M
Masterop512
Hi All
I have a Windows Server used like "NAS Server" with Storage Spaces and other storage functions, today the server restarts with BSOD, I trying to understand the DUMP FIle (it was open from Windows 10 computer). I don't know if the event was a Driver malfunction or memory dump.
Really, I can't found in Event Viewer (system or application) the real reason for this unexpected restart.
Can you help me with this?
Microsoft (R) Windows Debugger Version 10.0.18362.1 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\urudata01\Desktop\040820-109968-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 14393 MP (40 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS StorageServer
Built by: 14393.3564.amd64fre.rs1_release.200303-1942
Machine Name:
Kernel base = 0xfffff800`97a7c000 PsLoadedModuleList = 0xfffff800`97d800a0
Debug session time: Wed Apr 8 17:35:00.328 2020 (UTC - 3:00)
System Uptime: 9 days 11:22:15.480
Loading Kernel Symbols
..
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
...........................
For analysis of this file, run !analyze -v
21: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffc501a80c7108, Object whose reference count is being lowered
Arg3: 0000000000000010, Reserved
Arg4: 9f03d9a1dad004c1, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 14393.3564.amd64fre.rs1_release.200303-1942
SYSTEM_MANUFACTURER: Dell Inc.
SYSTEM_PRODUCT_NAME: Dell EMC NX3240
SYSTEM_SKU: SKU=NotProvided;ModelName=Dell EMC NX3240
BIOS_VENDOR: Dell Inc.
BIOS_VERSION: 2.3.10
BIOS_DATE: 08/15/2019
BASEBOARD_MANUFACTURER: Dell Inc.
BASEBOARD_PRODUCT: 0923K0
BASEBOARD_VERSION: A00
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: ffffc501a80c7108
BUGCHECK_P3: 10
BUGCHECK_P4: 9f03d9a1dad004c1
CPU_COUNT: 28
CPU_MHZ: 893
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 55
CPU_STEPPING: 4
CPU_MICROCODE: 6,55,4,0 (F,M,S,R) SIG: 2000060'00000000 (cache) 2000060'00000000 (init)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER
BUGCHECK_STR: 0x18
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-J9K906D
ANALYSIS_SESSION_TIME: 04-08-2020 23:49:13.0654
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff80097bf1586 to fffff80097bd9590
STACK_TEXT:
ffff8a82`18750ee8 fffff800`97bf1586 : 00000000`00000018 00000000`00000000 ffffc501`a80c7108 00000000`00000010 : nt!KeBugCheckEx
ffff8a82`18750ef0 fffff800`97ac280d : ffffc501`a80c7108 ffffa709`65d23780 ffffa708`d3ada060 ffffa709`65d23b6b : nt!ObfReferenceObjectWithTag+0xfb026
ffff8a82`18750f30 fffff800`97af3fb7 : ffffa708`a95de8e0 ffffa708`f58e6860 ffff8a82`187510a0 00000000`0000005c : nt!CcMapAndCopyInToCache+0x36d
ffff8a82`18751040 fffff809`49c0f507 : ffff9f03`721ee288 ffff8a82`18751300 00000000`00000000 ffffc501`3fb2dc00 : nt!CcCopyWriteEx+0xe7
ffff8a82`187510c0 fffff809`49c1f5f8 : ffff9f03`721ee288 ffff8a82`18751380 00000000`00000000 ffff9f03`721ee288 : NTFS!NtfsCommonWrite+0x3e07
ffff8a82`18751340 fffff800`97aba969 : ffff8a81`cb29b800 ffffa709`19fd1040 ffffa708`fb8a0088 ffff8a81`cb29b980 : NTFS!NtfsFspDispatch+0x268
ffff8a82`187514c0 fffff800`97b8626d : ffffa709`19fd1040 00000000`00000080 ffff9f02`d6caa6c0 ffffa709`19fd1040 : nt!ExpWorkerThread+0xe9
