none
システム障害: STOP エラーについて RRS feed

  • 質問

  • Windows Server 2003 SP2にて、予期せぬシャットダウンが発生しましたが、
    なかなか原因特定まで至らずご協力頂きたく質問させて頂きます。

    以下のイベントログ、メモリダンプの情報から何か得られないでしょうか。
    また、調査にあたりどのような切り口で進んでよいかなど教えて頂ければと思います。

    ちなみに、WinDbgからメモリダンプ結果を確認したところ「\WINDOWS\system32\ntoskrnl.exe」が
    クラッシュしたようにも取れますが解決策などあるのでしょうか。がわかりません。

    ■イベントのプロパティより
    ソース(S):Save Dump
    分類(R):なし
    種類(E):情報
    イベントID(I):1001
    ユーザ(U):N/A
    説明(D):
    システム障害: STOP エラー
    このコンピュータはバグチェック後、再起動されました。
    バグチェック: 0x0000008e (0xc0000005, 0xbf866e12, 0xb50ce764, 0x00000000)
    ダンプが保存されました: C:\WINDOWS\MEMORY.DMP

    ■メモリダンプ結果
    Loading Dump File [D:Mini020410-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
    Product: Server, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
    Debug session time: Thu Feb  4 12:16:20.610 2010 (GMT+9)
    System Uptime: 10 days 20:24:39.656
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ...................................................
    Loading User Symbols
    Loading unloaded module list
    ..................................................
    *** WARNING: Unable to verify timestamp for win32k.sys
    *** ERROR: Module load completed but symbols could not be loaded for win32k.sys
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, bf866e12, b50ce764, 0}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                  &

    2010年2月6日 10:52

回答

  • > WinDbgからメモリダンプ結果を確認したところ「\WINDOWS\system32\ntoskrnl.exe」が
    > クラッシュしたようにも取れますが解決策などあるのでしょうか

    これは Symbol が Load されていないために表示されています。
    Debugger を使用するときに 適切な Symbol File を load してください。

    Symbola が Load されていない状態での表示ですが、 原因は Win32k.sys にもとめられると思います。

    Event Viewer の Log は Minidump を生成した記録だけでしょうか?

    とりあえず、 下記の文書を参照してみてください。

    Windows Server 2003 ベースのコンピュータがクラッシュし、エラー メッセージ "STOP: 0x0000008E" が生成される
    http://support.microsoft.com/kb/907966

    画面の再描画後に、Win32k.sys ファイルを参照する STOP エラーが発生する
    http://support.microsoft.com/default.aspx/kb/842910

    2010年2月6日 14:18

すべての返信

  • 追加情報です。

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Probably caused by : win32k.sys ( win32k+66e12 )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: bf866e12, The address that the exception occurred at
    Arg3: b50ce764, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************

    ADDITIONAL_DEBUG_TEXT: 
    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

    MODULE_NAME: win32k

    FAULTING_MODULE: 80800000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a8417a6

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"  フ ス   ェ "0x%08lx"  フ         Q ニ オ ワ オ ス B       ェ "%s"  ノ ネ   ア ニ ヘ ナ ォ ワ ケ   ナ オ ス B

    FAULTING_IP:
    win32k+66e12
    bf866e12 ??              ???

    TRAP_FRAME:  b50ce764 -- (.trap 0xffffffffb50ce764)
    ErrCode = 00000000
    eax=e3b383c0 ebx=8084575e ecx=bcdc0000 edx=00000000 esi=b50ce84c edi=bcdc0588
    eip=bf866e12 esp=b50ce7d8 ebp=b50ce7f8 iopl=0         nv up ei ng nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
    win32k+0x66e12:
    bf866e12 ??              ???
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR:  0x8E

