Error 2003 Server : Error del sistema: sistema detenido

Descarga las últimas debugging tools o cambia la ruta de acceso a los
símbolos ya que no los estás cargando bien.

A parte, en lugar de usar mini-dump, configura el sistema para que haga un
dum completo (kernel) para poder sacar luego más información con las
debugging tools

Salu2!!
Javier Inglés
https://mvp.support.microsoft.com/p...B5567431B0
MS MVP, Windows Server-Directory Services



"ARKANO" escribió en el mensaje
news:
Llevo varias semanas que el sistema me cierra la sesión al realizar
busquedas desde el explorador de ficheros, al volver a iniciar la
sesión me da el siguiente código de error:

El motivo facilitado por el usuario SERVIDOR\Administrador para el
último apagado inesperado del equipo es el siguiente: Error del
sistema: sistema detenido
Código de motivo: 0x805000f
Id. de error:
Cadena de control del error: 0x00000050 (0xfffffff0, 0x00000000,
0x808925cf, 0x00000000)
Comentario: 0x00000050 (0xfffffff0, 0x00000000, 0x808925cf,
0x00000000)

Además uno de los volumenes raid empieza a comprobar la paridad.

El fichero de errores me facilita la siguiente información:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Administrador\Escritorio
\WER9a34.dir00\Mini040108-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/
download/symbols
Executable search path is:
Map \WINDOWS\system32tkrnlpa.exe:
Image region 800:8e000 does not fit in mapping
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntkrnlpa.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs)
Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Apr 1 20:54:50.437 2008 (GMT+2)
System Uptime: 0 days 0:06:31.066
Map \WINDOWS\system32tkrnlpa.exe:
Image region 800:8e000 does not fit in mapping
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntkrnlpa.exe
Loading Kernel Symbols
...
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffff0, 0, 808925cf, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************


Probably caused by : ntkrnlpa.exe ( nt+925cf )

Followup: MachineOwner


1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-
except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808925cf, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:


***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************



MODULE_NAME: nt

FAULTING_MODULE: 80800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
fffffff0

FAULTING_IP:
nt+925cf
808925cf ?? ???

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 8085eced to 80827c63

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may
be wrong.
f7902bdc 8085eced 00000050 fffffff0 00000000 nt+0x27c63
f7902c54 8088c798 00000000 fffffff0 00000000 nt+0x5eced
f7902c6c 808925cf badb0d00 fffffff6 00000019 nt+0x8c798
f7902d2c 808c6dd5 fffffff6 00000000 808a46c0 nt+0x925cf
f7902d48 808c7dba e2abd3b0 e29b76b0 f7902d80 nt+0xc6dd5
f7902d58 80814841 e2abd3b0 00000000 8a3933f0 nt+0xc7dba
f7902d80 8088043d 00000000 00000000 8a3933f0 nt+0x14841
f7902dac 80949b7c 00000000 00000000 00000000 nt+0x8043d
f7902ddc 8088e062 80880352 00000001 00000000 nt+0x149b7c
00000000 00000000 00000000 00000000 00000000 nt+0x8e062


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+925cf
808925cf ?? ???

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt+925cf

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntkrnlpa.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner


1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-
except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808925cf, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:


***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************



MODULE_NAME: nt

FAULTING_MODULE: 80800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

READ_ADDRESS: fffffff0

FAULTING_IP:
nt+925cf
808925cf ?? ???

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 8085eced to 80827c63

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may
be wrong.
f7902bdc 8085eced 00000050 fffffff0 00000000 nt+0x27c63
f7902c54 8088c798 00000000 fffffff0 00000000 nt+0x5eced
f7902c6c 808925cf badb0d00 fffffff6 00000019 nt+0x8c798
f7902d2c 808c6dd5 fffffff6 00000000 808a46c0 nt+0x925cf
f7902d48 808c7dba e2abd3b0 e29b76b0 f7902d80 nt+0xc6dd5
f7902d58 80814841 e2abd3b0 00000000 8a3933f0 nt+0xc7dba
f7902d80 8088043d 00000000 00000000 8a3933f0 nt+0x14841
f7902dac 80949b7c 00000000 00000000 00000000 nt+0x8043d
f7902ddc 8088e062 80880352 00000001 00000000 nt+0x149b7c
00000000 00000000 00000000 00000000 00000000 nt+0x8e062


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+925cf
808925cf ?? ???

