KMODE_EXCEPTION_NOT_HANDLED

[Guest]

Hi all,

I got the following bluescreen error from my Win2K Server with SP4 patch.
I have used dumpchk, windows debugger tool, poolmon but the logs collected
is not explicit and informative enough (at least for me). Do you know what's
wrong with my system? Appreciate your advice.

Thanks.



*** STOP: 0x0000001E (0xC0000044,0x804A1F6E,0x00000000,0x00000000)
KMODE_EXCEPTION_NOT_HANDLED

*** Address 804A1F6E base at 80400000, DateStamp 3ee650b3 - ntoskrnl.exe


*** event log ***
Event ID 2019 Source Srv The server was unable to allocate from the system
nonpaged pool because the pool was empty.


* Windows 2000 Crash Dump Analysis
**
****************************************************************
*
Filename . . . . . . .c:\winnt\memory.dmp
Signature. . . . . . .PAGE
ValidDump. . . . . . .DUMP
MajorVersion . . . . .free system
MinorVersion . . . . .2195
DirectoryTableBase . .0xc42d6000
PfnDataBase. . . . . .0x890c3000
PsLoadedModuleList . .0x80484520
PsActiveProcessHead. .0x80485c68
MachineImageType . . .i386
NumberProcessors . . .4
BugCheckCode . . . . .0x0000001e
BugCheckParameter1 . .0xc0000044
BugCheckParameter2 . .0x804a1f6e
BugCheckParameter3 . .0x00000000
BugCheckParameter4 . .0x00000000

ExceptionCode. . . . .0x80000003
ExceptionFlags . . . .0x00000001
ExceptionAddress . . .0x8042f2fc


***Debugger Tools for Windows***

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

********************************************************************** **
WARNING: Dump file has inconsistent set-bit count. Data may be missing.
********************************************************************** **
Symbol search path is: *** Invalid ***
********************************************************************** ******
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
********************************************************************** ******
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntkrnlmp.exe -
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Product: Server, suite: TerminalServer
Kernel base = 0x80400000 PsLoadedModuleList = 0x80484520
Debug session time: Sun Apr 30 03:02:05.406 2006 (GMT+8)
System Uptime: 9 days 13:15:27.156
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntkrnlmp.exe -
Loading Kernel Symbols
.......................................................................
....................................
Loading User Symbols
...............
Loading unloaded module list
............*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ntdll.dll -

The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
**********************************************************************
*********
* *
* Bugcheck Analysis *
* *
**********************************************************************
*********
Bugcheck code 0000001E
Arguments c0000044 804a1f6e 00000000 00000000

ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be
wrong.
bcd28058 80432934 bcd28480 00000000 bcd283fc nt!KeTerminateThread+0xd0e
bcd283cc 8046a033 bcd28480 bcd284d0 00000000 nt!ZwYieldExecution+0x1c60
bcd283e8 80466389 bcd28480 bcd284d0 00000001 nt!KiCoprocessorError+0x15f
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
Ntfs.sys -
bcd28410 bfee4d72 88fea800 fe3d4568 00000000 nt!KiReleaseSpinLock+0xba9
bcd28460 804a1f6e 00000000 00000286 8046b656
Ntfs!NtfsCommitCurrentTransaction+0x184c
00000000 00000000 00000000 00000000 00000000 nt!IoCreateStreamFileObject+0xde


*** poolmon.exe ***

Memory: 3669496K Avail: 2391756K PageFlts: 87149 InRam Krnl: 2312K P:34492K
Commit:1394324K Limit:6649500K Peak:1394380K Pool N:42204K P:34692K
Tag Type Allocs Frees Diff Bytes Per Alloc

SavE Nonp 656839 ( 0) 656377 ( 0) 462 15103008 ( 0) 32690
WD Nonp 386 ( 0) 225 ( 0) 161 3392576 ( 0) 21071
NDpp Nonp 8 ( 0) 0 ( 0) 8 2544864 ( 0) 318108
LSwi Nonp 1 ( 0) 0 ( 0) 1 2293760 ( 0) 2293760
tdLL Nonp 4644 ( 0) 736 ( 7) 3908 2234880 ( -896) 571
MmCm Nonp 45 ( 0) 11 ( 0) 34 1892928 ( 0) 55674
NtFC Nonp 93778 ( 0) 77012 ( 0) 16766 1876320 ( 0) 111
PTrk Nonp 9642 ( 0) 4996 ( 0) 4646 1504000 ( 0) 323

 

[Jerold Schulman]

See if any of the following help:

Tip 7141 » Your Window 2000 Server records event ID 2019 in the System Event log after slowing or hanging?
in the 'Tips & Tricks' at http://www.jsifaq.com

