windows bluescreen with KMODE_EXCEPTION_NOT_HANDLED

[Kelvin Tan]

hi there,

1 fine day i my Win2k server SP4 rebooted without apparent reason. it hasn't done so the 2nd time so far but i'm very eager to find out wht's wrong cos i know it will come again.

Following are error messages captured from few sources (screen, eventlog, dumpchk, memory dump).

Anyone know's wht went wrong? I saw few similar postings and seems there are ppl who are able to decode the error msg and pinpoint exactly wht went wrong. how's that done?

any help is appreciated.

cheers,
kelvin

***bluescreen error msg***

*** STOP: 0x0000001E (0xC0000044,0x804A1F6E,0x00000000,0x00000000)
KMODE_EXCEPTION_NOT_HANDLED

*** Address 804A1F6E base at 80400000, DateStamp 3ee650b3 - ntoskrnl.exe



***In eventlog***

Event ID 6088 Source Eventlog The previous system shutdown at 14:53:16 on 17-Apr-06 was unexpected
Event ID 2019 Source Srv The server was unable to allocate from the system nonpaged pool because the pool was empty.
Event ID 5719 Source NETLOGON No Windows NT or Windows 2000 Domain Controller is available for domain SHWAS. The following error occurred:
Not enough storage is available to process this command.
Event ID 2019 Source Srv The server was unable to allocate from the system nonpaged pool because the pool was empty.



** Windows 2000 Crash Dump Analysis
**
****************************************************************
*
Filename . . . . . . .c:\winnt\memory.dmp
Signature. . . . . . .PAGE
ValidDump. . . . . . .DUMP
MajorVersion . . . . .free system
MinorVersion . . . . .2195
DirectoryTableBase . .0xc42d6000
PfnDataBase. . . . . .0x890c3000
PsLoadedModuleList . .0x80484520
PsActiveProcessHead. .0x80485c68
MachineImageType . . .i386
NumberProcessors . . .4
BugCheckCode . . . . .0x0000001e
BugCheckParameter1 . .0xc0000044
BugCheckParameter2 . .0x804a1f6e
BugCheckParameter3 . .0x00000000
BugCheckParameter4 . .0x00000000

ExceptionCode. . . . .0x80000003
ExceptionFlags . . . .0x00000001
ExceptionAddress . . .0x8042f2fc



***Debugger Tools for Windows***

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

************************************************************************
WARNING: Dump file has inconsistent set-bit count. Data may be missing.
************************************************************************
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Kernel base = 0x80400000 PsLoadedModuleList = 0x80484520
Debug session time: Sun Apr 30 03:02:05.406 2006 (GMT+8)
System Uptime: 9 days 13:15:27.156
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
Loading Kernel Symbols
.........................................................................................................
Loading User Symbols
..............
Loading unloaded module list
...........*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -

The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Bugcheck code 0000001E
Arguments c0000044 804a1f6e 00000000 00000000

ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
bcd28058 80432934 bcd28480 00000000 bcd283fc nt!KeTerminateThread+0xd0e
bcd283cc 8046a033 bcd28480 bcd284d0 00000000 nt!ZwYieldExecution+0x1c60
bcd283e8 80466389 bcd28480 bcd284d0 00000001 nt!KiCoprocessorError+0x15f
*** ERROR: Symbol file could not be found. Defaulted to export symbols for Ntfs.sys -
bcd28410 bfee4d72 88fea800 fe3d4568 00000000 nt!KiReleaseSpinLock+0xba9
bcd28460 804a1f6e 00000000 00000286 8046b656 Ntfs!NtfsCommitCurrentTransaction+0x184c
00000000 00000000 00000000 00000000 00000000 nt!IoCreateStreamFileObject+0xde

 

[Samstoned]

go to MS and download the symbls
and or follow ther instructions for terminal load from website
not much from this
except maybe
your out of page file memory
our it failed to write to page file
you may need to allocate more cache memory somewhere's
I ran W2k advanced it was a litle better and handling off load memory
don't get me wrong windows is great for back end server management
but the front end is hard to config
for me anyway

 

[cpc2004]

?? Fauty CPU

It is no need to fix the symbol as your dump is full memory dump. From the stack trace, I believe that it is faulty CPU.

WARNING: Stack unwind information not available. Following frames may be wrong.
bcd28058 80432934 bcd28480 00000000 bcd283fc nt!KeTerminateThread+0xd0e
bcd283cc 8046a033 bcd28480 bcd284d0 00000000 nt!ZwYieldExecution+0x1c60
bcd283e8 80466389 bcd28480 bcd284d0 00000001 nt!KiCoprocessorError+0x15f <--- Co-Processor error ??
*** ERROR: Symbol file could not be found. Defaulted to export symbols for Ntfs.sys -
bcd28410 bfee4d72 88fea800 fe3d4568 00000000 nt!KiReleaseSpinLock+0xba9
bcd28460 804a1f6e 00000000 00000286 8046b656 Ntfs!NtfsCommitCurrentTransaction+0x184c
00000000 00000000 00000000 00000000 00000000 nt!IoCreateStreamFileObject+0xde

Your windows is crashed with NT status code c0000044. Refer the following problem
Norton AV software problem
http://www.experts-exchange.com/Operating_Systems/Win2000/Q_21711756.html
Memory Leak
http://support.microsoft.com/kb/264223/

 

[Kelvin Tan]

Hi there,

thanks a lot for your inputs.

I have run poolmon.exe and collected the following (sorted with higher bytes on top):

Memory: 3669496K Avail: 2391756K PageFlts: 87149 InRam Krnl: 2312K P:34492K
Commit:1394324K Limit:6649500K Peak:1394380K Pool N:42204K P:34692K
Tag Type Allocs Frees Diff Bytes Per Alloc

SavE Nonp 656839 ( 0) 656377 ( 0) 462 15103008 ( 0) 32690
WD Nonp 386 ( 0) 225 ( 0) 161 3392576 ( 0) 21071
NDpp Nonp 8 ( 0) 0 ( 0) 8 2544864 ( 0) 318108
LSwi Nonp 1 ( 0) 0 ( 0) 1 2293760 ( 0) 2293760
tdLL Nonp 4644 ( 0) 736 ( 7) 3908 2234880 ( -896) 571
MmCm Nonp 45 ( 0) 11 ( 0) 34 1892928 ( 0) 55674
NtFC Nonp 93778 ( 0) 77012 ( 0) 16766 1876320 ( 0) 111
PTrk Nonp 9642 ( 0) 4996 ( 0) 4646 1504000 ( 0) 323

Anyone knows what is SavE?? Is it Symantec anti-virus??? How do you define the Tag value? Appreciate your help. Thanks!!