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt+925cf

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntkrnlpa.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner


1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-
except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808925cf, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:


***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************



MODULE_NAME: nt

FAULTING_MODULE: 80800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

READ_ADDRESS: fffffff0

FAULTING_IP:
nt+925cf
808925cf ?? ???

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 8085eced to 80827c63

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may
be wrong.
f7902bdc 8085eced 00000050 fffffff0 00000000 nt+0x27c63
f7902c54 8088c798 00000000 fffffff0 00000000 nt+0x5eced
f7902c6c 808925cf badb0d00 fffffff6 00000019 nt+0x8c798
f7902d2c 808c6dd5 fffffff6 00000000 808a46c0 nt+0x925cf
f7902d48 808c7dba e2abd3b0 e29b76b0 f7902d80 nt+0xc6dd5
f7902d58 80814841 e2abd3b0 00000000 8a3933f0 nt+0xc7dba
f7902d80 8088043d 00000000 00000000 8a3933f0 nt+0x14841
f7902dac 80949b7c 00000000 00000000 00000000 nt+0x8043d
f7902ddc 8088e062 80880352 00000001 00000000 nt+0x149b7c
00000000 00000000 00000000 00000000 00000000 nt+0x8e062


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+925cf
808925cf ?? ???

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt+925cf

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntkrnlpa.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner


Por mas vueltas que le doy no consigo dar con el problema.

Alguna sugerencia ????

Gracias por adelantado

On 2 abr, 08:40, "Javier Inglés [MS MVP]"
wrote:

Descarga las últimas debugging tools o cambia la ruta de acceso a los
símbolos ya que no los estás cargando bien.

A parte, en lugar de usar mini-dump, configura el sistema para que haga un
dum completo (kernel) para poder sacar luego más información con las
debugging tools

Salu2!!
Javier Ingléshttps://mvp.support.microsoft.com/...209-2CB...
MS MVP, Windows Server-Directory Services



"ARKANO" escribió en el mensajenews:
Llevo varias semanas que el sistema me cierra la sesión al realizar
busquedas desde el explorador de ficheros, al volver a iniciar la
sesión me da el siguiente código de error:

El motivo facilitado por el usuario SERVIDOR\Administrador para el
último apagado inesperado del equipo es el siguiente: Error del
sistema: sistema detenido
 Código de motivo: 0x805000f
 Id. de error:
 Cadena de control del error: 0x00000050 (0xfffffff0, 0x00000000,
0x808925cf, 0x00000000)
 Comentario: 0x00000050 (0xfffffff0, 0x00000000, 0x808925cf,
0x00000000)

Además uno de los volumenes raid empieza a comprobar la paridad.

El fichero de errores me facilita la siguiente información:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Documents and Settings\Administrador\Escritorio
\WER9a34.dir00\Mini040108-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/
download/symbols
Executable search path is:
Map \WINDOWS\system32tkrnlpa.exe:
  Image region 800:8e000 does not fit in mapping
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntkrnlpa.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs)
Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Apr  1 20:54:50.437 2008 (GMT+2)
System Uptime: 0 days 0:06:31.066
Map \WINDOWS\system32tkrnlpa.exe:
  Image region 800:8e000 does not fit in mapping
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntkrnlpa.exe
Loading Kernel Symbols
...­
Loading User Symbols
Loading unloaded module list
...
***************************************************************************­****
*
*
*                        Bugcheck
Analysis                                    *
*
*
***************************************************************************­****

