|
Hi,
In the couple of months our print server has been bouncing frequently and I have used the Microsoft debugger to analyze the dump. Since I am very new to this and not knowledgable in the hardware programing, I and having difficulty in following thru to identify what caused the dump. In this case it seems to be pointing to memory_corruption but can anyone workout for me what caused the memory corruption. below is the dump file from the debugger.
thank very many for your help.
__________________
Loading Dump File [\\bfpmi01\c$\WINNT\Minidump\Mini120705-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*\\bfpmi01\c$\winnt\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: \\bfpmi01\c$\winnt\;\\bfpmi01\c$\winnt\system32\; \\bfpmi01\c$\winnt\system32\drivers\
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b00
Debug session time: Wed Dec 7 12:40:29.726 2005 (GMT+10)
System Uptime: not available
Loading Kernel Symbols
.............................................................................................................
Loading unloaded module list
.....
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 41, {1000, eb6a, ee1, 5dc25}
Probably caused by : memory_corruption ( nt!MiAllocatePoolPages+4e )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MUST_SUCCEED_POOL_EMPTY (41)
No component should ever ask for must-succeed pool as if there is none left,
the system crashes. Instead, components should ask for normal pool and
gracefully handle the scenario where the pool is temporarily empty. This
bugcheck definitely reveals a bug in the caller (use kb to identify the caller).
In addition, the fact that the pool is empty may be either a transient condition
or possibly a leak in another component (distinguish between the 2 cases by
following the directions below).
Type kb to show the calling stack.
Type !vm 1 to display total pool usage.
Then type !poolused 2 to display per-tag nonpaged pool usage.
Then type !poolused 4 to display per-tag paged pool usage.
The crash should be looked at by the tag owner that is consuming the most pool.
Arguments:
Arg1: 00001000, size of the request that could not be satisfied
Arg2: 0000eb6a, number of pages used of nonpaged pool
Arg3: 00000ee1, number of > PAGE_SIZE requests from nonpaged pool
Arg4: 0005dc25, number of pages available
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR: 0x41
LAST_CONTROL_TRANSFER: from 8046df68 to 8046e68e
STACK_TEXT:
f687fb38 8046df68 00000002 00001000 00000000 nt!MiAllocatePoolPages+0x4e
f687fb70 8041e6a2 00000002 00000000 20707249 nt!ExAllocatePoolWithTag+0x428
f687fbd4 8041e556 8810500e 00000000 80429e6c nt!IopAllocateIrpPrivate+0x148
f687fbe0 80429e6c 8810500e 00000000 00000000 nt!IoAllocateIrp+0xe
f687fc20 804da78a 878552b8 878552a0 89045040 nt!IopDeleteFile+0x6c
f687fc3c 804516ad 878552b8 80065704 00000000 nt!ObpRemoveObjectRoutine+0xd6
f687fc60 8043b66e 87b78668 e4683c08 00000000 nt!ObfDereferenceObject+0x157
f687fc84 8043bf8c e4554e88 87b7866c 87b78668 nt!MiSegmentDelete+0x142
f687fd48 8043d130 87b78600 00000000 80486180 nt!MiCleanSection+0x56c
f687fd8c 8043b927 00000000 00000000 00000000 nt!MiRemoveUnusedSegments+0x95e
f687fda8 80457838 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0x4f
f687fddc 8046c8e6 8043b8d8 00000000 00000000 nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
nt!MiAllocatePoolPages+4e
8046e68e bb00100000 mov ebx,0x1000
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!MiAllocatePoolPages+4e
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 427b58bb
STACK_COMMAND: kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x41_nt!MiAllocatePoolPages+4e
BUCKET_ID: 0x41_nt!MiAllocatePoolPages+4e
Followup: MachineOwner
---------
1: kd> kb
ChildEBP RetAddr Args to Child
f687fb38 8046df68 00000002 00001000 00000000 nt!MiAllocatePoolPages+0x4e
f687fb70 8041e6a2 00000002 00000000 20707249 nt!ExAllocatePoolWithTag+0x428
f687fbd4 8041e556 8810500e 00000000 80429e6c nt!IopAllocateIrpPrivate+0x148
f687fbe0 80429e6c 8810500e 00000000 00000000 nt!IoAllocateIrp+0xe
f687fc20 804da78a 878552b8 878552a0 89045040 nt!IopDeleteFile+0x6c
f687fc3c 804516ad 878552b8 80065704 00000000 nt!ObpRemoveObjectRoutine+0xd6
f687fc60 8043b66e 87b78668 e4683c08 00000000 nt!ObfDereferenceObject+0x157
f687fc84 8043bf8c e4554e88 87b7866c 87b78668 nt!MiSegmentDelete+0x142
f687fd48 8043d130 87b78600 00000000 80486180 nt!MiCleanSection+0x56c
f687fd8c 8043b927 00000000 00000000 00000000 nt!MiRemoveUnusedSegments+0x95e
f687fda8 80457838 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0x4f
f687fddc 8046c8e6 8043b8d8 00000000 00000000 nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
Myhope
|
|
|
|
|
I'm no expert, but it looks like some program is using up the non paged pool, a finite resource.
