Анализ MEMORY.DMP

[EvgenyN]

Добрый день!
Прошу помощи, после апдейта не поднялся сервер, проанализировал дамп программой Debugging Tools for Windows получил результат
Показывает на Probably caused by : Unknown_Image ( pcw!PcwpIoctlRegister+84 ), но что это значит?

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c000001d, fffff880017db900, fffff88005b71e00, 0}

Probably caused by : Unknown_Image ( pcw!PcwpIoctlRegister+84 )

Followup: MachineOwner
---------

16.0: kd:x86> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff880017db900, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88005b71e00, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {

FAULTING_IP:
pcw!PcwpIoctlRegister+84
fffff880`017db900 ff ???

CONTEXT: fffff88005b71e00 -- (.cxr 0xfffff88005b71e00)
Unable to read context, HRESULT 0x80004002

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000

STACK_TEXT:
00000000 00000000 00000000 00000000 00000000 0x0


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
pcw!PcwpIoctlRegister+84
fffff880`017db900 ff ???

SYMBOL_NAME: pcw!PcwpIoctlRegister+84

FOLLOWUP_NAME: MachineOwner

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: INVALID_KERNEL_CONTEXT

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

Followup: MachineOwner

[Petya V4sechkin]

EvgenyN, Pcw.sys - драйвер Performance Counters, код исключения 0xc000001d - Illegal Instruction.
Какой-то сбой в счетчиках производительности.

Если в безопасном режиме грузится, попробуйте рекомендации
How to manually rebuild Performance Counters for Windows Server 2008 64bit or Windows Server 2008 R2 systems (http://support.microsoft.com/kb/2554336/en-us)

Если не грузится, восстановите реестр (http://www.outsidethebox.ms/12505/#regback) из папки \Windows\System32\config\RegBack.

P. S. Какой процессор на сервере?

[Rostov_a]

Дабы не плодить тем, отпишу здесь.
Проблема следующего содержания: стал падать в dump сервер, порой пару раз на дню. Анализ дампа, таков:

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000046, Exception code that caused the bugcheck
Arg2: fffff80001ef17fc, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88006f59970, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000046 - An attempt to release a mutant object was made by a thread that was not the owner of the mutant object.

FAULTING_IP:
nt!RtlRaiseStatus+18
fffff800`01ef17fc 48 dec eax

CONTEXT: fffff88006f59970 -- (.cxr 0xfffff88006f59970)
Unable to read context, HRESULT 0x80004002

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000

STACK_TEXT:
00000000 00000000 00000000 00000000 00000000 0x0


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!RtlRaiseStatus+18
fffff800`01ef17fc 48 dec eax

SYMBOL_NAME: nt!RtlRaiseStatus+18

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: INVALID_KERNEL_CONTEXT

MODULE_NAME: Unknown_Module

Followup: MachineOwner
---------



На сервере стоит: Xeon E3-1245 + 8GB + Win2k8R2 STD.

[Petya V4sechkin]

Rostov_a, в разделе форума Устранение критических ошибок Windows (http://forum.oszone.net/forum-73.html) выполните, пожалуйста, инструкции
Важно! Прежде чем задать вопрос, прочтите эту тему! (http://forum.oszone.net/thread-81449.html)

P. S. Нужно несколько DMP-файлов.

[Docentoren]

Здравствуйте, потратил полчаса или более, но так и не нашел где мне задать мой вопрос, даже следуя вышеприведенным советам.
В общем, хотелось бы узнать результат анализа минидампа, так как слишком много инфы в нем, спасибо

Analyzing "C:\Windows\Minidump\091313-21828-01.dmp", please wait... Done.

Didn't find the answer. Try again with '-v' switch.


C:\Users\Docent>kdfe "%systemroot%\Minidump\091313-21828-01.dmp" -v


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\091313-21828-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols *http://msdl.microsoft.com/download/symbol
s
Executable search path is: srv*c:\symbols *http://msdl.microsoft.com/download/s
ymbols
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18205.x86fre.win7sp1_gdr.130708-1532
Machine Name:
Kernel base = 0x8341c000 PsLoadedModuleList = 0x8355c230
Debug session time: Fri Sep 13 19:18:12.094 2013 (GMT+9)
System Uptime: 0 days 10:06:38.157
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
......
0: kd> kd: Reading initial command '!analyze -v; q'
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: c029e14c, lock type that was held (value 1,2,3, or PTE address)
Arg2: c000009d, error status (normally i/o status code)
Arg3: 5632fbe0, current process (virtual address for lock type 3, or PTE)
Arg4: a7853000, virtual address that could not be in-paged (or PTE contents if a
rg1 is a PTE address)

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc000009d - STATUS_DEVICE_NOT_CONNECTED

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR: 0x7a_c000009d

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 834b73b2 to 834ee21c

STACK_TEXT:
80ef0b44 834b73b2 0000007a c029e14c c000009d nt!KeBugCheckEx+0x1e
80ef0bac 834c8f6d 80ef0c08 8357c300 80ef0c14 nt!MiWaitForInPageComplete+0x2fa
80ef0c2c 8347cc94 8357c300 a7853000 8756fa00 nt!MiIssueHardFault+0x3b6
80ef0c98 834a886a 00000001 a7853000 00000000 nt!MmAccessFault+0x1fef
80ef0d10 834b478e 8a027238 c029e150 00000000 nt!MiInPageSingleKernelStack+0x16c
80ef0d44 834803af 8a0272ac 80ef0d90 8360452a nt!KiInSwapKernelStacks+0x41
80ef0d50 8360452a 00000000 ad854f8d 00000000 nt!KeSwapProcessOrStack+0x78
80ef0d90 834a5899 83480337 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiWaitForInPageComplete+2fa
834b73b2 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiWaitForInPageComplete+2fa

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 51db7a55

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x7a_c000009d_nt!MiWaitForInPageComplete+2fa

BUCKET_ID: 0x7a_c000009d_nt!MiWaitForInPageComplete+2fa

Followup: MachineOwner
---------

quit:

C:\Users\Docent>

[Petya V4sechkin]

хотелось бы узнать результат анализа минидампа, так как слишком много инфы в нем
KERNEL_DATA_INPAGE_ERROR (7a)
ERROR_CODE: (NTSTATUS) 0xc000009d - STATUS_DEVICE_NOT_CONNECTED

Этого достаточно, почитайте
0x0000007A: KERNEL_DATA_INPAGE_ERROR (http://forum.oszone.net/thread-102501.html)

Код 0xc000009d - STATUS_DEVICE_NOT_CONNECTED - системный диск "отваливается". Возможные причины: неисправность самого диска, SATA/RAID-контроллера, SATA-кабеля (или какой у вас там интерфейс), блока питания.

[alef2474]

Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.


=Docentoren]DISK_HARDWARE_ERROR: There was error with disk hardware »


Тут прямым текстом пишется об ошибках дисковой системы. Простой вопрос, не то что предыдущие два.