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffff0, 0, 808925cf, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***
***
***
***
***    Your debugger is not using the correct symbols
***
***
***
***    In order for this command to work properly, your symbol path
***
***    must point to .pdb files that have full type information.
***
***
***
***    Certain .pdb files (such as the public OS symbols) do not
***
***    contain the required information.  Contact the group that
***
***    provided you with these symbols if you need this command to
***
***    work.
***
***
***
***    Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
***    Your debugger is not using the correct symbols
***
***
***
***    In order for this command to work properly, your symbol path
***
***    must point to .pdb files that have full type information.
***
***
***
***    Certain .pdb files (such as the public OS symbols) do not
***
***    contain the required information.  Contact the group that
***
***    provided you with these symbols if you need this command to
***
***    work.
***
***
***
***    Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
***    Your debugger is not using the correct symbols
***
***
***
***    In order for this command to work properly, your symbol path
***
***    must point to .pdb files that have full type information.
***
***
***
***    Certain .pdb files (such as the public OS symbols) do not
***
***    contain the required information.  Contact the group that
***
***    provided you with these symbols if you need this command to
***
***    work.
***
***
***
***    Type referenced: nt!_KPRCB
***
***
***
*************************************************************************

Probably caused by : ntkrnlpa.exe ( nt+925cf )

Followup: MachineOwner


1: kd> !analyze -v
***************************************************************************­****
*
*
*                        Bugcheck
Analysis                                    *
*
*
***************************************************************************­****

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-
except,
it must be protected by a Probe.  Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808925cf, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:


***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***
***
***
***
***    Your debugger is not using the correct symbols
***
***
***
***    In order for this command to work properly, your symbol path
***
***    must point to .pdb files that have full type information.
***
***
***
***    Certain .pdb files (such as the public OS symbols) do not
***
***    contain the required information.  Contact the group that
***
***    provided you with these symbols if you need this command to
***
***    work.
***
***
***
***    Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
***    Your debugger is not using the correct symbols
***
***
***
***    In order for this command to work properly, your symbol path
***
***    must point to .pdb files that have full type information.
***
***
***
***    Certain .pdb files (such as the public OS symbols) do not
***
***    contain the required information.  Contact the group that
***
***    provided you with these symbols if you need this command to
***
***    work.
***
***
***
***    Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
***    Your debugger is not using the correct symbols
***
***
***
***    In order for this command to work properly, your symbol path
***
***    must point to .pdb files that have full type information.
***
***
***
***    Certain .pdb files (such as the public OS symbols) do not
***
***    contain the required information.  Contact the group that
***
***    provided you with these symbols if you need this command to
***
***    work.
***
***
***
***    Type referenced: nt!_KPRCB
***
***
***
*************************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 80800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  45ec0a19

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
 fffffff0

FAULTING_IP:
nt+925cf
808925cf ??              ???

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

BUGCHECK_STR:  0x50

LAST_CONTROL_TRANSFER:  from 8085eced to 80827c63

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may
be wrong.
f7902bdc 8085eced 00000050 fffffff0 00000000 nt+0x27c63
f7902c54 8088c798 00000000 fffffff0 00000000 nt+0x5eced
f7902c6c 808925cf badb0d00 fffffff6 00000019 nt+0x8c798
f7902d2c 808c6dd5 fffffff6 00000000 808a46c0 nt+0x925cf
f7902d48 808c7dba e2abd3b0 e29b76b0 f7902d80 nt+0xc6dd5
f7902d58 80814841 e2abd3b0 00000000 8a3933f0 nt+0xc7dba
f7902d80 8088043d 00000000 00000000 8a3933f0 nt+0x14841
f7902dac 80949b7c 00000000 00000000 00000000 nt+0x8043d
f7902ddc 8088e062 80880352 00000001 00000000 nt+0x149b7c
00000000 00000000 00000000 00000000 00000000 nt+0x8e062

STACK_COMMAND:  kb

FOLLOWUP_IP:
nt+925cf
808925cf ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt+925cf

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntkrnlpa.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner


1: kd> !analyze -v
***************************************************************************­****
*
*
*                        Bugcheck
Analysis                                    *
*
*
***************************************************************************­****

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-
except,
it must be protected by a Probe.  Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808925cf, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:


***** Kernel symbols ...

leer más »

