locked
The computer has rebooted from a bugcheck The bugcheck was: 0x000000d1 (0x0000000c, 0xd0000002, 0x00000000, 0xf75febd5) RRS feed

  • Question

  • Hi there

    Looking for some advice re a stop error one of our servers has suddenly started suffering from.

    This server has been running perfectly ok for over a year, however just two days ago is started crashing, with the following event log entry:

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0x0000000c, 0xd0000002, 0x00000000, 0xf75febd5). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

    The server will now only stay up for less than an hour before crashing and rebooting with the same error.

    The hardware is HP Proliant DL 385 G2 with 2Gb ram and a Dual Core AMD Opteron processor

    The OS is Windows Server 2003 R2

    The server runs System Center Essentials 2007/SQL Server 2005 Express Edition

    No hardware has been changed, no new MS updates have been installed

    I  have installed the Microsoft Debbuging Tools for Windows (x86) but am not sure exactly which tool I should use to pinpoint what is causing the crash

    I have tried running dumpchk.exe to open the Minidump files but I'm not sure if this is the right tool to use, or, again, what exactly I should be looking for.

    I'd be very grateful for any advice.

    Cheers

    JHH

     

    Monday, February 2, 2009 1:14 PM

Answers

  • Your bugcheck shows 'DRIVER_IRQL_NOT_LESS_OR_EQUAL' and points to a driver of 'bxnd52x.sys'. This is the network card driver (Broadcom) of your server.

    It is likely that the NIC is the source of the BSOD, but not always the case. I would jump onto HP's support site and download the latest PSP (Proliant Support Pack) for your server. Run all the updates from the pack included firmware and driver updates, especially relating to the network interface, mainboard and drive controller (SCSI/SATA).
    After the BIOS update part is complete, reboot your server, go into the BIOS and disable any onboard devices that you dont need - ie USB, LPT, Serial ports.

    I have had similar issues with older HP servers and found that the PSP updates resolve the issue. You can download the PSP for your server from here, presuming you are running the 32bit version of 2k3 R2:

    http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareIndex.jsp?lang=en&cc=uk&prodNameId=3288112&prodTypeId=15351&prodSeriesId=3219233&swLang=8&taskId=135&swEnvOID=1005#78221

    Although it seems weird that a driver issue can suddenly bring down the server, it's often relating to recent windows updates and older hardware drivers that have not been updated.

     

     

     

     

    Monday, February 2, 2009 3:35 PM

All replies

  • Server just crashed/rebooted again, this time with a slightly different error:

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0x0000000c, 0xd0000002, 0x00000000, 0xf75ee8d5)

    JHH
    Monday, February 2, 2009 1:40 PM
  • hi there,

    first thing even befre troubleshooitng is to let you know that Blue screen / BSOD is not a error / problem condition.

    OS has sensed a potential threat by some of the driver / dll / application and it performed blue screen in order to prevent any further damage to OS. i ant to understand which is the driver it is causing the problem. when OS bug checks / BSOD , it will point out the module some times for eample "pnp.sys " here pnp.sys is a driver which caused BSOD.

    and the BUG check code is useful for debugging purpose to check whch module has created an exception. You have to use windbg tool to examine the memory dump provided you are good at analysis and the dump will give you the faulting module which will tell you which module / sys file has created the problem.

    Also when you run through the stack you will come to know the parameters which were passed during the time of crash.If it is a driver crash then you need to check if it is caused by 3rd party driver ( such as NIC driver / video driver ) , or if it is caused by Microsoft driver and also you need to check the dependency of the drivers.

    Action plan
    ========
    a) from when is the problem occuring , have you updated any pathces recently after which the BSOD is occuring .

    b) is your OS performing any application task with which the BSOD is occuring

    c) Make sure you have your AV updated , but i cant comment unless i find the faulting module.

    d) if you provide the bucket and the faulting id then it will be helpful for us .


    sainath Windows Driver Development
    Monday, February 2, 2009 2:20 PM
  • Hi Sainath

    Thank you for responding.

