Answered by:
Windows server 2008 R2 reboot form a bugcheck

Question
-
Hi, my Windows server 2008 R2 reboot form a bugcheck.
Here is the log of DMP
The current possibility is LSI raid card. And LSI Manger cannot be opened. Unable to confirm current state log
LSI RAID driver is up to date. Unable to updata. For now, I plan to replace the LSI RAID CAR---------------------------------------------------------------------------------
---------------------------------
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)
A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen and saved in
KiBugCheckDriver.
Arguments:
Arg1: fffff8800a1e1914, memory referenced
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation
Arg3: fffff8800a1e1914, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, Mm internal code.
Debugging Details:
------------------
Could not read faulting driver name
GetUlongPtrFromAddress: unable to read from fffff800034f1300
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 7601.24441.amd64fre.win7sp1_ldr.190418-1735
SYSTEM_MANUFACTURER: IBM
SYSTEM_PRODUCT_NAME: System x3850 X5 -[71455RV]-
SYSTEM_VERSION: 06
BIOS_VENDOR: IBM Corp.
BIOS_VERSION: -[G0E173BUS-1.73]-
BIOS_DATE: 01/21/2012
BASEBOARD_MANUFACTURER: IBM
BASEBOARD_PRODUCT: Node 1, Processor Card
BASEBOARD_VERSION: (none)
DUMP_TYPE: 2
BUGCHECK_P1: fffff8800a1e1914
BUGCHECK_P2: 8
BUGCHECK_P3: fffff8800a1e1914
BUGCHECK_P4: 0
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034f1100
Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff800034f12f0
GetUlongPtrFromAddress: unable to read from fffff800034f14a8
GetPointerFromAddress: unable to read from fffff800034f10d8
fffff8800a1e1914
FAULTING_IP:
portmap.sys+4914
fffff880`0a1e1914 ?? ???
CPU_COUNT: 40
CPU_MHZ: 8d5
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 2e
CPU_STEPPING: 6
CPU_MICROCODE: 6,2e,6,0 (F,M,S,R) SIG: 8'00000000 (cache) 8'00000000 (init)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT_SERVER
BUGCHECK_STR: 0xCE
PROCESS_NAME: System
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: T_00009720WL
ANALYSIS_SESSION_TIME: 02-19-2020 10:02:05.0194
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
TRAP_FRAME: fffff8801186cb30 -- (.trap 0xfffff8801186cb30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80f631bdd0 rbx=0000000000000000 rcx=fffffa80f631bdd0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800a1e1914 rsp=fffff8801186ccc8 rbp=0000000000000080
r8=fffffa80716b50f8 r9=fffffa80a23a41a0 r10=0000000000000048
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
<Unloaded_portmap.sys>+0x4914:
fffff880`0a1e1914 ?? ???
Resetting default scope
IP_MODULE_UNLOADED:
portmap.sys+4914
fffff880`0a1e1914 ?? ???
LAST_CONTROL_TRANSFER: from fffff800033c1462 to fffff800032e7aa0
STACK_TEXT:
fffff880`1186c9d8 fffff800`033c1462 : 00000000`00000050 fffff880`0a1e1914 00000000`00000008 fffff880`1186cb30 : nt!KeBugCheckEx
fffff880`1186c9e0 fffff800`032f3b96 : 00000000`00000008 fffff880`0a1e1914 02f8fc00`20003000 fffffa80`716b5080 : nt!MmAccessFault+0x2322
fffff880`1186cb30 fffff880`0a1e1914 : fffff880`0a0cb8f0 20002000`0000000c 20002000`20002000 00000000`00000000 : nt!KiPageFault+0x356
fffff880`1186ccc8 fffff880`0a0cb8f0 : 20002000`0000000c 20002000`20002000 00000000`00000000 fffffa80`716b5080 : <Unloaded_portmap.sys>+0x4914
fffff880`1186ccd0 fffff800`03595e40 : 00000000`0000000f 20002000`20002001 35003000`0000000f 30003000`30003000 : rpcxdr!RxWorkThread+0x554
fffff880`1186cd40 fffff800`032edaa6 : fffff880`03571180 fffffa80`9f42e040 fffff880`03581040 00000000`00000000 : nt!PspSystemThreadStartup+0x194
fffff880`1186cd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: f2cba90160501576446cc0a6d0240e2be18536ed
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 51b6770241709fa10c051bd99e2b4b8ed7dab104
THREAD_SHA1_HASH_MOD: 8eac0b137050064bca635c3dc7cdbe8e46e8d022
FOLLOWUP_IP:
portmap.sys+4914
fffff880`0a1e1914 ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: portmap.sys+4914
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: portmap
IMAGE_NAME: portmap.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: X64_0xCE_portmap.sys+4914
BUCKET_ID: X64_0xCE_portmap.sys+4914
PRIMARY_PROBLEM_CLASS: X64_0xCE_portmap.sys+4914
TARGET_TIME: 2020-02-13T02:53:04.000Z
OSBUILD: 7601
OSSERVICEPACK: 1000
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 274
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 7
