Hi All,
I want to diagnose a windows 2000 debug file. i am copying the same over here. Can anyone let me know the reason why this make a server to restart and wht is the cause.
----------------------------------------------------------------
Wednesday, November 12, 2003 9:33:59 PM scottec
Loading Dump File [E:\Memory.dmp]
Kernel Dump File: Full address space is available
Microsoft (R) Windows Kernel Debugger Version 3.0.0020.0
Copyright (c) Microsoft Corporation. All rights reserved.
Loaded dbghelp extension DLL
Loaded ext extension DLL
Loaded kext extension DLL
Loaded kdextx86 extension DLL
Symbol search path is: h:\win2kdebug\sp6symbols
Executable search path is:
Windows NT 4 Kernel Version 1381 (Service Pack 6) MP (4 procs) Free x86 compatible
Kernel base = 0x80100000 PsLoadedModuleList = 0x80154670
Debug session time: Mon Nov 03 09:44:47 2003
System Uptime: 2 days 5:42:07
Loading Kernel Symbols
....................................................
Loading unloaded module list
Unable to examine unloaded module list
Loading User Symbols
...............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyzebugcheck -v to get more information.
BugCheck A, {f2079000, 1c, 0, 80117120}
Probably caused by driver ntdll.dll ( ntdll!ZwRequestWaitReplyPort+0xb )
Followup : MachineOwner
2: kd> !analyzebugcheck -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pagable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: f2079000, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80117120, address which referenced memory
Details:
Read address f2079000unable to get nt!MmPoolCodeEnd
unable to get nt!MmPoolCodeStart
, Nonpaged pool
Current IRQL 1c Fault occurred in driver ntkrnlmp.exe ( ntkrnlmp!KiWaitTest+0x48 )
80117120 803902 cmp byte ptr [ecx],0x2
Probably caused by driver ntdll.dll ( ntdll!ZwRequestWaitReplyPort+0xb )
Followup : MachineOwner
BUCKET: 0xA_1C_ntdll!ZwRequestWaitReplyPort_ntdll.dll_3786600B_5F60A
ChildEBP RetAddr
f208fdd4 80117120 ntkrnlmp!KiTrap0E+0x284
f208fe5c 8011a058 ntkrnlmp!KiWaitTest+0x48
f208fe70 8017a33b ntkrnlmp!KeReleaseSemaphore+0x54
f208fef0 801413a9 ntkrnlmp!NtRequestWaitReplyPort+0x511
f208fef0 77f67fd7 ntkrnlmp!KiSystemService+0xc9
00f8f85c 765248d1 ntdll!ZwRequestWaitReplyPort+0xb
00f8fa7c 765240a6 LSASRV!LsapCallRm+0x8e
00f8faa0 75b86e3f LSASRV!LsapCreateLogonSession+0x95
00f8fe20 765242b1 msv1_0!LsaApLogonUserEx+0x6a2
00f8fee4 7652a029 LSASRV!LsapAuApiDispatchLogonUser+0x1a7
00f8ffb8 77f04ede LSASRV!LsapAuServerLoop+0x161
00f8ffec 00000000 KERNEL32!BaseThreadStart+0x51
Creating .\DMP12A3.tmp - mini kernel dump
Cheers