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from b50ce84c to bf866e12

    STACK_TEXT: 
    WARNING: Stack unwind information not available. Following frames may be wrong.
    b50ce7d4 b50ce84c bcdc0608 0000002e 00000783 win32k+0x66e12
    b50ce7f8 80906f2e bcdc0000 b50ce82c b50ce84c 0xb50ce84c
    b50ce820 80906ea2 bcdc0000 bcdc2000 b50ce84c nt+0x106f2e
    b50ce858 80906e10 00dc0000 00000068 bcd4bc20 nt+0x106ea2
    b50cea1c bf8565eb bcdc0000 00000009 0000005c nt+0x106e10
    b50cea30 bf859e2f 875652b8 0000005c 00000001 win32k+0x565eb
    b50cea54 bf83cf79 bcd4dea8 bcdc1e80 e6011848 win32k+0x59e2f
    b50cea70 bf84ad32 bcdc1e80 e6011848 0000001a win32k+0x3cf79
    b50ceabc bf899f91 00000001 bf83d9bf 87436b68 win32k+0x4ad32
    b50ceb30 bf826b11 bcdc06e8 0000001a 00000000 win32k+0x99f91
    b50ceb78 bf83dab8 0000001a 00000000 b50cebb8 win32k+0x26b11
    b50cebf8 bf8a1267 00000000 0000001a 00000000 win32k+0x3dab8
    b50cec38 bf8c62b2 ffffffff 0000001a 00000000 win32k+0xa1267
    b50ceca0 bf8d2787 ffffffff 0000001a 00000000 win32k+0xc62b2
    b50cecbc bf88f6e3 bcd406e8 0000001a 00000000 win32k+0xd2787
    b50ced08 bf8c1739 bcd406e8 0000001a 00000000 win32k+0x8f6e3
    b50ced40 80833bef 00040200 0000001a 00000000 win32k+0xc1739
    b50ced64 7c97860c badb0d00 029af060 00000000 nt+0x33bef
    b50ced68 badb0d00 029af060 00000000 00000000 0x7c97860c
    b50ced6c 029af060 00000000 00000000 00000000 0xbadb0d00
    b50ced70 00000000 00000000 00000000 00000000 0x29af060


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    win32k+66e12
    bf866e12 ??              ???

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  win32k+66e12

    FOLLOWUP_NAME:  MachineOwner

    IMAGE_NAME:  win32k.sys

    BUCKET_ID:  WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    2010年2月6日 13:18
  • > WinDbgからメモリダンプ結果を確認したところ「\WINDOWS\system32\ntoskrnl.exe」が
    > クラッシュしたようにも取れますが解決策などあるのでしょうか

    これは Symbol が Load されていないために表示されています。
    Debugger を使用するときに 適切な Symbol File を load してください。

    Symbola が Load されていない状態での表示ですが、 原因は Win32k.sys にもとめられると思います。

    Event Viewer の Log は Minidump を生成した記録だけでしょうか?

    とりあえず、 下記の文書を参照してみてください。

    Windows Server 2003 ベースのコンピュータがクラッシュし、エラー メッセージ "STOP: 0x0000008E" が生成される
    http://support.microsoft.com/kb/907966

    画面の再描画後に、Win32k.sys ファイルを参照する STOP エラーが発生する
    http://support.microsoft.com/default.aspx/kb/842910

    2010年2月6日 14:18
  • ご返信頂きありがとうございます。

    >Event Viewer の Log は Minidump を生成した記録だけでしょうか?
    その通りです。Minidumpです。

    >Windows Server 2003 ベースのコンピュータがクラッシュし、エラー メッセージ "STOP: 0x0000008E" が生成される
    http://support.microsoft.com/kb/907966
    >画面の再描画後に、Win32k.sys ファイルを参照する STOP エラーが発生する
    http://support.microsoft.com/default.aspx/kb/842910
    頂きました上記情報を確認させていただきます。

    以上、よろしくお願いいたします。

    2010年2月8日 6:01
  • > > Event Viewer の Log は Minidump を生成した記録だけでしょうか?
    > その通りです。Minidumpです。

    Event Viewer に は ほかに Error Log が 存在しない、
    記録されていない、 ということで間違いありませんか?

    > 頂きました上記情報を確認させていただきます。

    確認前に、 きちんと、 対応した Symbol を Load してから
    Debugger を実行しなおしてみてください。
    2010年2月8日 6:18
  • こんにちは、フォーラムオペレーターの三沢健二です。

    JR K Yoshikawa さん、アドバイスありがとうございます。

    案内いただいた内容が参考になられたようですので、ひとまず私の方で [回答としてマーク] を付けさせていただきました。

    なお、どうしても原因が分からない場合には、弊社有償サポートにダンプファイルの解析を依頼されてみてはいかがでしょうか?
    (必ずしも原因が特定できるとは限らないのですが、何か新しいヒントなどが見付かるかもしれませんので)


    それでは、今後とも TechNet Forum をよろしくお願いします。

    ______________________________________
    マイクロソフト株式会社 フォーラムオペレーター 三沢健二

    2010年2月25日 5:42
    モデレータ