locked
XPsp3 cant create kernel or full memory dump RRS feed

  • Question

  • Hi

    I have about 500 dell 755 workstations.

    for several weeks these PCs  get random crashes.

    I try to generate kernel or full dumps with no success. only minidumps are generated.

    pagingfile size on C: drive is twice the physical size.

    please assist

    thanks

     

     

    Wednesday, September 21, 2011 10:47 AM

All replies

  • Hello,

    please check you have enough disk space.

    As you have minidumps, please use Microsoft Skydrive to upload dump files (c:\windows\minidumps). Once done, post a link here.

    Is there a file named MEMORY.DMP under c:\windows\? If yes then that is the full dump.

     

    You can also contact Microsoft CSS for assistance.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator

    Microsoft Certified IT Professional: Server Administrator 

    Thursday, September 22, 2011 6:55 AM
  •  

    Thanks for your reply Mr X

    I found the MEMORY.DMP under c:\windows. I looked it under minidump for some unknows reson.

    anyway, below is the dump check I ran. it seems like iexplore is messing with the kernel.

    can you think of a method to find out why this happen on so many stations?

     

     

    Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [E:\KernelDumps\mc011\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp.080413-2111
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
    Debug session time: Sun Sep 11 12:57:53.075 2011 (UTC + 3:00)
    System Uptime: 0 days 4:13:27.204
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 7ffd800c).  Type ".hh dbgerr001" for details
    Loading unloaded module list
    ......................................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {a6a9bffc, ff, 0, 80545aff}

    Probably caused by : ntkrpamp.exe ( nt!SwapContext+6f )

    Followup: MachineOwner
    ---------

    windbg> .hh dbgerr001
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: a6a9bffc, memory referenced
    Arg2: 000000ff, IRQL
    Arg3: 00000000, bitfield :
     bit 0 : value 0 = read operation, 1 = write operation
     bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 80545aff, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS:  a6a9bffc

    CURRENT_IRQL:  ff

    FAULTING_IP:
    nt!SwapContext+6f
    80545aff 0b880c020000    or      ecx,dword ptr [eax+20Ch]

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0xA

    PROCESS_NAME:  iexplore.exe

    TRAP_FRAME:  a7b25c2c -- (.trap 0xffffffffa7b25c2c)
    ErrCode = 00000000
    eax=a6a9bdf0 ebx=ba340000 ecx=8001003b edx=80010031 esi=8821d180 edi=888b3da8
    eip=80545aff esp=a7b25ca0 ebp=8001003b iopl=0         nv up di ng nz na po nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010082
    nt!SwapContext+0x6f:
    80545aff 0b880c020000    or      ecx,dword ptr [eax+20Ch] ds:0023:a6a9bffc=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from 80545aff to 805446e0

    STACK_TEXT: 
    a7b25c2c 80545aff badb0d00 80010031 896f1980 nt!KiTrap0E+0x238
    a7b25ca4 8054599b a7b25cec 888b3da8 ba340120 nt!SwapContext+0x6f
    a7b25cb8 80503836 888b3e18 888b3da8 804fb068 nt!KiSwapContext+0x2f
    a7b25cc4 804fb068 00000000 a7b25d1c 00000000 nt!KiSwapThread+0x8a
    a7b25cec 805c0750 00000001 00000006 a7b25d01 nt!KeWaitForSingleObject+0x1c2
    a7b25d50 8054161c 00000290 00000001 a7b25d1c nt!NtWaitForSingleObject+0x9a
    a7b25d50 7c90e4f4 00000290 00000001 a7b25d1c nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0175fb0c 00000000 00000000 00000000 00000000 0x7c90e4f4


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!SwapContext+6f
    80545aff 0b880c020000    or      ecx,dword ptr [eax+20Ch]

    SYMBOL_STACK_INDEX:  1

    SYMBOL_NAME:  nt!SwapContext+6f

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  4802516a

    FAILURE_BUCKET_ID:  0xA_nt!SwapContext+6f

    BUCKET_ID:  0xA_nt!SwapContext+6f

    Followup: MachineOwner
    ---------


    • Edited by tamimh Thursday, September 22, 2011 10:13 AM
    Thursday, September 22, 2011 10:11 AM
  • Bug Check Code 0xA: http://msdn.microsoft.com/en-us/library/ff560129(VS.85).aspx

    Please zip the MEMORY.DMP file and upload it using Microsoft Skydrive. Upload the minidumps also. Once done, post a link here.

    You can also contact Microsoft CSS for assistance.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator

    Thursday, September 22, 2011 12:11 PM
  • Hi

    the link have general information on the specific BSOD.

     

    here are the files:

    https://skydrive.live.com/?cid=113b66b4217ef428&sc=documents&uc=3&id=113B66B4217EF428%21126

     

    Microsoft couldnt help me with this. its a frustrating story...

     

    thanks again.

     

     

    Thursday, September 22, 2011 3:04 PM