Supportnet / Forum / WindowsXP
fehlerdebugging richtig auswerten - komm nicht weiter
Frage
Hallo Freaks,
ich habe hier auf einem System mal mit den debugging Tools die Crashlogs ausgewertet, dabei fand ich immer wieder Fehler die von der ntoskernel verursacht wurden.
Leider finde ich keinen Ansatz diese Liste (unten) richtig auszuwerten. Wo kann ich weitere Informationen im Log finden? Kann jemand was mit dem Log anfangen und mir weiter helfen?
LOG:::::
Windows XP Kernel Version 2600 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054a130
Debug session time: Thu Nov 11 20:14:33.703 2004 (GMT+2)
System Uptime: 0 days 2:41:21.413
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...........................................................................................................................
Loading unloaded module list
..................................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {18, 2, 0, 80628bf6}
Probably caused by : ntoskrnl.exe ( nt!SdbpGetNextIndexedRecord+1c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000018, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80628bf6, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: 00000018
CURRENT_IRQL: 2
FAULTING_IP:
nt!SdbpGetNextIndexedRecord+1c
80628bf6 8b4818 mov ecx,[eax+0x18]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from 805331a1 to 804f52af
STACK_TEXT:
b20b1a30 805331a1 0000000a 00000018 00000002 nt!MmAccessFault+0x4ec
b20b1a4c b20b1aa8 f7568cea 865b00e0 865d88ec nt!ExpGetPoolTagInfo+0xcc
WARNING: Frame IP not in any known module. Following frames may be wrong.
b20b1a5c 00000000 00000001 b20b1ab0 865d88ec 0xb20b1aa8
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!SdbpGetNextIndexedRecord+1c
80628bf6 8b4818 mov ecx,[eax+0x18]
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!SdbpGetNextIndexedRecord+1c
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3d6dd59c
FAILURE_BUCKET_ID: 0xA_nt!SdbpGetNextIndexedRecord+1c
BUCKET_ID: 0xA_nt!SdbpGetNextIndexedRecord+1c
Followup: MachineOwner
---------