Try running Task Manager and display the 'Non Paged Pool' column, if a program keps increasing this value, eventually the PC will crash. MOnitor it for a few houres/days.
BTW are you runing Zone Alarm on the PC, that has caused me NP Pool leaks?
"Normal is getting dressed in clothes that you buy for work and driving through traffic in a car that you are still paying for - in order to get to the job you need to pay for the clothes and the car, and the house you leave vacant all day so you can afford to live in it." - Ellen Goodman
|
|
|
|
|
Thank you Ted,
I did monitor the memory use in the taskmgr but not able to get anything. I have posted further finding under Mike Dimmik response.
Can you be able to assist with that as well?
thanks for your time once again.
Eric
MyHope
Myhope
|
|
|
|
|
Mike, looks far more knowlegeable than me! I am sure he can help.
"Normal is getting dressed in clothes that you buy for work and driving through traffic in a car that you are still paying for - in order to get to the job you need to pay for the clothes and the car, and the house you leave vacant all day so you can afford to live in it." - Ellen Goodman
|
|
|
|
|
Normally I'd suspect that some driver was leaking badly, but there are no driver frames on your stack - all the routine names begin nt! indicating that the routine lives in NTOSKRNL.EXE, the Windows kernel. So I think I would go with the idea that there's memory corruption. Particularly if the other crashes have different results.
This corruption could come from many sources. It could be that a driver or other kernel-mode extension has a bug which causes it to write to incorrect addresses. However, more commonly in these cases it's actually a hardware fault.
The processor can read the contents of memory incorrectly if it's overheating. Check that all the cooling fans in the system are working and free of dust. If they are dusty, consider using a can of air (called something like 'air duster') which you can get from electronic component retailers such as Maplin in the UK to remove the dust or dirt. You don't want to use too much pressure as that could damage components. If there are filters (rare), clean them. If you're overclocking the processor (unlikely in a server, but I've heard of it), run it at its correct frequency.
If this doesn't help try running memory diagnostics such as memtest86 or Microsoft's Windows Memory Diagnostic[^]. This should reveal if your system's RAM is failing or unreliable. Sometimes you may find that it's simply a poor contact between the motherboard and the RAM module - removing and replacing the modules can help. Again, you can use the 'air duster' to clean the contacts before replacing the modules.
Stability. What an interesting concept. -- Chris Maunder
|
|
|
|
|
Thank you Mike for the quick response. I did a ram test and it passed. Its was done in windows though. My hardware is Dell 2650 and it has hardware monitor software(open manage) which I can be able to see what is failing and what is not. It seems all is fine and testing the Ram from this program runs success. In the event log there are continuing reports of print spooler services restarting. From the user dump files on the same box I am extracting the dump files showing below. I am suspecting they are related but not to sure why spoolsv servier is not mentioned on the privious dump. Can you be able to see any relation ore are they two different. One hardware issue and the other print driver issue?
thanks once again
Eric
---------------------------
Loading Dump File [\\bfpmi01\c$\Documents and Settings\All Users\Documents\DrWatson\user old2.dmp]
User Dump File: Only application data is available
Windows 2000 Version 2195 UP Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Debug session time: Mon Dec 19 16:43:15.128 2005 (GMT+10)
System Uptime: 7 days 5:11:53.921
Process Uptime: not available
Symbol search path is: srv*\\bfpmi01\c$\winnt\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: \\bfpmi01\c$\winnt\;\\bfpmi01\c$\winnt\system32\; \\bfpmi01\c$\winnt\system32\drivers\
..................................................................................................
