locked
Windows server 2008 R2 reboot form a bugcheck RRS feed

  • Question

  • Hi, my Windows server 2008 R2 reboot form a bugcheck.

    Here is the log of DMP

    The current possibility is LSI raid card. And LSI Manger cannot be opened. Unable to confirm current state log

    LSI RAID driver is up to date. Unable to updata. For now, I plan to replace the LSI RAID CAR

    ---------------------------------------------------------------------------------

    ---------------------------------

    DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)
    A driver unloaded without cancelling timers, DPCs, worker threads, etc.
    The broken driver's name is displayed on the screen and saved in
    KiBugCheckDriver.
    Arguments:
    Arg1: fffff8800a1e1914, memory referenced
    Arg2: 0000000000000008, value 0 = read operation, 1 = write operation
    Arg3: fffff8800a1e1914, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000000, Mm internal code.

    Debugging Details:
    ------------------


    Could not read faulting driver name
    GetUlongPtrFromAddress: unable to read from fffff800034f1300

    KEY_VALUES_STRING: 1


    PROCESSES_ANALYSIS: 1

    SERVICE_ANALYSIS: 1

    STACKHASH_ANALYSIS: 1

    TIMELINE_ANALYSIS: 1


    DUMP_CLASS: 1

    DUMP_QUALIFIER: 400

    BUILD_VERSION_STRING:  7601.24441.amd64fre.win7sp1_ldr.190418-1735

    SYSTEM_MANUFACTURER:  IBM

    SYSTEM_PRODUCT_NAME:  System x3850 X5 -[71455RV]-

    SYSTEM_VERSION:  06

    BIOS_VENDOR:  IBM Corp.

    BIOS_VERSION:  -[G0E173BUS-1.73]-

    BIOS_DATE:  01/21/2012

    BASEBOARD_MANUFACTURER:  IBM

    BASEBOARD_PRODUCT:  Node 1, Processor Card

    BASEBOARD_VERSION:  (none)

    DUMP_TYPE:  2

    BUGCHECK_P1: fffff8800a1e1914

    BUGCHECK_P2: 8

    BUGCHECK_P3: fffff8800a1e1914

    BUGCHECK_P4: 0

    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034f1100
    Unable to get MmSystemRangeStart
    GetUlongPtrFromAddress: unable to read from fffff800034f12f0
    GetUlongPtrFromAddress: unable to read from fffff800034f14a8
    GetPointerFromAddress: unable to read from fffff800034f10d8
     fffff8800a1e1914 

    FAULTING_IP: 
    portmap.sys+4914
    fffff880`0a1e1914 ??              ???

    CPU_COUNT: 40

    CPU_MHZ: 8d5

    CPU_VENDOR:  GenuineIntel

    CPU_FAMILY: 6

    CPU_MODEL: 2e

    CPU_STEPPING: 6

    CPU_MICROCODE: 6,2e,6,0 (F,M,S,R)  SIG: 8'00000000 (cache) 8'00000000 (init)

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER

    BUGCHECK_STR:  0xCE

    PROCESS_NAME:  System

    CURRENT_IRQL:  0

    ANALYSIS_SESSION_HOST:  T_00009720WL

    ANALYSIS_SESSION_TIME:  02-19-2020 10:02:05.0194

    ANALYSIS_VERSION: 10.0.18362.1 amd64fre

    TRAP_FRAME:  fffff8801186cb30 -- (.trap 0xfffff8801186cb30)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa80f631bdd0 rbx=0000000000000000 rcx=fffffa80f631bdd0
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8800a1e1914 rsp=fffff8801186ccc8 rbp=0000000000000080
     r8=fffffa80716b50f8  r9=fffffa80a23a41a0 r10=0000000000000048
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    <Unloaded_portmap.sys>+0x4914:
    fffff880`0a1e1914 ??              ???
    Resetting default scope

    IP_MODULE_UNLOADED: 
    portmap.sys+4914
    fffff880`0a1e1914 ??              ???

    LAST_CONTROL_TRANSFER:  from fffff800033c1462 to fffff800032e7aa0

    STACK_TEXT:  
    fffff880`1186c9d8 fffff800`033c1462 : 00000000`00000050 fffff880`0a1e1914 00000000`00000008 fffff880`1186cb30 : nt!KeBugCheckEx
    fffff880`1186c9e0 fffff800`032f3b96 : 00000000`00000008 fffff880`0a1e1914 02f8fc00`20003000 fffffa80`716b5080 : nt!MmAccessFault+0x2322
    fffff880`1186cb30 fffff880`0a1e1914 : fffff880`0a0cb8f0 20002000`0000000c 20002000`20002000 00000000`00000000 : nt!KiPageFault+0x356
    fffff880`1186ccc8 fffff880`0a0cb8f0 : 20002000`0000000c 20002000`20002000 00000000`00000000 fffffa80`716b5080 : <Unloaded_portmap.sys>+0x4914
    fffff880`1186ccd0 fffff800`03595e40 : 00000000`0000000f 20002000`20002001 35003000`0000000f 30003000`30003000 : rpcxdr!RxWorkThread+0x554
    fffff880`1186cd40 fffff800`032edaa6 : fffff880`03571180 fffffa80`9f42e040 fffff880`03581040 00000000`00000000 : nt!PspSystemThreadStartup+0x194
    fffff880`1186cd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


