서버 / IT 서버 재부팅 현상
2013.11.18 16:06
안녕하세요?
궁금한 사항이 있어 요청 드립니다.
간혈적으로 서버가 재부팅 되는 현상이 있는데 메모리 덤프 확인 시
V3engine의 문제로 보이나 해결 방법이 있는지 궁금합니다.
그리고 커널 메모리 부분인데 이게 커널메모리 풀이 맞는건가요?
PagedPool Usage: 40960 ( 163840 Kb)
PagedPool Maximum: 40960 ( 163840 Kb)
혹시 동일한 증상을 겪으신 분이 계시면 지도 부탁드립니다.
---------------------------Memory Dump------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\Windows dbg\memory\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
************************************************************
WARNING: Dump file has been truncated. Data may be missing.
************************************************************
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
*** WARNING: symbols timestamp is wrong 0x4344ec59 0x3ee650a8 for ntkrnlmp.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Sat Oct 26 05:50:40.243 2013 (UTC + 9:00)
System Uptime: 73 days 20:01:39.875
*** WARNING: symbols timestamp is wrong 0x4344ec59 0x3ee650a8 for ntkrnlmp.exe
Loading Kernel Symbols
...............................................................
.................................................
Loading User Symbols
................................................................
..................
Loading unloaded module list
........*** WARNING: symbols timestamp is wrong 0x41e648e0 0x3ef28c03 for ntdll.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {c0000005, bc4292e3, 1, c}
*** ERROR: Module load completed but symbols could not be loaded for v3engine.sys
*** ERROR: Module load completed but symbols could not be loaded for V3Flt2K.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for fltmgr.sys -
*** ERROR: Module load completed but symbols could not be loaded for AhnRghNt.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ctacore.dll -
*** WARNING: symbols timestamp is wrong 0x42a0689c 0x3ef28c04 for KERNEL32.dll
*** ERROR: Module load completed but symbols could not be loaded for ctai.dll
Probably caused by : v3engine.sys ( v3engine+1b22e3 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bc4292e3, The address that the exception occurred at
Arg3: 00000001, Parameter 0 of the exception
Arg4: 0000000c, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"
FAULTING_IP:
v3engine+1b22e3
bc4292e3 c7410c649342bc mov dword ptr [ecx+0Ch],offset v3engine+0x1b2364 (bc429364)
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 0000000c
WRITE_ADDRESS: 0000000c
ERROR_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"
BUGCHECK_STR: 0x1E_c0000005
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
PROCESS_NAME: FRC.exe
LAST_CONTROL_TRANSFER: from 80468ea5 to 804308ea
STACK_TEXT:
bc06f6bc 80468ea5 bc06f6d8 00000000 bc06f72c nt!IopProcessNewChildren+0x168
bc06f734 8046e142 87eba9fc 87eba948 87eba9a4 nt!MmLocateUnloadedDriver+0x7b5
bc06f7a8 bc425d84 00000000 00000001 00000004 nt!MmOutSwapProcess+0x104
WARNING: Stack unwind information not available. Following frames may be wrong.
