none
Ayuda con reinicio inesperado con error BlueScreen en WIndows Server 2008 Standard RRS feed

  • Pregunta

  • Buenas tardes. Éste mediodia el servidor de nuestra empresa se ha reiniciado. Es el servidor DNS y DC de la empresa por lo que estoy bastante preocupado por lo que les pido ayuda para ver si podemos determinar la causa de este error.

    Los errores que he podido detectar en el visor de sucesos son los siguientes (los archivos que menciona el primer evento están en un link de dropbox mas abajo.):

    https://www.dropbox.com/s/rxrqgattro32uen/error2008.rar

    Nombre de registro:Application
    Origen:        Windows Error Reporting
    Fecha:         23/01/2013 13:49:36
    Id. del evento:1001
    Categoría de la tarea:Ninguno
    Nivel:         Información
    Palabras clave:Clásico
    Usuario:       No disponible
    Equipo:        SERVIDOR.Cefrico.local
    Descripción:
    Depósito con errores X64_0x24_srv2!Smb2ExecuteSetInfo+342, tipo 0
    Nombre de evento: BlueScreen
    Respuesta Ninguno
    Id. de archivo CAB: 0

    Firma del problema:
    P1:
    P2:
    P3:
    P4:
    P5:
    P6:
    P7:
    P8:
    P9:
    P10:

    Archivos adjuntos:
    C:\Windows\Minidump\Mini012313-01.dmp
    C:\Users\cideco\AppData\Local\Temp\1\WER-247277-0.sysdata.xml
    C:\Users\cideco\AppData\Local\Temp\1\WER168C.tmp.version.txt

    Es posible que estos archivos estén disponibles aquí:
    C:\Users\cideco\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report0116866d
    XML de evento:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Windows Error Reporting" />
        <EventID Qualifiers="0">1001</EventID>
        <Level>4</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2013-01-23T12:49:36.000Z" />
        <EventRecordID>16186</EventRecordID>
        <Channel>Application</Channel>
        <Computer>SERVIDOR.Cefrico.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data>X64_0x24_srv2!Smb2ExecuteSetInfo+342</Data>
        <Data>0</Data>
        <Data>BlueScreen</Data>
        <Data>Ninguno</Data>
        <Data>0</Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>
    C:\Windows\Minidump\Mini012313-01.dmp
    C:\Users\cideco\AppData\Local\Temp\1\WER-247277-0.sysdata.xml
    C:\Users\cideco\AppData\Local\Temp\1\WER168C.tmp.version.txt</Data>
        <Data>C:\Users\cideco\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report0116866d</Data>
      </EventData>
    </Event>

    Este es el segundo error que se ha dado 2 veces seguidas:

    Éste es el analisis del MEMORY.DMP abierto con Windbg aunque no se si lo abre generado correctamente:

    Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Users\cideco\Desktop\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe -
    Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (4 procs) Free x64
    Product: LanManNt, suite: TerminalServer SingleUserTS
    Built by: 6002.18686.amd64fre.vistasp2_gdr.120824-0336
    Machine Name:
    Kernel base = 0xfffff800`02607000 PsLoadedModuleList = 0xfffff800`027cbdd0
    Debug session time: Wed Jan 23 13:26:05.734 2013 (UTC + 1:00)
    System Uptime: 2 days 17:04:44.596
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe -
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ........
    Loading User Symbols

    Loading unloaded module list
    ......
    *** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 24, {1904aa, fffffa600790c078, fffffa600790ba50, fffffa60010b5ee1}

    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for fltmgr.sys -
    *** ERROR: Module load completed but symbols could not be loaded for srv2.sys
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    Probably caused by : srv2.sys ( srv2+1bdf2 )

    Followup: MachineOwner
    ---------

    Por favor les ruego me ayuden a averiguar que ha pasado. SI necesitan mas información no duden en preguntarme.

    Gracias de antemano.


    • Editado mamp.vig miércoles, 23 de enero de 2013 15:26 Link
    miércoles, 23 de enero de 2013 15:16

Respuestas

Todas las respuestas

  • Por lo que puedo ver en la información que das, el problema parece estar causado por el componente SMB, y hay un fix de Microsoft para solucionarlo que puedes encontrar en la siguiente página:

    http://support.microsoft.com/kb/975517

    Ya nos dirás si te ha solucionado el fallo.


    Saludos
    José Antonio Quílez
    Mi Blog

    • Marcado como respuesta Uriel Almendra viernes, 21 de junio de 2013 15:08
    miércoles, 23 de enero de 2013 18:43
    Moderador
  • Hola Jose Antonio.

    Gracias por tu respuesta. ¿Me podrías indicar donde ves donde ves que el error del Bluescreen y el reinicio puede venir de ahí? Así sabré mas o menos donde buscar para la próxima^^

    Por cierto en el kb que me indicas hay 2 fixit, uno para deshabilitar smb y otro para habilitarlo. ¿Cual debería aplicar?

    Muchas gracias y un saludo!

    Edito para apuntar que me he dado cuenta de que el cierre inesperado del sistema fué a las 13:23, con lo que el evento de l2nd - 4 fué después, al arrancar el equipo.


    • Editado mamp.vig jueves, 24 de enero de 2013 7:51 nota al pié
    miércoles, 23 de enero de 2013 18:59