none
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001a

    Dotaz

  • Found this line from the eventlog and wants to know the reason the server rebooted by itself.

    Please find the memory dump that was created:

    https://1drv.ms/u/s!Avn-ZwAvVqbcgRZDNeghtp2H2RqM

    Here are the server info:

    Windows Server 2012 R2
    Intel(R) Xeon(R) CPU E5-2630 v3 @2.4GHz 2.4 GHz (2 Processors)
    32 GB
    64-bit Operating System x64-based processor

    Thanks in advance

    CW

    pátek 27. dubna 2018 18:45

Všechny reakce

  • Hi,

    As per the crash dump it has got crashed due to memory_corruptions. 

    Thanks

    Syed


    Dont forget to mark as Answered if you found this post helpful.

    pátek 27. dubna 2018 19:28
  • Thanks Syed for the quick response!

    So is this a one time occurrence or will this happen again?

    Does it mention which driver is causing this?

    Is there anything we can do to resolve this?

    pátek 27. dubna 2018 19:35
  • Hi,

    It may be one time are can happen again, hence kindly monitor the physical memory usage of the server and look for any application is using the memory resource. I didn't find any driver causing the issue it was just memory.

    Thanks

    Syed 



    Dont forget to mark as Answered if you found this post helpful.

    pátek 27. dubna 2018 19:56
  • Hi,

    I noticed the process Spoold.exe in the dump file, which points to the Backup Exec Deduplicatoin Engine. Were you using it when the reboot happens?

    I found there is a hotfix on the spoold.exe crash issue, here is the reference:

    https://www.veritas.com/support/en_US/article.100041057

    Note: this is a 3rd party link, we don't have any warranties on this website. It's just for your convenience.

    If the problem happens when you running some program, then it can help us narrow down the issue. It may be caused by the software, which may going to call some kernel drivers lead to memory corruption.



    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    sobota 28. dubna 2018 7:10
  • The memory dump was debugged.

    There were multiple misbehaving drivers identified.


    To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command:

    Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use one drive or drop box to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, dxdiag, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    .

    .

    In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread

    .

    .

    Use 7zip to organize the collected files on the desktop > post a one drive or drop box share link into the thread.

    .

    .

    .

    Please remember to vote and mark the replies as answers if they help.

    .

    .

    .




    sobota 28. dubna 2018 8:47
  • The memory dump was debugged.

    There were multiple misbehaving drivers identified.


    To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command:

    Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use one drive or drop box to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, dxdiag, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    .

    .

    In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread

    .

    .

    Use 7zip to organize the collected files on the desktop > post a one drive or drop box share link into the thread.

    .

    .

    .

    Please remember to vote and mark the replies as answers if they help.

    .

    .

    .




    Hi, Please find the logs...thanks.

    https://1drv.ms/u/s!Avn-ZwAvVqbcgRcGJtZlxAOoGGii

    • Upravený CW903 úterý 1. května 2018 13:23 .
    úterý 1. května 2018 13:23
  • There was 1 BSOD mini dump file collected.

    The msinfo32 file was not able to be opened.

    The event viewer txt log was not able to be opened.

    The misbehaving drivers were related to the Mcafee software.

    1) Uninstall McAfee software using the applicable removal tool:

    https://service.mcafee.com/webcenter/portal/cp/home/articleview;jsessionid=13sb_FTehvXxskBxBpQRZzGNnPN8jNe3cpcw91UgAVQ7uYuDLmuq!1715296370!-501425642?articleId=TS101331&_afrLoop=52468139099663#!%40%40%3F_afrLoop%3D52468139099663%26articleId%3DTS101331%26centerWidth%3D100%2525%26leftWidth%3D0%2525%26rightWidth%3D0%2525%26showFooter%3Dfalse%26showHeader%3Dfalse%26_adf.ctrl-state%3D944zmmwjx_4

    2) Turn on Windows defender

    3) Wait 1 week to reinstall McAfee.  If there are no BSOD upon re-installation then continue using the software product.  If there are recurrent BSOD upon re-installation then find an alternative AV software product.  The longer the waiting period the stronger the cause and effect upon re-installation.

    4) If you want a more comprehensive analysis of the server then rerun the administrative command prompt command and post new log files into the the newest post after the removal of McAfee.

    5) Also find the msinfo32 manually and post into the thread:  In the left lower corner search type:  msinfo32 > save as NFO > zip with 7zip > post a one drive or drop box share link into the thread.

    6) If there are any new BSOD > run the administrative command prompt command and post a memory dump (c:\windows\memory.dmp.

    úterý 1. května 2018 14:01
  • Thank you...will try to re-install the mcAfee software first.
    úterý 1. května 2018 17:19