The computer has rebooted from a bugcheck The bugcheck was: 0x000000d1 (0x0000000c, 0xd0000002, 0x00000000, 0xf75febd5)

All replies

• 

  

  0

  Sign in to vote

  Server just crashed/rebooted again, this time with a slightly different error:
  
  The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0x0000000c, 0xd0000002, 0x00000000, 0xf75ee8d5)
  
  JHH

  Monday, February 2, 2009 1:40 PM
• 

  

  0

  Sign in to vote

  hi there,
  
  first thing even befre troubleshooitng is to let you know that Blue screen / BSOD is not a error / problem condition.
  
  OS has sensed a potential threat by some of the driver / dll / application and it performed blue screen in order to prevent any further damage to OS. i ant to understand which is the driver it is causing the problem. when OS bug checks / BSOD , it will point out the module some times for eample "pnp.sys " here pnp.sys is a driver which caused BSOD.
  
  and the BUG check code is useful for debugging purpose to check whch module has created an exception. You have to use windbg tool to examine the memory dump provided you are good at analysis and the dump will give you the faulting module which will tell you which module / sys file has created the problem.
  
  Also when you run through the stack you will come to know the parameters which were passed during the time of crash.If it is a driver crash then you need to check if it is caused by 3rd party driver ( such as NIC driver / video driver ) , or if it is caused by Microsoft driver and also you need to check the dependency of the drivers.
  
  Action plan
  ========
  a) from when is the problem occuring , have you updated any pathces recently after which the BSOD is occuring .
  
  b) is your OS performing any application task with which the BSOD is occuring
  
  c) Make sure you have your AV updated , but i cant comment unless i find the faulting module.
  
  d) if you provide the bucket and the faulting id then it will be helpful for us .
  
  

  ---

  sainath Windows Driver Development

  • Proposed as answer by Sainath IRP_MJ_CREATE Monday, February 2, 2009 5:02 PM

  Monday, February 2, 2009 2:20 PM
• 

  

  0

  Sign in to vote

  Hi Sainath
  
  Thank you for responding.
  
  In answer to your questions:
  
  a) No changes of any kind were made to the server prior to the BSOD's occurring

  b) The BSOD occurs randomly

  c) AV is ok

  d) What do you mean by 'provide the bucket'? Do you mean post the contents of the minidump file?

  Thanks again

  JHH

  Monday, February 2, 2009 2:55 PM
• 

  

  0

  Sign in to vote

  Hi again Sainath
  
  Here is the output from running WinDbg on the most recent minidump file:
  
  ----------------------------------------------------------------------------------------------------------------------------------------------------------------
  
  

  Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
  Copyright (c) Microsoft Corporation. All rights reserved.

  
  Loading Dump File [C:\WINDOWS\Minidump\Mini020209-07.dmp]
  Mini Kernel Dump File: Only registers and stack trace are available

  Symbol search path is: C:\WINDOWS\Symbols
  Executable search path is:
  Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
  *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
  Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
  Product: Server, suite: TerminalServer SingleUserTS
  Machine Name:
  Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
  Debug session time: Mon Feb  2 14:53:01.456 2009 (GMT+0)
  System Uptime: 0 days 0:09:00.906
  Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
  *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
  Loading Kernel Symbols
  ...............................................................
  .............................................
  Loading User Symbols
  Loading unloaded module list
  ....
  *******************************************************************************
  *                                                                             *
  *                        Bugcheck Analysis                                    *
  *                                                                             *
  *******************************************************************************

  Use !analyze -v to get detailed debugging information.

