[Løst]Trenger hjelp til tyde memory.dmp fil

[acer82]

Har en 2003 server som vi kjører PS4.0 på. Denne har en uvane med restarte i utide. Etter disse restartene genereres det en memory.dmp fil. Denne har jeg fått åpnet med Windows Debugger. Er det noen som kan tyde akkurat hva som generer disse restartene utifra denne rapporten?

 

Slik jeg leser meldingen ser det ut til å være minnerelatert, og det er Word som utløser restarten...

 

 

Microsoft ® Windows Debugger Version 6.9.0003.113 X86

Copyright © Microsoft Corporation. All rights reserved.

 

 

Loading Dump File [C:\WINDOWS\MEMORY.DMP]

Kernel Summary Dump File: Only kernel address space is available

 

Symbol search path is: SRV*c:\symcache*http://msdl.microsoft.com/download/symbols;C:\WINDOWS\symbols

Executable search path is:

Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible

Product: Server, suite: TerminalServer

Built by: 3790.srv03_rtm.030324-2048

Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8

Debug session time: Thu Oct 30 07:15:00.364 2008 (GMT+1)

System Uptime: 6 days 14:25:15.135

Loading Kernel Symbols

..........................................................................................

...................................

Loading User Symbols

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

Loading unloaded module list

........................................

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

Use !analyze -v to get detailed debugging information.

 

BugCheck 50, {bc5ea000, 0, 804e7b03, 1}

 

Page b81d not present in the dump file. Type ".hh dbgerr004" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

Probably caused by : win32k.sys ( win32k!vSrcCopyS16D16Identity+56 )

 

Followup: MachineOwner

---------

 

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

PAGE_FAULT_IN_NONPAGED_AREA (50)

Invalid system memory was referenced. This cannot be protected by try-except,

it must be protected by a Probe. Typically the address is just plain bad or it

is pointing at freed memory.

Arguments:

Arg1: bc5ea000, memory referenced.

Arg2: 00000000, value 0 = read operation, 1 = write operation.

Arg3: 804e7b03, If non-zero, the instruction address which referenced the bad memory

address.

Arg4: 00000001, (reserved)

 

Debugging Details:

------------------

 

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

 

READ_ADDRESS: bc5ea000 Paged session pool

 

FAULTING_IP:

nt!memmove+33

804e7b03 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

 

MM_INTERNAL_CODE: 1

 

DEFAULT_BUCKET_ID: DRIVER_FAULT

 

BUGCHECK_STR: 0x50

 

PROCESS_NAME: WINWORD.EXE

 

CURRENT_IRQL: 1

 

TRAP_FRAME: 966b07f0 -- (.trap 0xffffffff966b07f0)

ErrCode = 00000000

eax=bc5ea008 ebx=bc216094 ecx=00000002 edx=00000000 esi=bc5ea000 edi=bc2160ac

eip=804e7b03 esp=966b0864 ebp=966b086c iopl=0 nv up ei pl zr na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246

nt!memmove+0x33:

804e7b03 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

Resetting default scope

 

LAST_CONTROL_TRANSFER: from 8052f640 to 805435b9

 

STACK_TEXT:

966b0788 8052f640 00000050 bc5ea000 00000000 nt!KeBugCheckEx+0x19

966b07d8 804e2dfc 00000000 bc5ea000 00000000 nt!MmAccessFault+0x796

966b07d8 804e7b03 00000000 bc5ea000 00000000 nt!KiTrap0E+0xc8

966b086c bf86768b bc216094 bc5e9fe8 00000020 nt!memmove+0x33

966b0890 bf8ec8b6 00000010 966b0b74 966b0acc win32k!vSrcCopyS16D16Identity+0x56

966b0aa0 bf8a7f3b bc216028 00000000 966b0acc win32k!EngCopyBits+0x4d8

966b0be0 bf88628f 00000001 bc3571c0 00000000 win32k!GreSetDIBitsToDeviceInternal+0x919

966b0c4c bf959808 0d0507db 0d0507db 00000000 win32k!GreSetDIBitsInternal+0x107

966b0c88 bf91bb7f 260107d5 0d0507db 00000000 win32k!GreSetDIBits+0x5a

966b0cc4 bf91c0bf 00000010 00000000 966b0d30 win32k!DIBtoBMP+0xe3

966b0ce8 bf85f798 8785b080 00000228 8785b080 win32k!xxxGetDummyBitmap+0xbe

966b0d04 bf85f72e 8785b080 00000002 966b0d30 win32k!xxxGetClipboardData+0xb2

966b0d54 804dfd24 00000002 0012ed78 00000000 win32k!NtUserGetClipboardData+0x72

966b0d54 7ffe0304 00000002 0012ed78 00000000 nt!KiSystemService+0xd0

0012eda4 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4

 

 

STACK_COMMAND: kb

 

FOLLOWUP_IP:

win32k!vSrcCopyS16D16Identity+56

bf86768b 83c40c add esp,0Ch

 

SYMBOL_STACK_INDEX: 4

 

SYMBOL_NAME: win32k!vSrcCopyS16D16Identity+56

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: win32k

 

IMAGE_NAME: win32k.sys

 

DEBUG_FLR_IMAGE_TIMESTAMP: 3e801611

 

FAILURE_BUCKET_ID: 0x50_win32k!vSrcCopyS16D16Identity+56

 

BUCKET_ID: 0x50_win32k!vSrcCopyS16D16Identity+56

 

Followup: MachineOwner

[acer82]

Nå har vi oppdatert med siste servicepacks på serveren og vi får en ny feilmelding i memorydumpen, se under. Noen som har et forslag til løsning?

