Hallo Community,
ich habe mit einem Server 2012R2 das Problem, dass er sporadisch neustartet. Ich hoffe, dass mir hier weiter geholfen werden kann, da ich so langsam nicht mehr wirklich weiter weiß.
Hier angehängt die ausgelesene Dump-File:
Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Administrator\Desktop\WindowsDebugger\MEMORY.DMP]
Kernel Bitmap Dump File: Only kernel address space is available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Users\Administrator\Desktop\WindowsDebugger\symbole*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Users\Administrator\Desktop\WindowsDebugger\symbole*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9600 MP (32 procs) Free x64
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 9600.17736.amd64fre.winblue_r9.150322-1500
Machine Name:
Kernel base = 0xfffff803`35e1b000 PsLoadedModuleList = 0xfffff803`360f4850
Debug session time: Mon Jun 8 12:57:18.084 2015 (UTC + 2:00)
System Uptime: 13 days 17:15:31.878
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 1200, 20000041, ffffe000b689c360}
*** ERROR: Module load completed but symbols could not be loaded for PktIcpt.sys
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
Probably caused by : fwpkclnt.sys ( fwpkclnt!FwpsFreeCloneNetBufferList0+13b )
Followup: MachineOwner
---------
8: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 0000000000001200, (reserved)
Arg3: 0000000020000041, Memory contents of the pool block
Arg4: ffffe000b689c360, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: ffffe000b689c360
FREED_POOL_TAG: Nph1
BUGCHECK_STR: 0xc2_7_Nph1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff803360bfff2 to fffff80335f6bca0
STACK_TEXT:
ffffd000`20606888 fffff803`360bfff2 : 00000000`000000c2 00000000`00000007 00000000`00001200 00000000`20000041 : nt!KeBugCheckEx
ffffd000`20606890 fffff801`fac1775c : 00000000`00000000 fffff801`fad4823d ffffe000`afbfac50 ffffe000`00000000 : nt!ExAllocatePoolWithTag+0x1102
ffffd000`20606980 fffff801`fb92649b : 00000000`00000000 ffffe000`b181ca00 ffffe000`b2e95530 ffffe000`ffff0002 : NDIS!NdisFreeCloneNetBufferList+0x7c
ffffd000`20606a30 fffff801`fc648767 : badbadfa`badbadfa ffffe000`afbfac00 ffffe000`b3a94d08 00000000`00000018 : fwpkclnt!FwpsFreeCloneNetBufferList0+0x13b
ffffd000`20606a70 fffff801`fc645eff : ffffe000`afbfac00 ffffe000`afbfac00 00000000`00000000 00000002`00000005 : PktIcpt+0x9767
ffffd000`20606aa0 fffff801`fb0329a0 : ffffe000`afbfac00 00000000`00000000 ffffe000`afc1bd30 ffffe000`b3a94d00 : PktIcpt+0x6eff
ffffd000`20606ad0 fffff803`35ec86bc : fffff803`362a9f38 fffff801`fb032934 ffffe000`b798b880 00000000`00000000 : fltmgr!FltpProcessGenericWorkItem+0x6c
ffffd000`20606b50 fffff803`35f1b36c : ffffe000`b3ebe2c0 ffffe000`b798b880 00000000`00000080 ffffe000`b798b880 : nt!ExpWorkerThread+0x28c
ffffd000`20606c00 fffff803`35f722c6 : fffff803`3611e180 ffffe000`b798b880 fffff803`36177a00 fffff803`35f06427 : nt!PspSystemThreadStartup+0x58
ffffd000`20606c60 00000000`00000000 : ffffd000`20607000 ffffd000`20601000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
fwpkclnt!FwpsFreeCloneNetBufferList0+13b
fffff801`fb92649b 488b5c2448 mov rbx,qword ptr [rsp+48h]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: fwpkclnt!FwpsFreeCloneNetBufferList0+13b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fwpkclnt
IMAGE_NAME: fwpkclnt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 546029a4
BUCKET_ID_FUNC_OFFSET: 13b
FAILURE_BUCKET_ID: 0xc2_7_Nph1_fwpkclnt!FwpsFreeCloneNetBufferList0
BUCKET_ID: 0xc2_7_Nph1_fwpkclnt!FwpsFreeCloneNetBufferList0
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xc2_7_nph1_fwpkclnt!fwpsfreeclonenetbufferlist0
FAILURE_ID_HASH: {1af1c775-e407-d619-e863-a9deaba0dff1}
Followup: MachineOwner
---------
Bin für jeden Vorschlag dankbar! Vorab vielen Dank!
Gruß
t0ms