Tip 3408 » Your server periodically loses connectivity with its' clients and must be restarted? 26-Feb-01

Tip 3581 » Running CHKDSK may reclaim Windows 2000 nonpaged pool memory.

http://support.microsoft.com?kbid=257956 "Error message appears when you restart Windows after installation of Nero CD-Recording Software "
http://support.microsoft.com?kbid=264994 "'Stop 0x0000001E' After Installing WriteDVD#33 for Windows 2000 with Easy CD Creator "
http://support.microsoft.com?kbid=287524 "'Stop 0x0000001E' Error Message When You Mount a Volume "
http://support.microsoft.com?kbid=288602 "Windows Setup Stops Responding with the VIA Apollo KX133 Chip Set "
http://support.microsoft.com?kbid=289001 "'STOP: 0x0000001E' Error Message When You Load Windows 2000 System Registry Hive "
http://support.microsoft.com?kbid=294690 "'Stop 0x0000001E' Error Message in Ntoskrnl.exe "
http://support.microsoft.com?kbid=304245 "Hard-Coded Breakpoint Is Encountered in GetARPBuffer "
http://support.microsoft.com?kbid=329850 "You Receive a 'STOP 0x0000001E' Error Message When You Try to Log On to Your Exchange 2000 Server-Based Computer "
http://support.microsoft.com?kbid=810558 "'Stop 0x00000051 REGISTRY_ERROR' Error Message When You Back Up the Registry Hive "
http://support.microsoft.com?kbid=811014 "'STOP 0x0000001E KMODE_EXCEPTION_NOT_HANDLED in NTOSKRNL.EXE' Stop Error Message After You Install PcAnywhere "
http://support.microsoft.com?kbid=900345 "Fixes that are included in the Update Rollup 1 for Microsoft Windows 2000 Service Pack 4 that is dated June 28 2005 "

Hi all,

I got the following bluescreen error from my Win2K Server with SP4 patch.
I have used dumpchk, windows debugger tool, poolmon but the logs collected
is not explicit and informative enough (at least for me). Do you know what's
wrong with my system? Appreciate your advice.

Thanks.



*** STOP: 0x0000001E (0xC0000044,0x804A1F6E,0x00000000,0x00000000)
KMODE_EXCEPTION_NOT_HANDLED

*** Address 804A1F6E base at 80400000, DateStamp 3ee650b3 - ntoskrnl.exe


*** event log ***
Event ID 2019 Source Srv The server was unable to allocate from the system
nonpaged pool because the pool was empty.


* Windows 2000 Crash Dump Analysis
**
****************************************************************
*
Filename . . . . . . .c:\winnt\memory.dmp
Signature. . . . . . .PAGE
ValidDump. . . . . . .DUMP
MajorVersion . . . . .free system
MinorVersion . . . . .2195
DirectoryTableBase . .0xc42d6000
PfnDataBase. . . . . .0x890c3000
PsLoadedModuleList . .0x80484520
PsActiveProcessHead. .0x80485c68
MachineImageType . . .i386
NumberProcessors . . .4
BugCheckCode . . . . .0x0000001e
BugCheckParameter1 . .0xc0000044
BugCheckParameter2 . .0x804a1f6e
BugCheckParameter3 . .0x00000000
BugCheckParameter4 . .0x00000000

ExceptionCode. . . . .0x80000003
ExceptionFlags . . . .0x00000001
ExceptionAddress . . .0x8042f2fc


***Debugger Tools for Windows***

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

********************************************************************** **
WARNING: Dump file has inconsistent set-bit count. Data may be missing.
********************************************************************** **
Symbol search path is: *** Invalid ***
********************************************************************** ******
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
********************************************************************** ******
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntkrnlmp.exe -
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Product: Server, suite: TerminalServer
Kernel base = 0x80400000 PsLoadedModuleList = 0x80484520
Debug session time: Sun Apr 30 03:02:05.406 2006 (GMT+8)
System Uptime: 9 days 13:15:27.156
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntkrnlmp.exe -
Loading Kernel Symbols
......................................................................
...................................
Loading User Symbols
..............
Loading unloaded module list
...........*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ntdll.dll -

The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
**********************************************************************
*********
* *
* Bugcheck Analysis *
* *
**********************************************************************
*********
Bugcheck code 0000001E
Arguments c0000044 804a1f6e 00000000 00000000

ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be
wrong.
bcd28058 80432934 bcd28480 00000000 bcd283fc nt!KeTerminateThread+0xd0e
bcd283cc 8046a033 bcd28480 bcd284d0 00000000 nt!ZwYieldExecution+0x1c60
bcd283e8 80466389 bcd28480 bcd284d0 00000001 nt!KiCoprocessorError+0x15f
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
Ntfs.sys -
bcd28410 bfee4d72 88fea800 fe3d4568 00000000 nt!KiReleaseSpinLock+0xba9
bcd28460 804a1f6e 00000000 00000286 8046b656
Ntfs!NtfsCommitCurrentTransaction+0x184c
00000000 00000000 00000000 00000000 00000000 nt!IoCreateStreamFileObject+0xde


