Annoying Random Crashes Win2K advince server

[mso]

The computer has rebooted randomly in the last few months and i have replaced all the hardwares, like HDD, RAM, cables, power supply and SCSI termination. Now this is my first time using Microsoft ® Windows Debugger Version 6.8.0004.0 X86

I think I have done everything right up till now... when I open the dump file this is what WinDbg comes up with....BugCheck 77, {c000000e, c000000e, 1, f1a000}

Furthermore, there was nothing much information that i could find from the event log, I was just able to find one , which was "The previous system shutdown at XXX was unexpected."

I would like to seek someone here can give me some idea? The following is what i got from the WinDbg:

Microsoft ® Windows Debugger Version 6.8.0004.0 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [Z:\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: c:\symbols
Executable search path is: 
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: Server, suite: Enterprise
Kernel base = 0x80400000 PsLoadedModuleList = 0x80481580
Debug session time: Tue Mar 25 04:04:50.213 2008 (GMT+8)
System Uptime: 2 days 14:46:44.929
Loading Kernel Symbols
..................................................................................................
Loading User Symbols

Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 77, {c000000e, c000000e, 1, f1a000}





Probably caused by : memory_corruption ( nt!MiMakeOutswappedPageResident+2b9 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in.  Caused by
bad block in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found.  Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED)  normally indicates
the data could not be read from the disk due to a bad
block.  Upon reboot autocheck will run and attempt to map out the bad
sector.  If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging
file is on a SCSI disk device, then the cabling and termination should be
checked.  See the knowledge base article on SCSI termination.
Arguments:
Arg1: c000000e, status code
Arg2: c000000e, i/o status code
Arg3: 00000001, page file number
Arg4: 00f1a000, offset into page file

Debugging Details:
------------------






ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR:  0x77_c000000e

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 8044018a to 80440aef

STACK_TEXT:  
f686bd50 8044018a c03d96fc 00000019 00000001 nt!MiMakeOutswappedPageResident+0x2b9
f686bd7c 8046397d 88dcd300 00000000 00000000 nt!MmInPageKernelStack+0x10e
f686bd90 80463942 00000000 00000000 00000000 nt!KiInSwapKernelStacks+0x2f
f686bda8 80454ab6 00000000 00000000 00000000 nt!KeSwapProcessOrStack+0x80
f686bddc 804692a2 804638c2 00000000 00000000 nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiMakeOutswappedPageResident+2b9
80440aef b102            mov     cl,2

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiMakeOutswappedPageResident+2b9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  44925809

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x77_c000000e_nt!MiMakeOutswappedPageResident+2b9

BUCKET_ID:  0x77_c000000e_nt!MiMakeOutswappedPageResident+2b9

Followup: MachineOwner
---------

[FAT64]

Oh dear, you do seem to be having problems. I hate to rub it in, but my two Windows 2000 Advanced Server installations have worked without a hitch for the last three years!

Are you fully up-to-date in terms of updates and service packs??

[Kelsenellenelvian]

memory_corruption

Run Memtest - http://hcidesign.com/memtest/

It does need to run for a looong time @ least an hour. Usually though if it is the ram (yes I know you replaced it, but the new batch can be faulty too seems like your on an older system so I am betting it is old ram too) you will know it the first 15 minutes because memtest will start coughing up errors..

If their is no error then I would say your motherboards having an ide controller conflict.

There are others on the forum than can read that memory dump and tell you more though so I would upload the dump file somewhere for them to check.

Edited March 26, 2008 by Kelsenellenelvian

[Mr Snrub]

"ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.

DISK_HARDWARE_ERROR: There was error with disk hardware"

Kernel stack inpage error - the OS wanted to copy a section of virtual memory from a page file into physical memory, but the disk was suddenly "not there".

On which volumes do you have the pagefile set?

Arg3: 00000001, page file number

(Hint: use the command !vm in the debugger and see the summary at the top)

It may be occurring only when trying to access the page file on a volume other than the boot volume (the fact that you created a dump successfully is an indication the boot volume is probably still available)...

Check the version of your SCSI controller driver, is there an update available for it?

[cluberti]

Gotta agree with Mr Snrub, this looks like a disk error:

c000000e = STATUS_NO_SUCH_DEVICE

[mso]

Thank you for all your reply. I would run the command that Mr Snrub advised and i will get back to all of you after i get a result. Thank you very much.

