Answered by:
The computer has rebooted from a bugcheck The bugcheck was: 0x000000d1 (0x0000000c, 0xd0000002, 0x00000000, 0xf75febd5)

Question
-
Hi there
Looking for some advice re a stop error one of our servers has suddenly started suffering from.
This server has been running perfectly ok for over a year, however just two days ago is started crashing, with the following event log entry:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000c, 0xd0000002, 0x00000000, 0xf75febd5). A dump was saved in: C:\WINDOWS\MEMORY.DMP.
The server will now only stay up for less than an hour before crashing and rebooting with the same error.
The hardware is HP Proliant DL 385 G2 with 2Gb ram and a Dual Core AMD Opteron processor
The OS is Windows Server 2003 R2
The server runs System Center Essentials 2007/SQL Server 2005 Express Edition
No hardware has been changed, no new MS updates have been installed
I have installed the Microsoft Debbuging Tools for Windows (x86) but am not sure exactly which tool I should use to pinpoint what is causing the crash
I have tried running dumpchk.exe to open the Minidump files but I'm not sure if this is the right tool to use, or, again, what exactly I should be looking for.
I'd be very grateful for any advice.
Cheers
JHH
Monday, February 2, 2009 1:14 PM
Answers
-
Your bugcheck shows 'DRIVER_IRQL_NOT_LESS_OR_EQUAL' and points to a driver of 'bxnd52x.sys'. This is the network card driver (Broadcom) of your server.
It is likely that the NIC is the source of the BSOD, but not always the case. I would jump onto HP's support site and download the latest PSP (Proliant Support Pack) for your server. Run all the updates from the pack included firmware and driver updates, especially relating to the network interface, mainboard and drive controller (SCSI/SATA).
After the BIOS update part is complete, reboot your server, go into the BIOS and disable any onboard devices that you dont need - ie USB, LPT, Serial ports.I have had similar issues with older HP servers and found that the PSP updates resolve the issue. You can download the PSP for your server from here, presuming you are running the 32bit version of 2k3 R2:
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareIndex.jsp?lang=en&cc=uk&prodNameId=3288112&prodTypeId=15351&prodSeriesId=3219233&swLang=8&taskId=135&swEnvOID=1005#78221
Although it seems weird that a driver issue can suddenly bring down the server, it's often relating to recent windows updates and older hardware drivers that have not been updated.
- Marked as answer by John Henry Thomas Monday, February 2, 2009 4:31 PM
Monday, February 2, 2009 3:35 PM
All replies
-
Server just crashed/rebooted again, this time with a slightly different error:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000c, 0xd0000002, 0x00000000, 0xf75ee8d5)
JHHMonday, February 2, 2009 1:40 PM -
hi there,
first thing even befre troubleshooitng is to let you know that Blue screen / BSOD is not a error / problem condition.
OS has sensed a potential threat by some of the driver / dll / application and it performed blue screen in order to prevent any further damage to OS. i ant to understand which is the driver it is causing the problem. when OS bug checks / BSOD , it will point out the module some times for eample "pnp.sys " here pnp.sys is a driver which caused BSOD.
and the BUG check code is useful for debugging purpose to check whch module has created an exception. You have to use windbg tool to examine the memory dump provided you are good at analysis and the dump will give you the faulting module which will tell you which module / sys file has created the problem.
Also when you run through the stack you will come to know the parameters which were passed during the time of crash.If it is a driver crash then you need to check if it is caused by 3rd party driver ( such as NIC driver / video driver ) , or if it is caused by Microsoft driver and also you need to check the dependency of the drivers.
Action plan
========
a) from when is the problem occuring , have you updated any pathces recently after which the BSOD is occuring .
b) is your OS performing any application task with which the BSOD is occuring
c) Make sure you have your AV updated , but i cant comment unless i find the faulting module.
d) if you provide the bucket and the faulting id then it will be helpful for us .
sainath Windows Driver Development- Proposed as answer by Sainath IRP_MJ_CREATE Monday, February 2, 2009 5:02 PM
Monday, February 2, 2009 2:20 PM -
Hi Sainath
Thank you for responding.