(bec.c5c): Access violation - code c0000005 (!!! second chance !!!)
eax=0000013c ebx=027b66d0 ecx=7ffa0000 edx=0000013c esi=02828cf8 edi=00000000
eip=77f87eeb esp=01d5fe84 ebp=01d5feb8 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!RtlEnterCriticalSection+0xb:
77f87eeb 837a1400 cmp dword ptr [edx+0x14],0x0 ds:0023:00000150=????????
0:011> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_PEB ***
*** ***
*************************************************************************
*** WARNING: Unable to verify checksum for HPBHealr.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for HPBHealr.dll -
*** WARNING: Unable to verify checksum for hpz2ku12.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for hpz2ku12.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for HPBF042G.DLL -
FAULTING_IP:
ntdll!RtlEnterCriticalSection+b
77f87eeb 837a1400 cmp dword ptr [edx+0x14],0x0
EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 77f87eeb (ntdll!RtlEnterCriticalSection+0x0000000b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000150
Attempt to read from address 00000150
FAULTING_THREAD: 00000c5c
DEFAULT_BUCKET_ID: APPLICATION_FAULT
PROCESS_NAME: spoolsv.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000150
BUGCHECK_STR: ACCESS_VIOLATION
LAST_CONTROL_TRANSFER: from 77d56bb4 to 77f87eeb
STACK_TEXT:
01d5fe80 77d56bb4 0000013c 00000000 027b65f8 ntdll!RtlEnterCriticalSection+0xb
01d5fe90 77d56b79 027b65f8 77d522b0 027b65f8 RPCRT4!OSF_ASSOCIATION::RemoveConnection+0x21
01d5fe98 77d522b0 027b65f8 77d56974 00015f90 RPCRT4!OSF_SCONNECTION::FreeObject+0xf
01d5fea0 77d56974 00015f90 027b65f8 00000000 RPCRT4!REFERENCED_OBJECT::RemoveReference+0x18
01d5feb8 77d54738 00015f90 00085480 7c57b594 RPCRT4!OSF_SCONNECTION::AbortConnection+0x87
01d5ff10 77d533a8 c0021012 00000000 000006d2 RPCRT4!OSF_SCONNECTION::ProcessReceiveComplete+0x2ab
01d5ff20 77d4f99c 00085480 0000000c c0021012 RPCRT4!ProcessConnectionServerReceivedEvent+0x1b
01d5ff74 77d43dd7 77d4e003 00085480 00000000 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x14a
01d5ff78 77d4e003 00085480 00000000 00000000 RPCRT4!ProcessIOEventsWrapper+0x9
01d5ffa8 77d4af16 0009bfc0 01d5ffec 7c57b388 RPCRT4!BaseCachedThreadRoutine+0x4f
01d5ffb4 7c57b388 0009bfe8 00000000 00000000 RPCRT4!ThreadStartRoutine+0x18
01d5ffec 00000000 77d4aefc 0009bfe8 00000000 KERNEL32!BaseThreadStart+0x52
FOLLOWUP_IP:
RPCRT4!OSF_ASSOCIATION::RemoveConnection+21
77d56bb4 ff4e1c dec dword ptr [esi+0x1c]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: RPCRT4!OSF_ASSOCIATION::RemoveConnection+21
MODULE_NAME: RPCRT4
IMAGE_NAME: RPCRT4.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 425670f4
STACK_COMMAND: ~11s ; kb
FAILURE_BUCKET_ID: ACCESS_VIOLATION_RPCRT4!OSF_ASSOCIATION::RemoveConnection+21
BUCKET_ID: ACCESS_VIOLATION_RPCRT4!OSF_ASSOCIATION::RemoveConnection+21
Followup: MachineOwner
---------
0:011> ~11s
eax=0000013c ebx=027b66d0 ecx=7ffa0000 edx=0000013c esi=02828cf8 edi=00000000
eip=77f87eeb esp=01d5fe84 ebp=01d5feb8 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!RtlEnterCriticalSection+0xb:
77f87eeb 837a1400 cmp dword ptr [edx+0x14],0x0 ds:0023:00000150=????????