Esto es lo que he sacado del memory.dmp actualizando los simbolos:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

************************************************************
WARNING: Dump file has been truncated. Data may be missing.
************************************************************
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/
download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs)
Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Apr 1 20:54:50.437 2008 (GMT+2)
System Uptime: 0 days 0:06:31.066
Loading Kernel Symbols
...
Loading User Symbols

Loading unloaded module list
...
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffff0, 0, 808925cf, 0}





Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+28b )

Followup: MachineOwner


1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-
except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808925cf, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:







OVERLAPPED_MODULE: Address regions for 'mrxsmb' and 'NetBurn.sys'
overlap

READ_ADDRESS: fffffff0

FAULTING_IP:
nt!ExFreePoolWithTag+28b
808925cf 668b4602 mov ax,word ptr [esi+2]

MM_INTERNAL_CODE: 0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

CURRENT_IRQL: 1

TRAP_FRAME: f7902c6c -- (.trap 0xfffffffff7902c6c)
ErrCode = 00000000
eax=ffffff00 ebx=fffffff6 ecx000000 edx=fffffff6 esi=ffffffee
edi000000
eip€8925cf esp÷902ce0 ebp÷902d2c iopl=0 nv up ei pl nz
na pe nc
cs08 ss10 ds23 es23 fs30 gs00
efl010206
nt!ExFreePoolWithTag+0x28b:
808925cf 668b4602 mov ax,word ptr [esi+2] ds:
0023:fffffff0=????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8085eced to 80827c63

STACK_TEXT:
f7902bdc 8085eced 00000050 fffffff0 00000000 nt!KeBugCheckEx+0x1b
f7902c54 8088c798 00000000 fffffff0 00000000 nt!MmAccessFault+0xb25
f7902c54 808925cf 00000000 fffffff0 00000000 nt!KiTrap0E+0xdc
f7902d2c 808c6dd5 fffffff6 00000000 808a46c0 nt!ExFreePoolWithTag
+0x28b
f7902d48 808c7dba e2abd3b0 e29b76b0 f7902d80 nt!CmpCleanUpKcbValueCache
+0x51
f7902d58 80814841 e2abd3b0 00000000 8a3933f0 nt!
CmpCleanUpKcbCacheWithLock+0x14
f7902d80 8088043d 00000000 00000000 8a3933f0 nt!CmpDelayCloseWorker
+0x25b
f7902dac 80949b7c 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f7902ddc 8088e062 80880352 00000001 00000000 nt!PspSystemThreadStartup
+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+28b
808925cf 668b4602 mov ax,word ptr [esi+2]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!ExFreePoolWithTag+28b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b

BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b

Followup: MachineOwner


Alguna sugerencia,

Gracias

Ha sido a raíz de algo en particular?

La cotnroladora RAID está al último nivel de driver adecuado para el
sistema?

Salu2!!
Javier Inglés
https://mvp.support.microsoft.com/p...B5567431B0
MS MVP, Windows Server-Directory Services



"ARKANO" escribió en el mensaje
news:
On 2 abr, 08:40, "Javier Inglés [MS MVP]"
wrote:

Descarga las últimas debugging tools o cambia la ruta de acceso a los
símbolos ya que no los estás cargando bien.

A parte, en lugar de usar mini-dump, configura el sistema para que haga un
dum completo (kernel) para poder sacar luego más información con las
debugging tools

Salu2!!
Javier
Ingléshttps://mvp.support.microsoft.com/...209-2CB...
MS MVP, Windows Server-Directory Services



"ARKANO" escribió en el
mensajenews:
Llevo varias semanas que el sistema me cierra la sesión al realizar
busquedas desde el explorador de ficheros, al volver a iniciar la
sesión me da el siguiente código de error:

El motivo facilitado por el usuario SERVIDOR\Administrador para el
último apagado inesperado del equipo es el siguiente: Error del
sistema: sistema detenido
Código de motivo: 0x805000f
Id. de error:
Cadena de control del error: 0x00000050 (0xfffffff0, 0x00000000,
0x808925cf, 0x00000000)
Comentario: 0x00000050 (0xfffffff0, 0x00000000, 0x808925cf,
0x00000000)

Además uno de los volumenes raid empieza a comprobar la paridad.