bc06f7c8 bc426214 e6ca77e8 87799748 bc06f848 v3engine+0x1aed84
bc06f7dc bc4261fb e6ca77e8 87799748 bc06f848 v3engine+0x1af214
bc06f7f0 bc284004 e6ca77e8 87799748 bc06f848 v3engine+0x1af1fb
bc06f804 bc296844 e6ca77e8 87799748 bc06f848 v3engine+0xd004
bc06f828 bc296714 ea940848 00000000 87799748 v3engine+0x1f844
bc06f854 bc27d096 ea940848 87799748 00000000 v3engine+0x1f714
bc06f86c bc51c447 ea940848 87799748 00000000 v3engine+0x6096
bc06f89c bc51de0d 87799748 00000f01 00001111 V3Flt2K+0xe447
bc06f8d4 bc5143e0 87a9cf50 87a9cfc0 87799748 V3Flt2K+0xfe0d
bc06f8f8 bff28e7e 87eba9a4 bc06f91c 87a9cf48 V3Flt2K+0x63e0
bc06f960 bff2c4f2 87eba900 00000000 87eba948 fltmgr+0xe7e
bc06f9ac bff2c7e3 bc06f9cc 00000000 00000000 fltmgr!FltGetIrpName+0xe7b
bc06f9e4 8041eec9 889126e0 87b36ac8 8890e240 fltmgr!FltGetIrpName+0x116c
bc06fa38 8041eec9 8890e240 87b36ac8 8042061e nt!FsRtlSplitLargeMcb+0x13a
bc06fab0 8041eec9 8815fe20 87b36ac8 886b9b88 nt!FsRtlSplitLargeMcb+0x13a
bc06fb48 80415b61 00000000 00000000 87eeabc0 nt!FsRtlSplitLargeMcb+0x13a
bc06fc00 eb0f5e2c 000011c4 bc06fd64 00000000 nt!CcGetVacbMiss+0x252
bc06fd58 80468389 000011c4 00000000 00000000 AhnRghNt+0x5e2c
bc06fe20 084b55d8 000054ff 00000000 00126360 nt!MmFlushImageSection+0x21b
bc06fe4c 77e7a030 00000404 00000000 00000000 ctacore!ctaWaitEvent+0x278
bc06ff98 084a1a85 00126460 084a19f0 01200178 KERNEL32!LoadModule+0x103
00000000 00000000 00000000 00000000 00000000 ctai+0x1a85
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
v3engine+1b22e3
bc4292e3 c7410c649342bc mov dword ptr [ecx+0Ch],offset v3engine+0x1b2364 (bc429364)
SYMBOL_NAME: v3engine+1b22e3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: v3engine
IMAGE_NAME: v3engine.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 51cb8910
FAILURE_BUCKET_ID: 0x1E_c0000005_VRFK_v3engine+1b22e3
BUCKET_ID: 0x1E_c0000005_VRFK_v3engine+1b22e3
Followup: MachineOwner
---------
1: kd> lmvm v3engine
start end module name
bc277000 bc4a8c00 v3engine (no symbols)
Loaded symbol image file: v3engine.sys
Image path: \??\C:\WINNT\system32\drivers\v3engine.sys
Image name: v3engine.sys
Timestamp: Thu Jun 27 09:36:32 2013 (51CB8910)
CheckSum: 0023E8E9
ImageSize: 00231C00
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
1: kd> .bugcheck
Bugcheck code 0000001E
Arguments c0000005 bc4292e3 00000001 0000000c
1: kd> !vm 1
*** Virtual Memory Usage ***
Physical Memory: 524155 ( 2096620 Kb)
Paging File Name paged out
Current: -301254912Kb Free Space: 2071053136Kb
Minimum: 1125737596Kb Maximum: -1201795112Kb
Available Pages: 296397 ( 1185588 Kb)
ResAvail Pages: 433799 ( 1735196 Kb)
********** Running out of physical memory **********
Locked IO Pages: 1448542208 (1499201536 Kb)
Free NP PTEs: 1706626164 (-1763429936 Kb)
Free Special NP: 1684532381 (-1851805068 Kb)
Modified Pages: 591 ( 2364 Kb)
NonPagedPool Usage: 7220 ( 28880 Kb)
NonPagedPool Max: 68609 ( 274436 Kb)
PagedPool 0 Usage: 22934 ( 91736 Kb)
PagedPool 1 Usage: 4513 ( 18052 Kb)
PagedPool 2 Usage: 4512 ( 18048 Kb)
PagedPool 3 Usage: 4514 ( 18056 Kb)
PagedPool 4 Usage: 4487 ( 17948 Kb)
********** Excessive Paged Pool Usage *****
PagedPool Usage: 40960 ( 163840 Kb)
PagedPool Maximum: 40960 ( 163840 Kb)
Shared Commit: 1324 ( 5296 Kb)
Special Pool: -1920972690 (906043832 Kb)
Free System PTEs: 1209496648 (543019296 Kb)
Shared Process: 10764 ( 43056 Kb)
PagedPool Commit: 40960 ( 163840 Kb)
Driver Commit: 2142 ( 8568 Kb)
Committed pages: 142945 ( 571780 Kb)
Commit limit: 1008759 ( 4035036 Kb)
********** Commit has been extended with VM popup ********
Extended by: 264275287 (1057101148 Kb)
****** ALL PAGING FILE BECAME FULL (28837957 times) - COMMITMENT ADJUSTED ****
Current adjust: 1463812545 (1560282884 Kb)