 

 

Microsoft ® Windows Debugger Version 6.9.0003.113 X86

Copyright © Microsoft Corporation. All rights reserved.

 

 

Loading Dump File [C:\WINDOWS\MEMORY.DMP]

Kernel Summary Dump File: Only kernel address space is available

 

Symbol search path is: SRV*c:\symcache*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible

Product: Server, suite: TerminalServer

Built by: 3790.srv03_sp2_gdr.080813-1204

Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8

Debug session time: Tue Nov 18 10:30:15.826 2008 (GMT+1)

System Uptime: 0 days 0:03:20.828

Loading Kernel Symbols

..........................................................................................

.....................................

Loading User Symbols

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

Loading unloaded module list

.....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

Use !analyze -v to get detailed debugging information.

 

BugCheck 8E, {c0000005, f3fb2666, f3deeac0, 0}

 

Page d3b85 not present in the dump file. Type ".hh dbgerr004" for details

Page d3af4 not present in the dump file. Type ".hh dbgerr004" for details

*** ERROR: Module load completed but symbols could not be loaded for WDICA.SYS

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

Probably caused by : WDICA.SYS ( WDICA+13666 )

 

Followup: MachineOwner

---------

 

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: f3fb2666, The address that the exception occurred at

Arg3: f3deeac0, Trap Frame

Arg4: 00000000

 

Debugging Details:

------------------

 

Page d3b85 not present in the dump file. Type ".hh dbgerr004" for details

Page d3af4 not present in the dump file. Type ".hh dbgerr004" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

 

FAULTING_IP:

WDICA+13666

f3fb2666 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

 

TRAP_FRAME: f3deeac0 -- (.trap 0xfffffffff3deeac0)

ErrCode = 00000000

eax=0000000d ebx=893b0958 ecx=00000003 edx=00000000 esi=00000000 edi=88fbe9e8

eip=f3fb2666 esp=f3deeb34 ebp=f3deeb50 iopl=0 nv up ei pl nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206

WDICA+0x13666:

f3fb2666 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

Resetting default scope

 

DEFAULT_BUCKET_ID: DRIVER_FAULT

 

BUGCHECK_STR: 0x8E

 

PROCESS_NAME: svchost.exe

 

CURRENT_IRQL: 0

 

LAST_CONTROL_TRANSFER: from 8085bba7 to 8087c4a0

 

STACK_TEXT:

f3dee68c 8085bba7 0000008e c0000005 f3fb2666 nt!KeBugCheckEx+0x1b

f3deea50 808346c4 f3deea6c 00000000 f3deeac0 nt!KiDispatchException+0x3a2

f3deeab8 80834678 f3deeb50 f3fb2666 badb0d00 nt!CommonDispatchException+0x4a

f3deeacc 80a8256d 8083e450 00000000 893b98f4 nt!KiExceptionExit+0x186

f3deead0 8083e450 00000000 893b98f4 893b0901 hal!KeReleaseQueuedSpinLock+0x2d

f3deeb50 f3fb7fd1 00000000 f3deebcc 893b98e0 nt!ExAcquireResourceExclusiveLite+0x66

WARNING: Stack unwind information not available. Following frames may be wrong.

f3deeb70 f71381c7 893a6000 f3deebcc 893bf610 WDICA+0x18fd1

f3deeb8c f71385a3 893b98e0 00000005 f3deebcc termdd!_IcaCallSd+0x35

f3deebac f7138a10 893bf608 00000005 f3deebcc termdd!_IcaCallStack+0x55

f3deebf4 f7136bcc 893bf608 8924c850 8924c8c0 termdd!IcaDeviceControlStack+0x414

f3deec24 f7136d20 8924c850 8924c8c0 8924c850 termdd!IcaDeviceControl+0x4e

f3deec3c 80840153 8a6de9f8 8924c850 8a17afb8 termdd!IcaDispatch+0x12a

f3deec50 8092b50f 8924c8c0 894f4f90 8924c850 nt!IofCallDriver+0x45

f3deec64 8092b444 8a6de9f8 8924c850 894f4f90 nt!IopSynchronousServiceTail+0x10b

f3deed00 8092b564 000007ec 00000000 00000000 nt!IopXxxControlFile+0x60f

f3deed34 80833bef 000007ec 00000000 00000000 nt!NtDeviceIoControlFile+0x2a

f3deed34 7c8285ec 000007ec 00000000 00000000 nt!KiFastCallEntry+0xfc

02e5ef88 00000000 00000000 00000000 00000000 0x7c8285ec

 

 

STACK_COMMAND: kb

 

FOLLOWUP_IP:

WDICA+13666

f3fb2666 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

 

SYMBOL_STACK_INDEX: 0

 

SYMBOL_NAME: WDICA+13666

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: WDICA

 

IMAGE_NAME: WDICA.SYS

 

DEBUG_FLR_IMAGE_TIMESTAMP: 401206d2

 

FAILURE_BUCKET_ID: 0x8E_WDICA+13666

 

BUCKET_ID: 0x8E_WDICA+13666

 

Followup: MachineOwner

---------

[acer82]

En full driveroppdatering tilpasset HP serveren(Support Pack for Win2003)og siste Hotfix Rollup-pack til Citrix ser ut til å ha løst problemet!