S
Snoopy
Guest
Dear all,
I have Windows 2003 R2 64bit SP2 server, that is experiencing Blue screen
olmost every second week, which ends in automatic reboot. The event log that
I'm getting is the folowing:
Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 11/30/2007
Time: 9:03:51 AM
User: N/A
Computer: xxxxxx
Description:
Error code 00000000000000d1, parameter1 0000000000000018, parameter2
0000000000000002, parameter3 0000000000000001, parameter4 fffffadef2622743.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 30 0000000
0020: 30 30 30 30 30 30 30 64 0000000d
0028: 31 20 20 50 61 72 61 6d 1 Param
0030: 65 74 65 72 73 20 30 30 eters 00
0038: 30 30 30 30 30 30 30 30 00000000
0040: 30 30 30 30 31 38 2c 20 000018,
0048: 30 30 30 30 30 30 30 30 00000000
0050: 30 30 30 30 30 30 30 32 00000002
0058: 2c 20 30 30 30 30 30 30 , 000000
0060: 30 30 30 30 30 30 30 30 00000000
0068: 30 31 2c 20 66 66 66 66 01, ffff
0070: 66 61 64 65 66 32 36 32 fadef262
0078: 32 37 34 33 2743
---------------------------------------------------
----------------------------------------------------
I was able to open the MEMORY.DMP file with folowing information:
Any idea waht it may be?
Opened log file 'c:\debuglog.txt'
3: kd> .sympath srv*c:\symbols*htt://msdl.microsoft.com/download/symbols
Symbol search path is:
srv*c:\symbols*htt://msdl.microsoft.com/download/symbols
3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols
3: kd> .reload;!analyze -v;r;thread;lmnt;.logclose;q
Loading Kernel Symbols
..........................................................................................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000018, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffffadef2622743, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 0000000000000018
CURRENT_IRQL: 2
FAULTING_IP:
tcpip!IpDelayedInvalidateOffloadWorker+93
fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffffadef668db20 -- (.trap 0xfffffadef668db20)
..trap 0xfffffadef668db20
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffadf05dd56c8 rbx=fffff800011cda18 rcx=fffffadef668dcd0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffffadf06bc3ce8
rip=fffffadef2622743 rsp=fffffadef668dcb0 rbp=fffffadf029c1950
r8=fffffadef668dcd0 r9=0000000100000000 r10=0000000000000000
r11=fffffadef62bd450 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
tcpip!IpDelayedInvalidateOffloadWorker+0x93:
fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax
ds:0286:3d00=????????????????
..trap
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000102e5b4 to fffff8000102e890
STACK_TEXT:
fffffade`f668d998 fffff800`0102e5b4 : 00000000`0000000a 00000000`00000018
00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffffade`f668d9a0 fffff800`0102d547 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x74
fffffade`f668db20 fffffade`f2622743 : fffffadf`06bc3bf0 fffff800`0125e200
00000000`00000000 fffffade`f626c051 : nt!KiPageFault+0x207
fffffade`f668dcb0 fffff800`010375ca : fffffadf`029c1970 fffffade`f626c010
fffffadf`06bc3bf0 fffff800`011cda18 :
tcpip!IpDelayedInvalidateOffloadWorker+0x93
fffffade`f668dd00 fffff800`0124a972 : fffffadf`06bc3bf0 00000000`00000080
fffffadf`06bc3bf0 fffffade`f62a3680 : nt!ExpWorkerThread+0x13b
fffffade`f668dd70 fffff800`01020226 : fffffade`f629b180 fffffadf`06bc3bf0
fffffade`f62a3680 fffff800`011b4dc0 : nt!PspSystemThreadStartup+0x3e
fffffade`f668ddd0 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!IpDelayedInvalidateOffloadWorker+93
fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: tcpip!IpDelayedInvalidateOffloadWorker+93
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 45d699a3
FAILURE_BUCKET_ID: X64_0xD1_W_tcpip!IpDelayedInvalidateOffloadWorker+93
BUCKET_ID: X64_0xD1_W_tcpip!IpDelayedInvalidateOffloadWorker+93
Followup: MachineOwner
---------
rax=fffffadef668daa0 rbx=fffffadf05e75200 rcx=000000000000000a
rdx=0000000000000018 rsi=fffffadf05dd56a0 rdi=0000000000000000
rip=fffff8000102e890 rsp=fffffadef668d998 rbp=fffffadef668dba0
r8=0000000000000002 r9=0000000000000001 r10=fffffadef2622743
r11=fffffadef62bd450 r12=fffffadf029c1950 r13=0000000000000001
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286
nt!KeBugCheckEx:
fffff800`0102e890 48894c2408 mov qword ptr [rsp+8],rcx
ss:0018:fffffade`f668d9a0=000000000000000a
^ No runnable debuggees error in
'.reload;!analyze -v;r;thread;lmnt;.logclose;q'
I have Windows 2003 R2 64bit SP2 server, that is experiencing Blue screen
olmost every second week, which ends in automatic reboot. The event log that
I'm getting is the folowing:
Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 11/30/2007
Time: 9:03:51 AM
User: N/A
Computer: xxxxxx
Description:
Error code 00000000000000d1, parameter1 0000000000000018, parameter2
0000000000000002, parameter3 0000000000000001, parameter4 fffffadef2622743.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 30 0000000
0020: 30 30 30 30 30 30 30 64 0000000d
0028: 31 20 20 50 61 72 61 6d 1 Param
0030: 65 74 65 72 73 20 30 30 eters 00
0038: 30 30 30 30 30 30 30 30 00000000
0040: 30 30 30 30 31 38 2c 20 000018,
0048: 30 30 30 30 30 30 30 30 00000000
0050: 30 30 30 30 30 30 30 32 00000002
0058: 2c 20 30 30 30 30 30 30 , 000000
0060: 30 30 30 30 30 30 30 30 00000000
0068: 30 31 2c 20 66 66 66 66 01, ffff
0070: 66 61 64 65 66 32 36 32 fadef262
0078: 32 37 34 33 2743
---------------------------------------------------
----------------------------------------------------
I was able to open the MEMORY.DMP file with folowing information:
Any idea waht it may be?