0:011> ;
0:011> kb
ChildEBP RetAddr Args to Child
01d5fe80 77d56bb4 0000013c 00000000 027b65f8 ntdll!RtlEnterCriticalSection+0xb
01d5fe90 77d56b79 027b65f8 77d522b0 027b65f8 RPCRT4!OSF_ASSOCIATION::RemoveConnection+0x21
01d5fe98 77d522b0 027b65f8 77d56974 00015f90 RPCRT4!OSF_SCONNECTION::FreeObject+0xf
01d5fea0 77d56974 00015f90 027b65f8 00000000 RPCRT4!REFERENCED_OBJECT::RemoveReference+0x18
01d5feb8 77d54738 00015f90 00085480 7c57b594 RPCRT4!OSF_SCONNECTION::AbortConnection+0x87
01d5ff10 77d533a8 c0021012 00000000 000006d2 RPCRT4!OSF_SCONNECTION::ProcessReceiveComplete+0x2ab
01d5ff20 77d4f99c 00085480 0000000c c0021012 RPCRT4!ProcessConnectionServerReceivedEvent+0x1b
01d5ff74 77d43dd7 77d4e003 00085480 00000000 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x14a
01d5ff78 77d4e003 00085480 00000000 00000000 RPCRT4!ProcessIOEventsWrapper+0x9
01d5ffa8 77d4af16 0009bfc0 01d5ffec 7c57b388 RPCRT4!BaseCachedThreadRoutine+0x4f
01d5ffb4 7c57b388 0009bfe8 00000000 00000000 RPCRT4!ThreadStartRoutine+0x18
01d5ffec 00000000 77d4aefc 0009bfe8 00000000 KERNEL32!BaseThreadStart+0x52
Myhope
|
|
|
|
|
That's a user-mode dump rather than a kernel-mode one - it indicates that the spooler service has crashed. Again, there's no third-party code on the stack which leads me to suspect there's a stack corruption error of some sort in the printer driver. See if there's an updated printer driver. This is completely unrelated to your other problem.
Are you up to date on security patches? Have you installed the update rollup[^]?
I think we're reaching the point where you ought to be calling Dell technical support (if you obtained your OS pre-installed on your server) or Microsoft.
Stability. What an interesting concept. -- Chris Maunder
|
|
|
|
|
In my opinion, this error might occure because your server process on the file which locate in a low disk space. Because your printer is the print server, it might handle a lot of job in order to print for the client. As we know that document that is wait to print is store in the printer spooler which locate under printer spool folder: C:\WINDOWS\System32\spool\PRINTERS. If the system disk become full or nearly full, the printing process might be slow. If you have a fix sufficient disk space, you should change the location of spool folder. Try to change to d:\Print\Spool\Printers. Hope this would help you to solve the problem.
|
|
|
|
|
Thanks for the reply. My C:\ drive has a lot of disk space(20GB) free.
Eric
Myhope
|
|
|
|
|
any sugestions on how i could make windows think a key has been pressed so that it writes the value into another window for example text editor or as brute force mthod? im just writing my first brute force app, possibly setKeyState() dono if that would work, any ideas, must sleep nite nite!
vbms
|
|
|
|
|
Hi, I want to know that the bluetooth headset and microphone [^] could be ablet to use it with a PC and chat with other people in yahoo messenger or msn messenger?
-- modified at 20:13 Monday 19th December, 2005
|
|
|
|
|
the manufacturer says it can be done...
link[^]
scroll down & click "How to Use Your Bluetooth Headset on a PC with Yahoo Instant Messenger"
|
|
|
|
|
Thank you very much for your suppport. An information the hyperlink is very usefull for me to use this device 
|
|
|
|
|
|
this is also by the same manufacturer (Logitech), isn't it? So I suppose this should work too
(try to find it on their web site)
|
|
|
|
|
Thank you very much for your comment. I also try to find some information relate to this product about using with yahoo messenger too but I could not found it. Other wise i will try all of my best search for it now.
|
|
|
|
|
I recently found myself in a predicament where my machine, running WinXP SP2, froze during a compile. Not an altogether unique event. I did what I usually do in situations like this; I took a long overdue coffee break hoping that things would work out by the time I returned. After returning 20 minutes later found that the probability of the compile ever completing on its own was approaching zero so I did what I am loath to do; I pressed the reset button. What distinguished this occasion from numerous other similar experiences is that this time when Windows tried to start it informed me that the disk appeared damaged and that I should run chkdsk /f to try to correct the problem.