    In answer to your questions:

    a) No changes of any kind were made to the server prior to the BSOD's occurring

    b) The BSOD occurs randomly

    c) AV is ok

    d) What do you mean by 'provide the bucket'? Do you mean post the contents of the minidump file?

    Thanks again

    JHH

    Monday, February 2, 2009 2:55 PM
  • Hi again Sainath

    Here is the output from running WinDbg on the most recent minidump file:

    ----------------------------------------------------------------------------------------------------------------------------------------------------------------

    Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini020209-07.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: Server, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
    Debug session time: Mon Feb  2 14:53:01.456 2009 (GMT+0)
    System Uptime: 0 days 0:09:00.906
    Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    Loading Kernel Symbols
    ...............................................................
    .............................................
    Loading User Symbols
    Loading unloaded module list
    ....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck D1, {c, d0000002, 0, f75eebd5}

    *** WARNING: Unable to verify timestamp for bxnd52x.sys
    *** ERROR: Module load completed but symbols could not be loaded for bxnd52x.sys
    Probably caused by : bxnd52x.sys ( bxnd52x+7bd5 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000c, memory referenced
    Arg2: d0000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: f75eebd5, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS:  0000000c

    CURRENT_IRQL:  2

    FAULTING_IP:
    bxnd52x+7bd5
    f75eebd5 ??              ???

    CUSTOMER_CRASH_COUNT:  7

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR:  0xD1

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 89741d02 to 8088c963

    STACK_TEXT: 
    f78f6c0c 89741d02 89741d02 00000000 00000000 nt!ExFreePoolWithTag+0x62d
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    f78f6c18 00000000 00000023 00000023 00000000 0x89741d02


    STACK_COMMAND:  .bugcheck ; kb

    FOLLOWUP_IP:
    bxnd52x+7bd5
    f75eebd5 ??              ???

    SYMBOL_NAME:  bxnd52x+7bd5

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: bxnd52x

    IMAGE_NAME:  bxnd52x.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  44a55446

    FAILURE_BUCKET_ID:  0xD1_bxnd52x+7bd5

    BUCKET_ID:  0xD1_bxnd52x+7bd5

    Followup: MachineOwner
    ------------------------------------------------------------------------------------------------------------------------------------------------------------


    Does that data provide a clue to what is causing the BSOD?

    Thanks

    JHH

    Monday, February 2, 2009 3:08 PM
  • Your bugcheck shows 'DRIVER_IRQL_NOT_LESS_OR_EQUAL' and points to a driver of 'bxnd52x.sys'. This is the network card driver (Broadcom) of your server.

    It is likely that the NIC is the source of the BSOD, but not always the case. I would jump onto HP's support site and download the latest PSP (Proliant Support Pack) for your server. Run all the updates from the pack included firmware and driver updates, especially relating to the network interface, mainboard and drive controller (SCSI/SATA).
    After the BIOS update part is complete, reboot your server, go into the BIOS and disable any onboard devices that you dont need - ie USB, LPT, Serial ports.

    I have had similar issues with older HP servers and found that the PSP updates resolve the issue. You can download the PSP for your server from here, presuming you are running the 32bit version of 2k3 R2:

    http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareIndex.jsp?lang=en&cc=uk&prodNameId=3288112&prodTypeId=15351&prodSeriesId=3219233&swLang=8&taskId=135&swEnvOID=1005#78221

    Although it seems weird that a driver issue can suddenly bring down the server, it's often relating to recent windows updates and older hardware drivers that have not been updated.

     

     

     

     

    Monday, February 2, 2009 3:35 PM
  • Thanks a bunch guys!

    Changed driver, server hasn't crashed in over an hour now.

    Great stuff, all the best to the both of you!

    JHH
    Monday, February 2, 2009 4:32 PM
  • sorry for the delayed response

    as ross said , the driver is 'bxnd52x.sys' which belongs to broadcom  and this driver caused an interrupt . if you want to dug more into the stck trace follow from the Last_control_transfer section, the driver has called exfreepoolwithtag using an IRQL request.

    any ways good that the problem got resolved



    sainath Windows Driver Development
    Monday, February 2, 2009 5:02 PM