  BugCheck D1, {c, d0000002, 0, f75eebd5}

  *** WARNING: Unable to verify timestamp for bxnd52x.sys
  *** ERROR: Module load completed but symbols could not be loaded for bxnd52x.sys
  Probably caused by : bxnd52x.sys ( bxnd52x+7bd5 )

  Followup: MachineOwner
  ---------

  1: kd> !analyze -v
  *******************************************************************************
  *                                                                             *
  *                        Bugcheck Analysis                                    *
  *                                                                             *
  *******************************************************************************

  DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
  An attempt was made to access a pageable (or completely invalid) address at an
  interrupt request level (IRQL) that is too high.  This is usually
  caused by drivers using improper addresses.
  If kernel debugger is available get stack backtrace.
  Arguments:
  Arg1: 0000000c, memory referenced
  Arg2: d0000002, IRQL
  Arg3: 00000000, value 0 = read operation, 1 = write operation
  Arg4: f75eebd5, address which referenced memory

  Debugging Details:
  ------------------

  
  READ_ADDRESS:  0000000c

  CURRENT_IRQL:  2

  FAULTING_IP:
  bxnd52x+7bd5
  f75eebd5 ??              ???

  CUSTOMER_CRASH_COUNT:  7

  DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

  BUGCHECK_STR:  0xD1

  PROCESS_NAME:  System

  LAST_CONTROL_TRANSFER:  from 89741d02 to 8088c963

  STACK_TEXT: 
  f78f6c0c 89741d02 89741d02 00000000 00000000 nt!ExFreePoolWithTag+0x62d
  WARNING: Frame IP not in any known module. Following frames may be wrong.
  f78f6c18 00000000 00000023 00000023 00000000 0x89741d02

  
  STACK_COMMAND:  .bugcheck ; kb

  FOLLOWUP_IP:
  bxnd52x+7bd5
  f75eebd5 ??              ???

  SYMBOL_NAME:  bxnd52x+7bd5

  FOLLOWUP_NAME:  MachineOwner

  MODULE_NAME: bxnd52x

  IMAGE_NAME:  bxnd52x.sys

  DEBUG_FLR_IMAGE_TIMESTAMP:  44a55446

  FAILURE_BUCKET_ID:  0xD1_bxnd52x+7bd5

  BUCKET_ID:  0xD1_bxnd52x+7bd5

  Followup: MachineOwner
  ------------------------------------------------------------------------------------------------------------------------------------------------------------
  
  
  Does that data provide a clue to what is causing the BSOD?
  
  Thanks
  
  JHH

  Monday, February 2, 2009 3:08 PM
• 

  

  1

  Sign in to vote

  Your bugcheck shows 'DRIVER_IRQL_NOT_LESS_OR_EQUAL' and points to a driver of 'bxnd52x.sys'. This is the network card driver (Broadcom) of your server.

  It is likely that the NIC is the source of the BSOD, but not always the case. I would jump onto HP's support site and download the latest PSP (Proliant Support Pack) for your server. Run all the updates from the pack included firmware and driver updates, especially relating to the network interface, mainboard and drive controller (SCSI/SATA).
  After the BIOS update part is complete, reboot your server, go into the BIOS and disable any onboard devices that you dont need - ie USB, LPT, Serial ports.

  I have had similar issues with older HP servers and found that the PSP updates resolve the issue. You can download the PSP for your server from here, presuming you are running the 32bit version of 2k3 R2:

  http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareIndex.jsp?lang=en&cc=uk&prodNameId=3288112&prodTypeId=15351&prodSeriesId=3219233&swLang=8&taskId=135&swEnvOID=1005#78221

  Although it seems weird that a driver issue can suddenly bring down the server, it's often relating to recent windows updates and older hardware drivers that have not been updated.

   

   

   

   

  • Marked as answer by John Henry Thomas Monday, February 2, 2009 4:31 PM

  Monday, February 2, 2009 3:35 PM
• 

  

  0

  Sign in to vote

  Thanks a bunch guys!
  
  Changed driver, server hasn't crashed in over an hour now.
  
  Great stuff, all the best to the both of you!
  
  JHH

  Monday, February 2, 2009 4:32 PM
• 

  

  0

  Sign in to vote

  sorry for the delayed response
  
  as ross said , the driver is 'bxnd52x.sys' which belongs to broadcom  and this driver caused an interrupt . if you want to dug more into the stck trace follow from the Last_control_transfer section, the driver has called exfreepoolwithtag using an IRQL request.
  
  any ways good that the problem got resolved
  
  
  

  ---

  sainath Windows Driver Development

  Monday, February 2, 2009 5:02 PM