*** poolmon.exe ***

Memory: 3669496K Avail: 2391756K PageFlts: 87149 InRam Krnl: 2312K P:34492K
Commit:1394324K Limit:6649500K Peak:1394380K Pool N:42204K P:34692K
Tag Type Allocs Frees Diff Bytes Per Alloc

SavE Nonp 656839 ( 0) 656377 ( 0) 462 15103008 ( 0) 32690
WD Nonp 386 ( 0) 225 ( 0) 161 3392576 ( 0) 21071
NDpp Nonp 8 ( 0) 0 ( 0) 8 2544864 ( 0) 318108
LSwi Nonp 1 ( 0) 0 ( 0) 1 2293760 ( 0) 2293760
tdLL Nonp 4644 ( 0) 736 ( 7) 3908 2234880 ( -896) 571
MmCm Nonp 45 ( 0) 11 ( 0) 34 1892928 ( 0) 55674
NtFC Nonp 93778 ( 0) 77012 ( 0) 16766 1876320 ( 0) 111
PTrk Nonp 9642 ( 0) 4996 ( 0) 4646 1504000 ( 0) 323

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com

 

[Steve Parry]

Hi all,

I got the following bluescreen error from my Win2K Server with SP4 patch.
I have used dumpchk, windows debugger tool, poolmon but the logs collected
is not explicit and informative enough (at least for me). Do you know
what's wrong with my system? Appreciate your advice.

Thanks.

<snip>

take a look here

http://support.microsoft.com/?kbid=279640

http://www.eventid.net/display.asp?eventid=2019&eventno=6608&source=NCP Server&phase=1

and

http://support.microsoft.com/?id=272568

 

[Guest]

Hi Jarold,

I am suspecting Symantec Anti-virus that gives me tht problem. That's why i
use poolmon trying to determine if any application is holding up the nonpage
memory but all i saw with poolmon was an application with memory tag = SavE
is holding most of the nonpage memory. Is there a way to decode the tag?

In my case, I'm using HP NC7782 gigabit server network adapters and no
external display card. so i do not suspect the network card or some display
driver that cause the problem.

my version of the anti-virus is 10.0.1.100

--
Will. L

See if any of the following help:

Tip 7141 » Your Window 2000 Server records event ID 2019 in the System Event log after slowing or hanging?
in the 'Tips & Tricks' at http://www.jsifaq.com

Tip 3408 » Your server periodically loses connectivity with its' clients and must be restarted? 26-Feb-01

Tip 3581 » Running CHKDSK may reclaim Windows 2000 nonpaged pool memory.

http://support.microsoft.com?kbid=257956 "Error message appears when you restart Windows after installation of Nero CD-Recording Software "
http://support.microsoft.com?kbid=264994 "'Stop 0x0000001E' After Installing WriteDVD#33 for Windows 2000 with Easy CD Creator "
http://support.microsoft.com?kbid=287524 "'Stop 0x0000001E' Error Message When You Mount a Volume "
http://support.microsoft.com?kbid=288602 "Windows Setup Stops Responding with the VIA Apollo KX133 Chip Set "
http://support.microsoft.com?kbid=289001 "'STOP: 0x0000001E' Error Message When You Load Windows 2000 System Registry Hive "
http://support.microsoft.com?kbid=294690 "'Stop 0x0000001E' Error Message in Ntoskrnl.exe "
http://support.microsoft.com?kbid=304245 "Hard-Coded Breakpoint Is Encountered in GetARPBuffer "
http://support.microsoft.com?kbid=329850 "You Receive a 'STOP 0x0000001E' Error Message When You Try to Log On to Your Exchange 2000 Server-Based Computer "
http://support.microsoft.com?kbid=810558 "'Stop 0x00000051 REGISTRY_ERROR' Error Message When You Back Up the Registry Hive "
http://support.microsoft.com?kbid=811014 "'STOP 0x0000001E KMODE_EXCEPTION_NOT_HANDLED in NTOSKRNL.EXE' Stop Error Message After You Install PcAnywhere "
http://support.microsoft.com?kbid=900345 "Fixes that are included in the Update Rollup 1 for Microsoft Windows 2000 Service Pack 4 that is dated June 28 2005 "

Hi all,

I got the following bluescreen error from my Win2K Server with SP4 patch.
I have used dumpchk, windows debugger tool, poolmon but the logs collected
is not explicit and informative enough (at least for me). Do you know what's
wrong with my system? Appreciate your advice.

