|
1. 我的電腦，屬性->高級->啟動，最下面的內(nèi)存調(diào)試選最后一項的全部，確定后重新啟動
2. 藍屏后不要急著重啟，系統(tǒng)會保存整個內(nèi)存內(nèi)容，然后會自動重啟
3. 重啟后,windows目錄會多出 MEMORY.DMP, 如果1步驟選完全調(diào)試，那么這個文件和你的內(nèi)存一樣大
4. 下載安裝windwos 的 debug tools, 我這有下載地址，或微軟網(wǎng)站
http://public./SysTools/debug/dbg_x86_6.6.07.5.exe
5. 安裝后創(chuàng)建一個臨時目錄，例如 c:\temp
6. 啟動 windbg
7. windbg界面: file->symbol file path (ctrl+s) 輸入:
SRV*c:\temp*http://msdl.microsoft.com/download/symbols
然后確定
8. windbg界面: file->open crash dump(ctrl+d)，打開windows目錄下面的 memory.dmp
9. 打開后，等待提示
當(dāng)出現(xiàn) Use !analyze -v to get detailed debugging information. 字樣后，在下面輸入框
!analyze -v
10. 等待分析完畢，可以知道什么導(dǎo)致的出錯
我貼出之前服務(wù)器問題：
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffffadf291e4ec4, fffffadf25015d90, 0}
Page cc2d8 not present in the dump file. Type ".hh dbgerr004" for details
Page cdecc not present in the dump file. Type ".hh dbgerr004" for details
*** ERROR: Module load completed but symbols could not be loaded for HpCISSs2.sys
Page cdecc not present in the dump file. Type ".hh dbgerr004" for details
Page cc2d8 not present in the dump file. Type ".hh dbgerr004" for details
Page c549d not present in the dump file. Type ".hh dbgerr004" for details
Page c555e not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 000007ff`fffd4018). Type ".hh dbgerr001" for details
Page cdecc not present in the dump file. Type ".hh dbgerr004" for details
Page cc2d8 not present in the dump file. Type ".hh dbgerr004" for details
Page c549d not present in the dump file. Type ".hh dbgerr004" for details
Page c555e not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 000007ff`fffd4018). Type ".hh dbgerr001" for details
Probably caused by : storport.sys ( storport!StorPortGetPhysicalAddress+2db )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffffadf291e4ec4, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffadf25015d90, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
Page cc2d8 not present in the dump file. Type ".hh dbgerr004" for details
Page cdecc not present in the dump file. Type ".hh dbgerr004" for details
Page cdecc not present in the dump file. Type ".hh dbgerr004" for details
Page cc2d8 not present in the dump file. Type ".hh dbgerr004" for details
Page c549d not present in the dump file. Type ".hh dbgerr004" for details
Page c555e not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 000007ff`fffd4018). Type ".hh dbgerr001" for details
Page cdecc not present in the dump file. Type ".hh dbgerr004" for details
Page cc2d8 not present in the dump file. Type ".hh dbgerr004" for details
Page c549d not present in the dump file. Type ".hh dbgerr004" for details
Page c555e not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 000007ff`fffd4018). Type ".hh dbgerr001" for details
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
storport!StorPortGetPhysicalAddress+2db
fffffadf`291e4ec4 4c8b4850 mov r9,qword ptr [rax+50h]
CONTEXT: fffffadf25015d90 -- (.cxr 0xfffffadf25015d90)
rax=00015105823e684c rbx=0000000000000000 rcx=fffffadf29edb000
rdx=fffffadf2740e380 rsi=fffffadf2740e380 rdi=00000000f1594964
rip=fffffadf291e4ec4 rsp=fffffadf250165a0 rbp=fffffadf383796e0
r8=fffffadf2740e438 r9=fffffadf25016620 r10=fffffadf3836e008
r11=fffffadf2740e498 r12=fffffadf3836e008 r13=fffffadf25016620
r14=0000000000000298 r15=00000000000001a8
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
storport!StorPortGetPhysicalAddress+0x2db:
fffffadf`291e4ec4 4c8b4850 mov r9,qword ptr [rax+50h] ds:002b:00015105`823e689c=????????????????
