In the Event log I see this error The computer has rebooted from a bugcheck.
The bugcheck was: 0x000000c2 (0x00000007, 0x0000121a, 0xf56d3867,
0xc0000120). A dump was saved in: C:\WINDOWS\MEMORY.DMP.
Attached is a debug from the memory.dmp file everything is pointing to the
fact that the ntkrpamp.exe is the problem and I have read that it may be
faulty memory or there may be a hot fix for dropped packets none the less the
server reboots and will run fine for 4 or 5 days then it will re-boot with
the same error. I would like to find out what is causing the error so that I
can get it fixed. This is a 2003 R2 Enterprise sp2 server fully patched and
running SQL 2005
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\i386
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free
x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed Oct 15 03:16:24.082 2008 (GMT-4)
System Uptime: 6 days 17:02:16.265
Loading Kernel Symbols
.................................................................................................... .........
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 121a, f56d3867, c0000120}
*** ERROR: Module load completed but symbols could not be loaded for
MfeAVFK.sys
*** ERROR: Module load completed but symbols could not be loaded for
MfeBOPK.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
mfehidk.sys -
*** ERROR: Module load completed but symbols could not be loaded for
cpqteam.sys
*** ERROR: Module load completed but symbols could not be loaded for
q57xp32.sys
*** ERROR: Module load completed but symbols could not be loaded for
cpqasm2.sys
*** ERROR: Module load completed but symbols could not be loaded for
vstor2.sys
*** WARNING: Unable to verify timestamp for ati2drad.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
mfetdik.sys -
*** ERROR: Module load completed but symbols could not be loaded for
CPQCISSE.sys
*** ERROR: Module load completed but symbols could not be loaded for
cpqcissm.sys
*** ERROR: Module load completed but symbols could not be loaded for
dump_cpqcissm.sys
*** ERROR: Module load completed but symbols could not be loaded for
sysmgmt.sys
*** ERROR: Module load completed but symbols could not be loaded for
cpqcidrv.sys
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+477 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad
IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 0000121a, (reserved)
Arg3: f56d3867, Memory contents of the pool block
Arg4: c0000120, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: c0000120
BUGCHECK_STR: 0xc2_7
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 808927bb to 80827c63
STACK_TEXT:
f78cead4 808927bb 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b
f78ceb3c 8087c543 c0000120 00000000 f78cebbc nt!ExFreePoolWithTag+0x477
f78ceb5c f7b4e18a 891d9998 f78cebbc f78ceb90 nt!ExDeleteResourceLite+0x5d
f78ceb6c f7b84c27 891d9998 e1427390 e1187c60 Ntfs!NtfsFreeEresource+0x6b
f78ceb90 f7b4d212 88fde500 f78cebbc f78cebc6 Ntfs!NtfsDeleteFcb+0x4e
f78cebe0 f7b821f9 88fde500 8aef47f8 e1187c60 Ntfs!NtfsTeardownFromLcb+0x1e2
f78cec38 f7b4f137 88fde500 e1187d28 00000000 Ntfs!NtfsTeardownStructures+0x12c
f78cec64 f7b8f0a9 88fde500 e1187d28 00000000
Ntfs!NtfsDecrementCloseCounts+0xa9
f78cecec f7b891d8 88fde500 e1187d28 e1187c60 Ntfs!NtfsCommonClose+0x3a1
f78ced80 8088043d 00000000 00000000 8af7b628 Ntfs!NtfsFspClose+0xe2
f78cedac 80949b7c 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78ceddc 8088e062 80880352 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+477
808927bb ff75fc push dword ptr [ebp-4]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExFreePoolWithTag+477
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19
FAILURE_BUCKET_ID: 0xc2_7_nt!ExFreePoolWithTag+477
BUCKET_ID: 0xc2_7_nt!ExFreePoolWithTag+477
Followup: MachineOwner
---------
Reply With Quote
Bookmarks