Thanks.



*** STOP: 0x0000001E (0xC0000044,0x804A1F6E,0x00000000,0x00000000)
KMODE_EXCEPTION_NOT_HANDLED

*** Address 804A1F6E base at 80400000, DateStamp 3ee650b3 - ntoskrnl.exe


*** event log ***
Event ID 2019 Source Srv The server was unable to allocate from the system
nonpaged pool because the pool was empty.


* Windows 2000 Crash Dump Analysis
**
****************************************************************
*
Filename . . . . . . .c:\winnt\memory.dmp
Signature. . . . . . .PAGE
ValidDump. . . . . . .DUMP
MajorVersion . . . . .free system
MinorVersion . . . . .2195
DirectoryTableBase . .0xc42d6000
PfnDataBase. . . . . .0x890c3000
PsLoadedModuleList . .0x80484520
PsActiveProcessHead. .0x80485c68
MachineImageType . . .i386
NumberProcessors . . .4
BugCheckCode . . . . .0x0000001e
BugCheckParameter1 . .0xc0000044
BugCheckParameter2 . .0x804a1f6e
BugCheckParameter3 . .0x00000000
BugCheckParameter4 . .0x00000000

ExceptionCode. . . . .0x80000003
ExceptionFlags . . . .0x00000001
ExceptionAddress . . .0x8042f2fc


***Debugger Tools for Windows***

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

********************************************************************** **
WARNING: Dump file has inconsistent set-bit count. Data may be missing.
********************************************************************** **
Symbol search path is: *** Invalid ***
********************************************************************** ******
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
********************************************************************** ******
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntkrnlmp.exe -
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Product: Server, suite: TerminalServer
Kernel base = 0x80400000 PsLoadedModuleList = 0x80484520
Debug session time: Sun Apr 30 03:02:05.406 2006 (GMT+8)
System Uptime: 9 days 13:15:27.156
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntkrnlmp.exe -
Loading Kernel Symbols
......................................................................
...................................
Loading User Symbols
..............
Loading unloaded module list
...........*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ntdll.dll -

The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
**********************************************************************
*********
* *
* Bugcheck Analysis *
* *
**********************************************************************
*********
Bugcheck code 0000001E
Arguments c0000044 804a1f6e 00000000 00000000

ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be
wrong.
bcd28058 80432934 bcd28480 00000000 bcd283fc nt!KeTerminateThread+0xd0e
bcd283cc 8046a033 bcd28480 bcd284d0 00000000 nt!ZwYieldExecution+0x1c60
bcd283e8 80466389 bcd28480 bcd284d0 00000001 nt!KiCoprocessorError+0x15f
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
Ntfs.sys -
bcd28410 bfee4d72 88fea800 fe3d4568 00000000 nt!KiReleaseSpinLock+0xba9
bcd28460 804a1f6e 00000000 00000286 8046b656
Ntfs!NtfsCommitCurrentTransaction+0x184c
00000000 00000000 00000000 00000000 00000000 nt!IoCreateStreamFileObject+0xde


*** poolmon.exe ***

Memory: 3669496K Avail: 2391756K PageFlts: 87149 InRam Krnl: 2312K P:34492K
Commit:1394324K Limit:6649500K Peak:1394380K Pool N:42204K P:34692K
Tag Type Allocs Frees Diff Bytes Per Alloc

SavE Nonp 656839 ( 0) 656377 ( 0) 462 15103008 ( 0) 32690
WD Nonp 386 ( 0) 225 ( 0) 161 3392576 ( 0) 21071
NDpp Nonp 8 ( 0) 0 ( 0) 8 2544864 ( 0) 318108
LSwi Nonp 1 ( 0) 0 ( 0) 1 2293760 ( 0) 2293760
tdLL Nonp 4644 ( 0) 736 ( 7) 3908 2234880 ( -896) 571
MmCm Nonp 45 ( 0) 11 ( 0) 34 1892928 ( 0) 55674
NtFC Nonp 93778 ( 0) 77012 ( 0) 16766 1876320 ( 0) 111
PTrk Nonp 9642 ( 0) 4996 ( 0) 4646 1504000 ( 0) 323

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com

 

[Jerold Schulman]

Sorry, I don't know how to decode the tag.

Hi Jarold,

I am suspecting Symantec Anti-virus that gives me tht problem. That's why i
use poolmon trying to determine if any application is holding up the nonpage
memory but all i saw with poolmon was an application with memory tag = SavE
is holding most of the nonpage memory. Is there a way to decode the tag?

In my case, I'm using HP NC7782 gigabit server network adapters and no
external display card. so i do not suspect the network card or some display
driver that cause the problem.

my version of the anti-virus is 10.0.1.100

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com