ffff8a82`18751550 fffff800`97be0896 : ffff8a81`cb314180 ffffa709`19fd1040 fffff800`97b8622c 6e6f6974`616c736e : nt!PspSystemThreadStartup+0x41
ffff8a82`187515a0 00000000`00000000 : ffff8a82`18752000 ffff8a82`1874b000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: 3cb8d139213b83d4966f960c9c1fdeaf35e1d799
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b99af58d0f1f5c6301d714182213d9e4f21ef8be
THREAD_SHA1_HASH_MOD: f923c08631feb6816d3b05718a0d19204ecb003b
FOLLOWUP_IP:
nt!ObfReferenceObjectWithTag+fb026
fffff800`97bf1586 cc int 3
FAULT_INSTR_CODE: 58bcccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ObfReferenceObjectWithTag+fb026
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5e5f4d4a
IMAGE_VERSION: 10.0.14393.3564
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: fb026
FAILURE_BUCKET_ID: 0x18_nt!ObfReferenceObjectWithTag
BUCKET_ID: 0x18_nt!ObfReferenceObjectWithTag
PRIMARY_PROBLEM_CLASS: 0x18_nt!ObfReferenceObjectWithTag
TARGET_TIME: 2020-04-08T20:35:00.000Z
OSBUILD: 14393
OSSERVICEPACK: 3564
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 8464
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 Server TerminalServer SingleUserTS StorageServer
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2020-03-04 03:40:10
BUILDDATESTAMP_STR: 200303-1942
BUILDLAB_STR: rs1_release
BUILDOSVER_STR: 10.0.14393.3564.amd64fre.rs1_release.200303-1942
ANALYSIS_SESSION_ELAPSED_TIME: ee3
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x18_nt!obfreferenceobjectwithtag
FAILURE_ID_HASH: {b6b47bfd-ed1b-fc56-3b01-ddc037f9c59f}
Followup: MachineOwner
---------
2.11.0.0
Continue reading...
I have a Windows Server used like "NAS Server" with Storage Spaces and other storage functions, today the server restarts with BSOD, I trying to understand the DUMP FIle (it was open from Windows 10 computer). I don't know if the event was a Driver malfunction or memory dump.
Really, I can't found in Event Viewer (system or application) the real reason for this unexpected restart.
Can you help me with this?
Microsoft (R) Windows Debugger Version 10.0.18362.1 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\urudata01\Desktop\040820-109968-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 14393 MP (40 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS StorageServer
Built by: 14393.3564.amd64fre.rs1_release.200303-1942
Machine Name:
Kernel base = 0xfffff800`97a7c000 PsLoadedModuleList = 0xfffff800`97d800a0
Debug session time: Wed Apr 8 17:35:00.328 2020 (UTC - 3:00)
System Uptime: 9 days 11:22:15.480
Loading Kernel Symbols
..
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
...........................
For analysis of this file, run !analyze -v
21: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffc501a80c7108, Object whose reference count is being lowered
Arg3: 0000000000000010, Reserved
Arg4: 9f03d9a1dad004c1, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 14393.3564.amd64fre.rs1_release.200303-1942
SYSTEM_MANUFACTURER: Dell Inc.
SYSTEM_PRODUCT_NAME: Dell EMC NX3240
SYSTEM_SKU: SKU=NotProvided;ModelName=Dell EMC NX3240
BIOS_VENDOR: Dell Inc.
BIOS_VERSION: 2.3.10
BIOS_DATE: 08/15/2019
BASEBOARD_MANUFACTURER: Dell Inc.