In answer to your questions:
a) No changes of any kind were made to the server prior to the BSOD's occurringb) The BSOD occurs randomly
c) AV is ok
d) What do you mean by 'provide the bucket'? Do you mean post the contents of the minidump file?
Thanks again
JHH
Monday, February 2, 2009 2:55 PM -
Hi again Sainath
Here is the output from running WinDbg on the most recent minidump file:
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini020209-07.dmp]
Mini Kernel Dump File: Only registers and stack trace are availableSymbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Mon Feb 2 14:53:01.456 2009 (GMT+0)
System Uptime: 0 days 0:09:00.906
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
.............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************Use !analyze -v to get detailed debugging information.
BugCheck D1, {c, d0000002, 0, f75eebd5}
*** WARNING: Unable to verify timestamp for bxnd52x.sys
*** ERROR: Module load completed but symbols could not be loaded for bxnd52x.sys
Probably caused by : bxnd52x.sys ( bxnd52x+7bd5 )Followup: MachineOwner
---------1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000c, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f75eebd5, address which referenced memoryDebugging Details:
------------------
READ_ADDRESS: 0000000cCURRENT_IRQL: 2
FAULTING_IP:
bxnd52x+7bd5
f75eebd5 ?? ???CUSTOMER_CRASH_COUNT: 7
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 89741d02 to 8088c963
STACK_TEXT:
f78f6c0c 89741d02 89741d02 00000000 00000000 nt!ExFreePoolWithTag+0x62d
WARNING: Frame IP not in any known module. Following frames may be wrong.
f78f6c18 00000000 00000023 00000023 00000000 0x89741d02
STACK_COMMAND: .bugcheck ; kbFOLLOWUP_IP:
bxnd52x+7bd5
f75eebd5 ?? ???SYMBOL_NAME: bxnd52x+7bd5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: bxnd52x
IMAGE_NAME: bxnd52x.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 44a55446
FAILURE_BUCKET_ID: 0xD1_bxnd52x+7bd5
BUCKET_ID: 0xD1_bxnd52x+7bd5
Followup: MachineOwner
------------------------------------------------------------------------------------------------------------------------------------------------------------
Does that data provide a clue to what is causing the BSOD?
Thanks
JHHMonday, February 2, 2009 3:08 PM -
Your bugcheck shows 'DRIVER_IRQL_NOT_LESS_OR_EQUAL' and points to a driver of 'bxnd52x.sys'. This is the network card driver (Broadcom) of your server.
It is likely that the NIC is the source of the BSOD, but not always the case. I would jump onto HP's support site and download the latest PSP (Proliant Support Pack) for your server. Run all the updates from the pack included firmware and driver updates, especially relating to the network interface, mainboard and drive controller (SCSI/SATA).
After the BIOS update part is complete, reboot your server, go into the BIOS and disable any onboard devices that you dont need - ie USB, LPT, Serial ports.I have had similar issues with older HP servers and found that the PSP updates resolve the issue. You can download the PSP for your server from here, presuming you are running the 32bit version of 2k3 R2:
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareIndex.jsp?lang=en&cc=uk&prodNameId=3288112&prodTypeId=15351&prodSeriesId=3219233&swLang=8&taskId=135&swEnvOID=1005#78221
Although it seems weird that a driver issue can suddenly bring down the server, it's often relating to recent windows updates and older hardware drivers that have not been updated.
- Marked as answer by John Henry Thomas Monday, February 2, 2009 4:31 PM
Monday, February 2, 2009 3:35 PM -
Thanks a bunch guys!
Changed driver, server hasn't crashed in over an hour now.
Great stuff, all the best to the both of you!
JHHMonday, February 2, 2009 4:32 PM -
sorry for the delayed response
as ross said , the driver is 'bxnd52x.sys' which belongs to broadcom and this driver caused an interrupt . if you want to dug more into the stck trace follow from the Last_control_transfer section, the driver has called exfreepoolwithtag using an IRQL request.
any ways good that the problem got resolved
sainath Windows Driver DevelopmentMonday, February 2, 2009 5:02 PM