[mso]

That is what i got the result from !vm?! Is there any information that I can get here? Thank you very much

kd> !vm

*** Virtual Memory Usage ***
	Physical Memory:   524148   ( 2096592 Kb)
	Page File: \??\C:\pagefile.sys
	   Current:   2097152Kb Free Space:   2090496Kb
	   Minimum:   2097152Kb Maximum:      2097152Kb
	Page File: \??\D:\pagefile.sys
	   Current:   1048576Kb Free Space:   1029368Kb
	   Minimum:   1048576Kb Maximum:      1572864Kb
	Available Pages:   139046   (  556184 Kb)
	ResAvail Pages:    443069   ( 1772276 Kb)
	Modified Pages:       150   (     600 Kb)
	NonPagedPool Usage:  6292   (   25168 Kb)
	NonPagedPool Max:   68609   (  274436 Kb)
	PagedPool 0 Usage:  15964   (   63856 Kb)
	PagedPool 1 Usage:   4515   (   18060 Kb)
	PagedPool 2 Usage:   4494   (   17976 Kb)
	PagedPool Usage:    24973   (   99892 Kb)
	PagedPool Maximum:  87040   (  348160 Kb)
	Shared Commit:        865   (    3460 Kb)
	Special Pool:           0   (       0 Kb)
	Free System PTEs:   84685   (  338740 Kb)
	Shared Process:      4791   (   19164 Kb)
	PagedPool Commit:   24973   (   99892 Kb)
	Driver Commit:       1202   (    4808 Kb)
	Committed pages:   257449   ( 1029796 Kb)
	Commit limit:     1271416   ( 5085664 Kb)

[Mr Snrub]

Highlighting & commenting the interesting bits from the !analyze and !vm outputs...

Arguments:

Arg1: c000000e, status code - device which does not exist was specified

Arg2: c000000e, i/o status code - device which does not exist was specified

Arg3: 00000001, page file number - 1 = second page file (?)

Arg4: 00f1a000, offset into page file - location inside the page file on disk we were trying to read

...

Page File: \??\C:\pagefile.sys

Current: 2097152Kb Free Space: 2090496Kb

Minimum: 2097152Kb Maximum: 2097152Kb

Page File: \??\D:\pagefile.sys

Current: 1048576Kb Free Space: 1029368Kb

Minimum: 1048576Kb Maximum: 1572864Kb

Facts:

The Memory Manager tried to read from page file number 1, at offset 00f1a000 and failed with the result "device which does not exist was specified".

Theory:

I'm going to guess that the page file numbering starts at 0, so page file number 1 is actually the file on the D: volume.

The error code isn't "bad block" which would indicate a disk corruption, it is saying that the disk entirely is no longer present.

Follow-up:

1. Is D: a partition on the same physical disk as C:, or a separate disk?

> The same physical disk would imply C: would have vanished too

2. Is the page file number always the same?

> If so, volume D: is looking a bit shaky - consider removing the page file from D: to see if you gain stability

Side Note:

If the status code had implied "bad data" then I would check if the offset into the page file is the same every time which would imply a localized disk corruption - if it isn't the same offset then it could indicate a failing disk or disk controller.

[mso]

Hi Mr. Snrub, sorry for the late reply, i did delete and create the pagefile.sys on both C: and D: today. The reason that i did that because it rebooted during weekend again. When i checked memory.dumb this time, the value of the arg3 was 0000000 instead of 00000001. Therefore, I deleted and created the pagefile.sys on both C: and D:.

Hopefully, it can solve the problem because it is driving me crazy. Between, is there any information that i can get from the memory.dump file?

Thank you very much

[Mr Snrub]

Are the volumes on the same disk?

If so then you're still looking at a dodgy disk, disk controller or driver if it was changed recently.

If they are different disks then I would be more inclined to suspect a disk controller issue (again, unles the drivers were changed shortly before the problem began).

To be honest, at this point the dump can't tell you much - except that the disk was physically available to create the dump file itself on C: in raw mode (i.e. not using the disk driver) - at this point you'd be needing to do a live debug to catch the bugcheck and see the state of the system from the kernel's perspective (not a layman job, plus not many people can afford the downtime of the server).

[mso]

Sorry i did not answer your question last time! Yes, both of the volumes are on the same disk.

[mso]

Sorry for the late reply, I just want to say THANK YOU to all of you because I found out the root cause for this case. The problem is caused by Norton AntiVirus. It crashed whenever the AntiVirus running.

Thank you