Fair enough, I did interrupt the operating system midstream and had probably caused corruption which hopefully chkdsk could resolve. Then I became aware of my dilemma, how can I run chkdsk when the operating system will not run. Not to worry, I can take a disk from another machine, boot and execute chkdsk /f on the corrupt disk. To test the theory I installed, actually just put the disk on a bench next to the machine and connected the cables to it, the other disk with operating system installed on it. The machine booted and my hopes were buoyed until I shutdown and connected the corrupt disk as a slave drive. When I tried to boot again I ended up with the “blue screen of death” again recommending that a disk (it didn’t specify which) was corrupt and instructing me to run chkdsk /f to try to recover.
Does anyone know how I can approach this problem?
Is there anything I could have done differently, with the exception of taking a longer coffee break?
Looking to the future I would like to set up a second disk on my development machine and, as part of the shutdown process, backup whatever I have modified to the other disk. That way I will only loose the current session’s modifications if something like this happens again.
I know that if I put an entry in HKLM/Microsoft/Windows/CurrentVersion/Run the application will run when the user logs on. Is there any registry entry I can make to run a utility when I shutdown the machine?
I'm on-line therefore I am.
JimmyRopes
|
|
|
|
|
You can run apps BEFORE you pick Shutdown. There is no registry key for this though. DURING a shutdown, Windows won't start a new application.
Before you start swapping hard drivers around, I would suggest starting the machine on the Windows XP setup disk and running the Recovery Console. You can run CHKDSK from there.
RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome
|
|
|
|
|
Unfortunately, there is no floppy drive on that machine, nor a lot of my lab machines, so there is no recovery diskette to insert when promped to do so.
Can I make up a recovery diskette on another machine, plug in a diskette drive and then run the recovery console to run chkdsk using the diskette generated from the other machine, since I won't be actually recovering from it?
I'm on-line therefore I am.
JimmyRopes
|
|
|
|
|
All you need is to create the Setup floppies. And that'll work. You don't need to create an Emergency Repair Disk, as it used to be called.
But, you can also do the same thing by booting from the XP installation CD.
RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome
|
|
|
|
|
Thanks, I'll try the floppies in the morning.
I must be missing something about how to use the installation CD. When I tried it started to load the files, but I don't know where since the disk is bad, and then proceeded to start windows when it choaked and I got the "blue screen" telling me to run chkdsk.
As far as I know there are only two chances to interrupt the processing from when it asks "do you want to boot from the CD".
F6 to load SCSI or IDE drivers.
F2 to go into the restore which asks to mount the floppy.
It never completed the startup of windows so there doesn't seem to be a place to run the chkdsk before it tries to start windows.
Anyway, I think the floppies will work. My wife's machine has WinXP and a floppy drive so I can make them there and then I will have something to mount when going to the automated recovery [F2 near the start of the process]
I'm on-line therefore I am.
JimmyRopes
|
|
|
|
|
Did you try to logon to safe mode?
|
|
|
|
|
Yes, I tried safe mode and safemode with command prompt, as well as boot to the last known good configuration.
All of these produce the "blue screen" saying to run chkdsk.
I'm on-line therefore I am.
JimmyRopes
|
|
|
|
|
Yesterday, i also have an experience with the blue screen error. It said that the there is insufficient disk space. So I try to start up as safe mode and clean my disk space. Then when i restart as normal it is working fine.
So in case of your problem, i think there are two solution that might fix it:
1. Try to locate the file dump memory and send it to Microsoft. The file dump memory record an information that has error in your computer and wait for the solution from Microsoft expert. The dump memory could be locate from %SystemRoot%\MEMORY.DMP.
2. Try to create a windows boot able disk by using Bart PD[^]. I also use this method to rescue my personal file when windows become unstable and could not start in a normal/safe mode. But i never run chkdsk command from it. Try to discover it for more detail.
|
|
|
|
|
Thanks for the link to Bart PD. I have been looking for a CD distribution like this. I don't even have a floppy drive mounted on the machine so a CD like that will be very handy.
I'm on-line therefore I am.
JimmyRopes
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