OSEDITION: Windows 7 Server (Service Pack 1) Enterprise TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2019-04-19 10:08:54
BUILDDATESTAMP_STR: 190418-1735
BUILDLAB_STR: win7sp1_ldr
BUILDOSVER_STR: 6.1.7601.24441.amd64fre.win7sp1_ldr.190418-1735
ANALYSIS_SESSION_ELAPSED_TIME: 5b9
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0xce_portmap.sys+4914
FAILURE_ID_HASH: {906f5bfb-d0b9-a7bf-6205-67e3a38f270b}
Followup: MachineOwner
Wednesday, February 19, 2020 2:05 AM
Answers
-
Hi,
Some information below:
The crash was caused by 0XCE due to portmap.sys driver which failed to cancel pending operations before unloading.
The portmap which comes with NFS services is designed to run only on port 111. In case any other application is consuming port 111, then the NFS portmap will not run and this is what is happening on this server.
User need to run netstat -abo and check which application is using port number 111 and reconfigure that application to use a different port number.
Another step that can be tried is uninstalling NIS role service and reinstalling and reconfiguring it again.
However in another case it was found that arc serve backup software services is portmapper and another service running is because of debong.exe process are both using the port 111. Disabling one of the service resolved the issue.
Regards,
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.- Edited by Carl FanMicrosoft contingent staff Wednesday, February 19, 2020 8:24 AM
- Marked as answer by Lxy365 Wednesday, February 19, 2020 12:12 PM
Wednesday, February 19, 2020 8:24 AM
All replies
-
To evaluate the BSOD please post logs for troubleshooting.
Using administrative command prompt copy and paste this whole command.
Make sure the default language is English so that the logs can be scanned and read.
Choose the applicable link for the operating system:
https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html
https://www.eightforums.com/threads/language-add-or-remove-in-windows-8.5849/
https://www.sevenforums.com/tutorials/87317-display-language-change.html
The command will automatically collect the computer files and place them on the desktop.
Then use 7zip to organize the files and one drive, drop box, or google drive to place share links into the thread for troubleshooting.
https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07
This command will automatically collect these files: msinfo32, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.
Open administrative command prompt and copy and paste the whole command:
copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt© %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"® export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"® export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"
There are two files for you to find manually:
a) C:\Windows\MEMORY.DMP
Use file explorer > this PC > local C: drive > right upper corner search enter the above to find results.
b) dxdiag:
In the left lower corner search type: dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread
.
.
.
.
.
Please remember to vote and to mark the replies as answers if they help.
On the bottom of each post there is:
Propose as answer = answered the question
On the left side of each post: Vote = a helpful post
.
.
.
.
.Wednesday, February 19, 2020 4:08 AM -
Hi,
Some information below:
The crash was caused by 0XCE due to portmap.sys driver which failed to cancel pending operations before unloading.
The portmap which comes with NFS services is designed to run only on port 111. In case any other application is consuming port 111, then the NFS portmap will not run and this is what is happening on this server.
User need to run netstat -abo and check which application is using port number 111 and reconfigure that application to use a different port number.
Another step that can be tried is uninstalling NIS role service and reinstalling and reconfiguring it again.
However in another case it was found that arc serve backup software services is portmapper and another service running is because of debong.exe process are both using the port 111. Disabling one of the service resolved the issue.
Regards,
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.- Edited by Carl FanMicrosoft contingent staff Wednesday, February 19, 2020 8:24 AM
- Marked as answer by Lxy365 Wednesday, February 19, 2020 12:12 PM
Wednesday, February 19, 2020 8:24 AM