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: cqmgstor.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffffadf2950eb06 to fffffadf291e4ec4
STACK_TEXT:
fffffadf`250165a0 fffffadf`2950eb06 : fffffadf`2740e480 fffffadf`35e79a40 fffffadf`2740e380 fffffadf`2740e3e0 : storport!StorPortGetPhysicalAddress+0x2db
fffffadf`25016600 fffffadf`2950cbd4 : fffffadf`3836e008 fffffadf`35e79a40 fffffadf`2740e380 fffffadf`35fd64e0 : HpCISSs2+0x8b06
fffffadf`25016640 fffffadf`295087fb : fffffadf`35fd64e0 fffffadf`35e79a40 fffffadf`3836e008 fffffadf`29506000 : HpCISSs2+0x6bd4
fffffadf`25016670 fffffadf`291e251a : 00000000`00000000 fffffadf`291e4282 fffffadf`383796e0 fffffadf`2740e0c8 : HpCISSs2+0x27fb
fffffadf`250166f0 fffffadf`291e2e83 : fffffadf`378d33f0 00000000`00000001 fffffadf`2740e010 fffffadf`383796e0 : storport!RaidAdapterPostScatterGatherExecute+0xf1
fffffadf`25016740 fffff800`0080c0a9 : 00000000`00000004 fffff800`0128b06d fffffadf`35e97000 00000000`00000002 : storport!RaidpAdapterContinueScatterGather+0x5b
fffffadf`25016780 fffffadf`291e385a : 00000000`00000000 fffffadf`38379590 fffffadf`2740e0b8 fffffadf`2740e000 : hal!HalBuildScatterGatherList+0x2b9
fffffadf`250167e0 fffffadf`291e7b21 : 00000000`00000000 00000000`00000298 fffffadf`2740e010 00000000`00000000 : storport!RaidAdapterExecuteXrb+0xb3
fffffadf`25016840 fffffadf`29239642 : fffffadf`383796e0 fffffadf`35e79a40 fffffadf`3600a010 00000000`0004d008 : storport!RaidAdapterScsiMiniportIoctl+0x351
fffffadf`250168b0 fffffadf`2923add0 : fffffadf`38a20f20 fffffadf`38a20dd0 fffffadf`38379590 fffffadf`3600a010 : storport!RaidAdapterDeviceControlIrp+0x1b2
fffffadf`25016950 fffffadf`2985c586 : fffffadf`00000000 fffffadf`38a20f20 fffffadf`3600a170 fffffadf`3600a010 : storport!RaDriverDeviceControlIrp+0xb0
fffffadf`250169e0 fffff800`01282091 : 00000000`00000201 fffffadf`25016cf0 00000000`00000000 fffffadf`3718c710 : mpspfltr!MPSPDevCtlDispatch+0x86
fffffadf`25016a70 fffff800`01281b96 : 00000000`00000174 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xa79
fffffadf`25016b90 fffff800`0102e3fd : fffffadf`36bd4310 fffffadf`3716d4b0 00000000`00000000 00000000`0096f820 : nt!NtDeviceIoControlFile+0x56
fffffadf`25016c00 00000000`77ef0a5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0096fc48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ef0a5a
FOLLOWUP_IP:
storport!StorPortGetPhysicalAddress+2db
fffffadf`291e4ec4 4c8b4850 mov r9,qword ptr [rax+50h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: storport!StorPortGetPhysicalAddress+2db
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: storport
IMAGE_NAME: storport.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 45d06f34
STACK_COMMAND: .cxr 0xfffffadf25015d90 ; kb
FAILURE_BUCKET_ID: X64_0x3B_storport!StorPortGetPhysicalAddress+2db
BUCKET_ID: X64_0x3B_storport!StorPortGetPhysicalAddress+2db
Followup: MachineOwner
---------
看上邊紅色字體部分，大概說明都是HP的某個驅(qū)動有問題
去google搜索HpCISSs2.sys，最好加上Microsoft，這樣篩選快一些。
我的運氣還算好，馬上就看見一個KB就是關(guān)于這個錯誤，說是HP的機器更新了一個windows Server 2003 的補丁后，驅(qū)動有問題，必須到HP的網(wǎng)站上去更新相關(guān)的驅(qū)動。我去查看服務(wù)器補丁安裝的情況，果然發(fā)現(xiàn)機器出問題的時間和更新那個補丁的時間差不多。
問題終于搞定，觀察了兩天，服務(wù)器沒有再出現(xiàn)異常藍屏
|