BASEBOARD_PRODUCT: 0923K0
BASEBOARD_VERSION: A00
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: ffffc501a80c7108
BUGCHECK_P3: 10
BUGCHECK_P4: 9f03d9a1dad004c1
CPU_COUNT: 28
CPU_MHZ: 893
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 55
CPU_STEPPING: 4
CPU_MICROCODE: 6,55,4,0 (F,M,S,R) SIG: 2000060'00000000 (cache) 2000060'00000000 (init)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER
BUGCHECK_STR: 0x18
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-J9K906D
ANALYSIS_SESSION_TIME: 04-08-2020 23:49:13.0654
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff80097bf1586 to fffff80097bd9590
STACK_TEXT:
ffff8a82`18750ee8 fffff800`97bf1586 : 00000000`00000018 00000000`00000000 ffffc501`a80c7108 00000000`00000010 : nt!KeBugCheckEx
ffff8a82`18750ef0 fffff800`97ac280d : ffffc501`a80c7108 ffffa709`65d23780 ffffa708`d3ada060 ffffa709`65d23b6b : nt!ObfReferenceObjectWithTag+0xfb026
ffff8a82`18750f30 fffff800`97af3fb7 : ffffa708`a95de8e0 ffffa708`f58e6860 ffff8a82`187510a0 00000000`0000005c : nt!CcMapAndCopyInToCache+0x36d
ffff8a82`18751040 fffff809`49c0f507 : ffff9f03`721ee288 ffff8a82`18751300 00000000`00000000 ffffc501`3fb2dc00 : nt!CcCopyWriteEx+0xe7
ffff8a82`187510c0 fffff809`49c1f5f8 : ffff9f03`721ee288 ffff8a82`18751380 00000000`00000000 ffff9f03`721ee288 : NTFS!NtfsCommonWrite+0x3e07
ffff8a82`18751340 fffff800`97aba969 : ffff8a81`cb29b800 ffffa709`19fd1040 ffffa708`fb8a0088 ffff8a81`cb29b980 : NTFS!NtfsFspDispatch+0x268
ffff8a82`187514c0 fffff800`97b8626d : ffffa709`19fd1040 00000000`00000080 ffff9f02`d6caa6c0 ffffa709`19fd1040 : nt!ExpWorkerThread+0xe9
ffff8a82`18751550 fffff800`97be0896 : ffff8a81`cb314180 ffffa709`19fd1040 fffff800`97b8622c 6e6f6974`616c736e : nt!PspSystemThreadStartup+0x41
ffff8a82`187515a0 00000000`00000000 : ffff8a82`18752000 ffff8a82`1874b000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: 3cb8d139213b83d4966f960c9c1fdeaf35e1d799
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b99af58d0f1f5c6301d714182213d9e4f21ef8be
THREAD_SHA1_HASH_MOD: f923c08631feb6816d3b05718a0d19204ecb003b
FOLLOWUP_IP:
nt!ObfReferenceObjectWithTag+fb026
fffff800`97bf1586 cc int 3
FAULT_INSTR_CODE: 58bcccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ObfReferenceObjectWithTag+fb026
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5e5f4d4a
IMAGE_VERSION: 10.0.14393.3564
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: fb026
FAILURE_BUCKET_ID: 0x18_nt!ObfReferenceObjectWithTag
BUCKET_ID: 0x18_nt!ObfReferenceObjectWithTag
PRIMARY_PROBLEM_CLASS: 0x18_nt!ObfReferenceObjectWithTag
TARGET_TIME: 2020-04-08T20:35:00.000Z
OSBUILD: 14393
OSSERVICEPACK: 3564
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 8464
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 Server TerminalServer SingleUserTS StorageServer
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2020-03-04 03:40:10
BUILDDATESTAMP_STR: 200303-1942
BUILDLAB_STR: rs1_release
BUILDOSVER_STR: 10.0.14393.3564.amd64fre.rs1_release.200303-1942
ANALYSIS_SESSION_ELAPSED_TIME: ee3
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x18_nt!obfreferenceobjectwithtag
FAILURE_ID_HASH: {b6b47bfd-ed1b-fc56-3b01-ddc037f9c59f}
Followup: MachineOwner
---------
2.11.0.0
Continue reading...