# Blue Screen Memory Dump Diagnostics SERVER 2003



## JScott82305 (Sep 8, 2008)

I had a blue screen on one of my servers which created a mini(date).dmp file. I used WinDbg to open the dump which i will post below. as I read this I am a bit confused and would like some expert assistance on reading the contents with explanation of its contents. from the looks of this dump it is pointing to the tcpip.sys which I have no idea about. After speaking with Dell they suspected that it was related to Intel, so they were thiking about replacing the board and processor. as this would be a good measure, because I would then have a practically new server, if this is not the cause then it will be useless downtime. thanks

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\name\Desktop\Mini091508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS StorageServer
Built by: 3790.srv03_sp1_qfe.070321-2340
Kernel base = 0xfffff800`01000000 PsLoadedModuleList = 0xfffff800`011d7120
Debug session time: Mon Sep 15 10:28:27.342 2008 (GMT-4)
System Uptime: 50 days 23:14:10.203
Loading Kernel Symbols
.......................................................................................................................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9C, {5, fffffadfc8a81240, b2000018, 2000e0f}

Probably caused by : tcpip.sys ( tcpip!ProcessSynTcbs+c2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*  *
* Bugcheck Analysis *
* *
*******************************************************************************

MACHINE_CHECK_EXCEPTION (9c)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters;
x86 Processors
If the processor has ONLY MCE feature available (For example Intel
Pentium), the parameters are:
1 - Low 32 bits of P5_MC_TYPE MSR
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of P5_MC_ADDR MSR
4 - Low 32 bits of P5_MC_ADDR MSR
If the processor also has MCA feature available (For example Intel
Pentium Pro), the parameters are:
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
IA64 Processors
1 - Bugcheck Type
1 - MCA_ASSERT
2 - MCA_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing MCA.
3 - MCA_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
4 - MCA_FATAL
FW reported a fatal MCA.
5 - MCA_NONFATAL
SAL reported a recoverable MCA and we don't support currently
support recovery or SAL generated an MCA and then couldn't
produce an error record.
0xB - INIT_ASSERT
0xC - INIT_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing INIT event.
0xD - INIT_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT event.
0xE - INIT_FATAL
Not used.
2 - Address of log
3 - Size of log
4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO
AMD64 Processors
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
Arguments:
Arg1: 0000000000000005
Arg2: fffffadfc8a81240
Arg3: 00000000b2000018
Arg4: 0000000002000e0f

Debugging Details:
------------------


BUGCHECK_STR: 0x9C_GenuineIntel

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

PROCESS_NAME: Idle

CURRENT_IRQL: f

LAST_CONTROL_TRANSFER: from fffff8000080ef6c to fffff8000104e890

STACK_TEXT: 
fffff800`00123b88 fffff800`0080ef6c : 00000000`0000009c 00000000`00000001 fffff800`00123bc0 00000000`b2000000 : nt!KeBugCheckEx
fffff800`00123b90 fffff800`0104db77 : 00000000`00000000 00000000`00000000 00000000`000000fa fffff800`00123ef0 : hal!HalHandleMcheck+0x12c
fffff800`00123cf0 fffff800`0104d9b5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxMcheckAbort+0x77
fffff800`00123e70 fffffadf`c72ff6de : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0xf5
fffff800`001173d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!ProcessSynTcbs+0xc2


STACK_COMMAND: kb

FOLLOWUP_IP: 
tcpip!ProcessSynTcbs+c2
fffffadf`c72ff6de 498b2c0e mov rbp,qword ptr [r14+rcx]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: tcpip!ProcessSynTcbs+c2

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME: tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47270ec7

FAILURE_BUCKET_ID: X64_0x9C_GenuineIntel_tcpip!ProcessSynTcbs+c2

BUCKET_ID: X64_0x9C_GenuineIntel_tcpip!ProcessSynTcbs+c2

Followup: MachineOwner
---------

0: kd> 
0: kd> !analyze -show 
Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


----------



## rthomp8363 (Aug 27, 2008)

Machine check exceptions dumps are mostly hardware related. I would go with changing out what Dell suggested and go from there, if it is under warranty. If not, cost might prohibit that


----------



## rthomp8363 (Aug 27, 2008)

http://support.microsoft.com/kb/329284/en-us is a write up by microsoft


----------



## JScott82305 (Sep 8, 2008)

Thanks rthomp8363.

We went ahead and replaced motherboard. So far everything is good. Hopefully it will stay this way.


----------

