Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

minidump analysis - Win2k SP4 sp1 Roll up

23 views
Skip to first unread message

got...@msn.com

unread,
Apr 7, 2006, 3:27:10 PM4/7/06
to
Hello,

This server has been running for about 5 years without problems.
Now, since January 2006, it started to crash every few days.
So far it has crashed about 14 times since January.

I installed WinDbg and here is the output.
I'm no expert on debugging, but managed to google some info.
This server is at a datacenter, and I am working on it remotely using
TS.

Please advise.

**************************************
Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\Minidump\Mini013106-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86
compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x804814c0
Debug session time: Tue Jan 31 11:41:40.250 2006 (GMT-7)
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
...........................................................................................
Loading User Symbols
Loading unloaded module list
......
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Bugcheck code 000000D1
Arguments 0301b426 00000004 00000000 bfe7b206

ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may
be wrong.
be182b24 00000000 0301b426 00000004 00000000 nt+0x67d67

*******************************************


Thanks for the help!!

got...@msn.com

unread,
Apr 7, 2006, 3:29:24 PM4/7/06
to
Err:
I meant SP4 rollup

Thanks!

alon.e...@gmail.com

unread,
Apr 8, 2006, 10:37:12 AM4/8/06
to
Do you have symbols configured? - It seems the answer is no since we
can't see the function: nt+0x67d67
Did you do any windows updates or something lately?

got...@msn.com

unread,
Apr 8, 2006, 3:04:17 PM4/8/06
to
Hi,

Thanks for your reply.
AS explained on several sites, I used the MS site for symbols:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

In the c:\symbols directroy, there ae files that were downloaded after
running WinDbg.

Are there some other symbols I need to use or install in some other way
?

Yes, windows update has been run, and all the latest updates available
have been applied.

The system crashed again last night.

Any ideas ?

Thanks in advance.

Alon

unread,
Apr 9, 2006, 5:56:14 AM4/9/06
to
Hi,

Please try to type "!lmi nt" in order to see why your symbols are not seen.
Than type
"!sym noisy"
".reload/f nt"

Send the results

<got...@msn.com> wrote in message
news:1144523057.3...@u72g2000cwu.googlegroups.com...

got...@msn.com

unread,
Apr 9, 2006, 9:25:23 PM4/9/06
to
Alon wrote:
> Hi,
>
> Please try to type "!lmi nt" in order to see why your symbols are not seen.
> Than type
> "!sym noisy"
> ".reload/f nt"
>
> Send the results
>

Hi Alon,
Thanks for helping out.
Here is the full copy/paste after opening the dump file, and then
running the commands you posted:

**********************************************


Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\Minidump\Mini040806-02.dmp]


Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86
compatible

Kernel base = 0x80400000 PsLoadedModuleList = 0x80481580
Debug session time: Sat Apr 8 04:31:39.601 2006 (GMT-7)


System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
.........................................................................................

Loading User Symbols
Loading unloaded module list
......
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Bugcheck code 0000007F
Arguments 00000008 00000000 00000000 00000000

ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may
be wrong.

8046ebb4 00000000 00000008 00000000 00000000 nt+0x66df9

kd> !lmi nt
Loaded Module Info: [nt]
Cannot read Image header @ 80400000
Load Report: no symbols loaded
kd> !sym noisy
noisy mode - symbol prompts on
kd> .reload/f nt
SYMSRV: c:\symbols\ntoskrnl.exe\4344EC5919cd80\ntoskrnl.exe not found
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/4344EC5919cd80/ntoskrnl.exe
not found
SYMSRV: c:\symbols\ntkrnlup.exe\4344EC5919cd80\ntkrnlup.exe not found
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntkrnlup.exe/4344EC5919cd80/ntkrnlup.exe
not found
SYMSRV: c:\symbols\ntkrnlpa.exe\4344EC5919cd80\ntkrnlpa.exe not found
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntkrnlpa.exe/4344EC5919cd80/ntkrnlpa.exe
not found
SYMSRV: c:\symbols\ntkrnlmp.exe\4344EC5919cd80\ntkrnlmp.exe not found
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/4344EC5919cd80/ntkrnlmp.exe
not found
SYMSRV: c:\symbols\ntkrpamp.exe\4344EC5919cd80\ntkrpamp.exe not found
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntkrpamp.exe/4344EC5919cd80/ntkrpamp.exe
not found
DBGHELP: C:\Program Files\Debugging Tools for Windows\ntoskrnl.exe -
file not found
DBGHELP: invalid path:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: C:\Program Files\Debugging Tools for Windows\ntkrnlup.exe -
file not found
DBGHELP: invalid path:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: C:\Program Files\Debugging Tools for Windows\ntkrnlpa.exe -
file not found
DBGHELP: invalid path:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: C:\Program Files\Debugging Tools for Windows\ntkrnlmp.exe -
file not found
DBGHELP: invalid path:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: C:\Program Files\Debugging Tools for Windows\ntkrpamp.exe -
file not found
DBGHELP: invalid path:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGENG: ntoskrnl.exe - Image mapping disallowed by non-local path.


Unable to load image ntoskrnl.exe, Win32 error 2

DBGENG: ntoskrnl.exe - Partial symbol image load missing image info
DBGHELP: No header for ntoskrnl.exe. Searching for dbg file
DBGHELP: .\ntoskrnl.dbg - file not found
DBGHELP: .\symbols\exe\ntoskrnl.dbg - path not found
DBGHELP: .\exe\ntoskrnl.dbg - path not found
DBGHELP: ntoskrnl.exe missing debug info. Searching for pdb anyway
DBGHELP: Can't use symbol server for ntoskrnl.pdb - no header
information available
DBGHELP: ntoskrnl.pdb - file not found


*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe

DBGHELP: nt - no symbols loaded
************************************************
End

Any ideas ?

Thanks again for your help.

Alon

unread,
Apr 10, 2006, 8:13:25 AM4/10/06
to
Hi again,

Well, it seems you really have some configuration problems with your
WinDbg - did you try to reinstall it? do you have network connection to the
WEB? Why do you open a minidump and not a full dump?

<got...@msn.com> wrote in message
news:1144632322....@v46g2000cwv.googlegroups.com...

0 new messages