    THREAD_SHA1_HASH_MOD_FUNC:  f2cba90160501576446cc0a6d0240e2be18536ed

    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  51b6770241709fa10c051bd99e2b4b8ed7dab104

    THREAD_SHA1_HASH_MOD:  8eac0b137050064bca635c3dc7cdbe8e46e8d022

    FOLLOWUP_IP: 
    portmap.sys+4914
    fffff880`0a1e1914 ??              ???

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  portmap.sys+4914

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: portmap

    IMAGE_NAME:  portmap.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  0

    STACK_COMMAND:  .thread ; .cxr ; kb

    FAILURE_BUCKET_ID:  X64_0xCE_portmap.sys+4914

    BUCKET_ID:  X64_0xCE_portmap.sys+4914

    PRIMARY_PROBLEM_CLASS:  X64_0xCE_portmap.sys+4914

    TARGET_TIME:  2020-02-13T02:53:04.000Z

    OSBUILD:  7601

    OSSERVICEPACK:  1000

    SERVICEPACK_NUMBER: 0

    OS_REVISION: 0

    SUITE_MASK:  274

    PRODUCT_TYPE:  3

    OSPLATFORM_TYPE:  x64

    OSNAME:  Windows 7

    OSEDITION:  Windows 7 Server (Service Pack 1) Enterprise TerminalServer SingleUserTS

    OS_LOCALE:  

    USER_LCID:  0

    OSBUILD_TIMESTAMP:  2019-04-19 10:08:54

    BUILDDATESTAMP_STR:  190418-1735

    BUILDLAB_STR:  win7sp1_ldr

    BUILDOSVER_STR:  6.1.7601.24441.amd64fre.win7sp1_ldr.190418-1735

    ANALYSIS_SESSION_ELAPSED_TIME:  5b9

    ANALYSIS_SOURCE:  KM

    FAILURE_ID_HASH_STRING:  km:x64_0xce_portmap.sys+4914

    FAILURE_ID_HASH:  {906f5bfb-d0b9-a7bf-6205-67e3a38f270b}

    Followup:     MachineOwner

    Wednesday, February 19, 2020 2:05 AM

Answers

  • Hi,

    Some information below:

    The crash was caused by 0XCE due to portmap.sys driver which failed to cancel pending operations before unloading.

    The portmap which comes with NFS services is designed to run only on port 111. In case any other application is consuming port 111, then the NFS portmap will not run and this is what is happening on this server.

    User need to run netstat -abo and check which application is using port number 111 and reconfigure that application to use a different port number.

    Another step that can be tried is uninstalling NIS role service and reinstalling and reconfiguring it again.

    However in another case it was found that arc serve backup software services is portmapper and another service running is because of debong.exe process are both using the port 111. Disabling one of the service resolved the issue.

    Regards,


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Wednesday, February 19, 2020 8:24 AM

All replies

  • To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command.

    Make sure the default language is English so that the logs can be scanned and read.

    Choose the applicable link for the operating system:
    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html
    https://www.eightforums.com/threads/language-add-or-remove-in-windows-8.5849/
    https://www.sevenforums.com/tutorials/87317-display-language-change.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use 7zip to organize the files and one drive, drop box, or google drive to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There are two files for you to find manually:

    a) C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter the above to find results.

    b) dxdiag:  

    In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread
    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.

    On the bottom of each post there is: 

    Propose as answer = answered the question

    On the left side of each post:  Vote = a helpful post
    .
    .
    .
    .
    .
    Wednesday, February 19, 2020 4:08 AM
  • Hi,

    Some information below:

    The crash was caused by 0XCE due to portmap.sys driver which failed to cancel pending operations before unloading.

    The portmap which comes with NFS services is designed to run only on port 111. In case any other application is consuming port 111, then the NFS portmap will not run and this is what is happening on this server.

    User need to run netstat -abo and check which application is using port number 111 and reconfigure that application to use a different port number.

    Another step that can be tried is uninstalling NIS role service and reinstalling and reconfiguring it again.

    However in another case it was found that arc serve backup software services is portmapper and another service running is because of debong.exe process are both using the port 111. Disabling one of the service resolved the issue.

    Regards,


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Wednesday, February 19, 2020 8:24 AM