Opened log file 'c:\debuglog.txt'
3: kd> .sympath srv*c:\symbols*htt://msdl.microsoft.com/download/symbols
Symbol search path is:
srv*c:\symbols*htt://msdl.microsoft.com/download/symbols
3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols
3: kd> .reload;!analyze -v;r;thread;lmnt;.logclose;q
Loading Kernel Symbols
..........................................................................................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000018, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffffadef2622743, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 0000000000000018
CURRENT_IRQL: 2
FAULTING_IP:
tcpip!IpDelayedInvalidateOffloadWorker+93
fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffffadef668db20 -- (.trap 0xfffffadef668db20)
..trap 0xfffffadef668db20
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffadf05dd56c8 rbx=fffff800011cda18 rcx=fffffadef668dcd0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffffadf06bc3ce8
rip=fffffadef2622743 rsp=fffffadef668dcb0 rbp=fffffadf029c1950
r8=fffffadef668dcd0 r9=0000000100000000 r10=0000000000000000
r11=fffffadef62bd450 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
tcpip!IpDelayedInvalidateOffloadWorker+0x93:
fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax
ds:0286:3d00=????????????????
..trap
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000102e5b4 to fffff8000102e890
STACK_TEXT:
fffffade`f668d998 fffff800`0102e5b4 : 00000000`0000000a 00000000`00000018
00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffffade`f668d9a0 fffff800`0102d547 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x74
fffffade`f668db20 fffffade`f2622743 : fffffadf`06bc3bf0 fffff800`0125e200
00000000`00000000 fffffade`f626c051 : nt!KiPageFault+0x207
fffffade`f668dcb0 fffff800`010375ca : fffffadf`029c1970 fffffade`f626c010
fffffadf`06bc3bf0 fffff800`011cda18 :
tcpip!IpDelayedInvalidateOffloadWorker+0x93
fffffade`f668dd00 fffff800`0124a972 : fffffadf`06bc3bf0 00000000`00000080
fffffadf`06bc3bf0 fffffade`f62a3680 : nt!ExpWorkerThread+0x13b
fffffade`f668dd70 fffff800`01020226 : fffffade`f629b180 fffffadf`06bc3bf0
fffffade`f62a3680 fffff800`011b4dc0 : nt!PspSystemThreadStartup+0x3e
fffffade`f668ddd0 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!IpDelayedInvalidateOffloadWorker+93
fffffade`f2622743 48894718 mov qword ptr [rdi+18h],rax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: tcpip!IpDelayedInvalidateOffloadWorker+93
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 45d699a3
FAILURE_BUCKET_ID: X64_0xD1_W_tcpip!IpDelayedInvalidateOffloadWorker+93
BUCKET_ID: X64_0xD1_W_tcpip!IpDelayedInvalidateOffloadWorker+93
Followup: MachineOwner
---------
rax=fffffadef668daa0 rbx=fffffadf05e75200 rcx=000000000000000a
rdx=0000000000000018 rsi=fffffadf05dd56a0 rdi=0000000000000000
rip=fffff8000102e890 rsp=fffffadef668d998 rbp=fffffadef668dba0
r8=0000000000000002 r9=0000000000000001 r10=fffffadef2622743
r11=fffffadef62bd450 r12=fffffadf029c1950 r13=0000000000000001
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286
nt!KeBugCheckEx:
fffff800`0102e890 48894c2408 mov qword ptr [rsp+8],rcx
ss:0018:fffffade`f668d9a0=000000000000000a
^ No runnable debuggees error in
'.reload;!analyze -v;r;thread;lmnt;.logclose;q'