El fichero de errores me facilita la siguiente información:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Documents and Settings\Administrador\Escritorio
\WER9a34.dir00\Mini040108-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/
download/symbols
Executable search path is:
Map \WINDOWS\system32tkrnlpa.exe:
Image region 800:8e000 does not fit in mapping
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntkrnlpa.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs)
Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Apr 1 20:54:50.437 2008 (GMT+2)
System Uptime: 0 days 0:06:31.066
Map \WINDOWS\system32tkrnlpa.exe:
Image region 800:8e000 does not fit in mapping
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntkrnlpa.exe
Loading Kernel Symbols
...­
Loading User Symbols
Loading unloaded module list
...
***************************************************************************­****
*
*
* Bugcheck
Analysis *
*
*
***************************************************************************­****

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffff0, 0, 808925cf, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************

Probably caused by : ntkrnlpa.exe ( nt+925cf )

Followup: MachineOwner


1: kd> !analyze -v
***************************************************************************­****
*
*
* Bugcheck
Analysis *
*
*
***************************************************************************­****

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-
except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808925cf, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:


***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: nt!_KPRCB
***
***
***
*************************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 80800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
fffffff0

FAULTING_IP:
nt+925cf
808925cf ?? ???

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 8085eced to 80827c63

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may
be wrong.
f7902bdc 8085eced 00000050 fffffff0 00000000 nt+0x27c63
f7902c54 8088c798 00000000 fffffff0 00000000 nt+0x5eced
f7902c6c 808925cf badb0d00 fffffff6 00000019 nt+0x8c798
f7902d2c 808c6dd5 fffffff6 00000000 808a46c0 nt+0x925cf
f7902d48 808c7dba e2abd3b0 e29b76b0 f7902d80 nt+0xc6dd5
f7902d58 80814841 e2abd3b0 00000000 8a3933f0 nt+0xc7dba
f7902d80 8088043d 00000000 00000000 8a3933f0 nt+0x14841
f7902dac 80949b7c 00000000 00000000 00000000 nt+0x8043d
f7902ddc 8088e062 80880352 00000001 00000000 nt+0x149b7c
00000000 00000000 00000000 00000000 00000000 nt+0x8e062

STACK_COMMAND: kb

FOLLOWUP_IP:
nt+925cf
808925cf ?? ???

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt+925cf

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntkrnlpa.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner


1: kd> !analyze -v
***************************************************************************­****
*
*
* Bugcheck
Analysis *
*
*
***************************************************************************­****

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-
except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808925cf, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:


***** Kernel symbols ...

leer más »

Esto es lo que he sacado del memory.dmp actualizando los simbolos:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

************************************************************
WARNING: Dump file has been truncated. Data may be missing.
************************************************************
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/
download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs)
Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Apr 1 20:54:50.437 2008 (GMT+2)
System Uptime: 0 days 0:06:31.066
Loading Kernel Symbols
...
Loading User Symbols

Loading unloaded module list
...
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffff0, 0, 808925cf, 0}





Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+28b )

Followup: MachineOwner


1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-
except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808925cf, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:







OVERLAPPED_MODULE: Address regions for 'mrxsmb' and 'NetBurn.sys'
overlap

READ_ADDRESS: fffffff0

FAULTING_IP:
nt!ExFreePoolWithTag+28b
808925cf 668b4602 mov ax,word ptr [esi+2]

MM_INTERNAL_CODE: 0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

CURRENT_IRQL: 1

TRAP_FRAME: f7902c6c -- (.trap 0xfffffffff7902c6c)
ErrCode = 00000000
eax=ffffff00 ebx=fffffff6 ecx000000 edx=fffffff6 esi=ffffffee
edi000000
eip€8925cf esp÷902ce0 ebp÷902d2c iopl=0 nv up ei pl nz
na pe nc
cs08 ss10 ds23 es23 fs30 gs00
efl010206
nt!ExFreePoolWithTag+0x28b:
808925cf 668b4602 mov ax,word ptr [esi+2] ds:
0023:fffffff0=????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8085eced to 80827c63

