Win2003/Exch2003 - Event ID 1003, Category (102)

Status
Not open for further replies.
I have several clustered Windows 2003 servers with Exchange 2003 installed. On one cluster with two nodes, each node reboots once or twice a day and I get Event ID 1003, Category (102), with this text:

Error code 1000008e, parameter1 c0000005, parameter2 e0c092dc, parameter3 f1f535e4, parameter4 00000000.

And Event ID 1001 with this text:

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0xe0c092dc, 0xf20035e4, 0x00000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

I have attached five minidumps. Please help me figure out what is causing this.
Thanks,
lee
 

howard_hopkinso

Posts: 21,238   +17
Hello and welcome to Techspot.

All your minidumps crash at SYMEVENT.SYS. This is part of your Symantec/Norton security product.

Do yourself a favour, and get rid of this crap, and use a different security product(not McAfee).

Regards Howard :wave: :wave:
 
  • Thread Starter Thread Starter
  • #4
Thanks for the response.
Unfortunately, people much higher than me have decided that we will use Symantec.
Is there anything you can tell me, by looking at the dumps, about why this is happening? It doesn't happen on the other machines in the organization.
If not, OK.
Thanks again.
 

howard_hopkinso

Posts: 21,238   +17
SYMEVENT.SYS. Is the Symantec event library. This is a known issue on some systems/configurations.

Since you are forced to use this awful product. Turning off the live update can sometimes resolve this issue. Also check on the Symantec site for any updates/patches that may be available.

Regards Howard :)
 
  • Thread Starter Thread Starter
  • #6
Thanks for your help.
By the way, is there a freeware application that one can use to read the minidumps?
Thanks,
lee
 

howard_hopkinso

Posts: 21,238   +17
Yes you would need to download the Windows debugging tools.

Go HERE and follow this short tutorial on how to read minidumps.

You may also find these two links of some help. Link1 and Link2

Regards Howard :)
 
Status
Not open for further replies.