? Windows questions? Ask the Windows Guru!

    Stay up to date with all of my latest content. Follow me on Twitter!

    Help us help you! Post your exact error message with these easy tips!
  4. #3
  5. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Jan 2013
    Posts
    14
    Rep Power
    0
    by the way, I have replaced all new FB-RAM already and still experiencing crashed.
  6. #4
  7. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Jan 2013
    Posts
    14
    Rep Power
    0
    Thanks a quick replied.

    Unfortunately, I started to work here about a month and all events has been cleared out.
    I will check bios the next time I restart the server. As for right now, there are lot of clients on it.

    The drives are set at RAID 1, so if I want to replace both drive, should I just hot swap by pulling out Drive 1 then putting in the drive new drive in and wait till the mirror is done then do the same to drive 0?
  8. #5
  9. Devshed Beginner (1000 - 1499 posts)

    Join Date
    Jan 2004
    Location
    New Springfield, OH
    Posts
    1,177
    Rep Power
    1469
    Originally Posted by et7223
    The drives are set at RAID 1, so if I want to replace both drive, should I just hot swap by pulling out Drive 1 then putting in the drive new drive in and wait till the mirror is done then do the same to drive 0?
    That's typically the easiest way. But I wouldn't hot swap unless you have hot swappable hardware. Otherwise, shut it down while removing and replacing drives.

    Since your are using RAID, I would check the RAID controller before the drives. It's the more likely culprit.
    Don't like me? Click it.

    Scripting problems? Windows questions? Ask the Windows Guru!

    Stay up to date with all of my latest content. Follow me on Twitter!

    Help us help you! Post your exact error message with these easy tips!
  10. #6
  11. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Jan 2013
    Posts
    14
    Rep Power
    0
    I noticed on every event that recorded server restarted unexpectedly, and, there's always an event network load balance created id..
    So I unteam the network cards and will see how that go.

    Thanks for you help. I will report back if no crash for a week or so..
  12. #7
  13. No Profile Picture
    Stumpier old Moderator
    Devshed Supreme Being (6500+ posts)

    Join Date
    Jun 2003
    Posts
    14,409
    Rep Power
    4538
    Maybe it's time for a server upgrade. W2K server extended support ended in 2010 afaik.

    Comments on this post

    • Nilpo agrees : It was something like that. Definitely time to start looking.
    ======
    Doug G
    ======
    It is a truism of American politics that no man who can win an election deserves to. --Trevanian, from the novel Shibumi
  14. #8
  15. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Jan 2013
    Posts
    14
    Rep Power
    0
    Thank you all for your time.

    I think I solved the problem. So far no crash for a whole 7 days straight after I broke the Intel NIC TEAMING.
  16. #9
  17. Devshed Beginner (1000 - 1499 posts)

    Join Date
    Jan 2004
    Location
    New Springfield, OH
    Posts
    1,177
    Rep Power
    1469
    Great! Thanks for posting back to let us know.
    Don't like me? Click it.

    Scripting problems? Windows questions? Ask the Windows Guru!

    Stay up to date with all of my latest content. Follow me on Twitter!

    Help us help you! Post your exact error message with these easy tips!

IMN logo majestic logo threadwatch logo seochat tools logo