STACK_TEXT:
f7902bdc 8085eced 00000050 fffffff0 00000000 nt!KeBugCheckEx+0x1b
f7902c54 8088c798 00000000 fffffff0 00000000 nt!MmAccessFault+0xb25
f7902c54 808925cf 00000000 fffffff0 00000000 nt!KiTrap0E+0xdc
f7902d2c 808c6dd5 fffffff6 00000000 808a46c0 nt!ExFreePoolWithTag
+0x28b
f7902d48 808c7dba e2abd3b0 e29b76b0 f7902d80 nt!CmpCleanUpKcbValueCache
+0x51
f7902d58 80814841 e2abd3b0 00000000 8a3933f0 nt!
CmpCleanUpKcbCacheWithLock+0x14
f7902d80 8088043d 00000000 00000000 8a3933f0 nt!CmpDelayCloseWorker
+0x25b
f7902dac 80949b7c 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f7902ddc 8088e062 80880352 00000001 00000000 nt!PspSystemThreadStartup
+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+28b
808925cf 668b4602 mov ax,word ptr [esi+2]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!ExFreePoolWithTag+28b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b

BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b

Followup: MachineOwner


Alguna sugerencia,

Gracias

Lamento el retraso, he estado fuera.

Adelanto que se cambió el hardware del equipo y se reinstaló el
sistema manteniendo las configuraciones, todo estuvo corriendo sin
problemas durante 2 meses.

El problema no lo tengo identificado a raiz de nada en particular, la
controladora raiz estaba trabajando con un controlador no firmado pero
lo actualice por uno certificado y el problema continúa, esto fué
antes de generar el informe dmp que adjunté el otro dia.

Hardware del equipo:
Placa base Asus P5M2-E4L Xeon Core Duo FSB-1066/800 INTEL 3000MCH/
ICH7R
1 Procesador Xeon X3220 2.4GHZ QUAD CORE FSB1066 C 8MB (INTEL)
1 Modulo DDR 2 Gb 667 Mhz
Controladora 1 Marvell 61xx Marvell: 2 hdd Raid 1
Controladora 2 Intel(R) 82801GR/GH Sata Raid: 3 hdd Raid 5
Sistema:
Windows 2003 Server Standar SP2, actualizaciones al dia.

Adjunto esta información por si hay algún problema conocido con algún
componente o driver relacionado.

Gracias y Saludos.

Revisa esto por si acaso también

An updated Storport storage driver is available for Windows Server 2003
http://support.microsoft.com/kb/932755/en-us

Salu2!!
Javier Inglés
https://mvp.support.microsoft.com/p...B5567431B0
MS MVP, Windows Server-Directory Services



"ARKANO" escribió en el mensaje
news:
Lamento el retraso, he estado fuera.

Adelanto que se cambió el hardware del equipo y se reinstaló el
sistema manteniendo las configuraciones, todo estuvo corriendo sin
problemas durante 2 meses.

El problema no lo tengo identificado a raiz de nada en particular, la
controladora raiz estaba trabajando con un controlador no firmado pero
lo actualice por uno certificado y el problema continúa, esto fué
antes de generar el informe dmp que adjunté el otro dia.

Hardware del equipo:
Placa base Asus P5M2-E4L Xeon Core Duo FSB-1066/800 INTEL 3000MCH/
ICH7R
1 Procesador Xeon X3220 2.4GHZ QUAD CORE FSB1066 C 8MB (INTEL)
1 Modulo DDR 2 Gb 667 Mhz
Controladora 1 Marvell 61xx Marvell: 2 hdd Raid 1
Controladora 2 Intel(R) 82801GR/GH Sata Raid: 3 hdd Raid 5
Sistema:
Windows 2003 Server Standar SP2, actualizaciones al dia.

Adjunto esta información por si hay algún problema conocido con algún
componente o driver relacionado.

Gracias y Saludos.