服务器dump文件位置,使用windbg分析服务器的DUMP文件

最近一台联想R630

G7总是自动重启,因为在出现”自动重启”故障前曾更换过内存,因此首先报给联想800,确定不是硬件问题。问题出在哪里?现在我们只能根据日志文件和DUMP文件进行分析了。

操作系统日志文件内容：

Error code 1000007f, parameter1 00000008,

parameter2 f774ffe0, parameter3 00000000, parameter4

00000000.

The reason supplied by user PRD_ROI3Administrator

for the last unexpected shutdown of this computer is: System

Failure: Stop error

Reason Code: 0x805000f

Bug ID:

Bugcheck String: 0x0000007f (0x00000008,

0xf774ffe0, 0x00000000, 0x00000000)

Comment: 0x0000007f (0x00000008, 0xf774ffe0,

0x00000000, 0x00000000)

DUMP文件位置：

windowsmemory.dmp

分析全过程:

1. 下载安装windwos

的debug tools,软件名为windbg;

2. 安装后创建一个临时目录，我创建的为 c:temp;

3. 启动windbg

4. 在windbg界面设定符号文件路径

file->symbol file path 输入:

SRV *c:temp* http://msdl.microsoft.com/download/symbols,然后确定

5. windbg界面: file->open crash dump，打开

memory.dmp文件；

6. 打开后，等待提示，当出现Use !analyze -v to get detailed debugging

information. 字样后，在下面输入框!analyze

-v;r;kv;lmtn;.logclose;

7. 分析完毕，可以知道什么导致的故障.请注意下面的windbg输出内容中的红字部分。

分析得出sptd.sys(虚拟光驱软件dametools使用的驱动文件)这个驱动模块出错，导致win2003自动重启。

解决方法:

卸载dametools或使用第三方软件(如autoruns)禁用sptd.sys驱动。我直接卸载dametools。

windbg输出内容(很长)：

Loading Dump File [C:Documents and

SettingsAdministratorLocal SettingsTempDWRCC

DownloadsMEMORY.DMP]

Kernel Summary Dump File: Only kernel address space is

available

Symbol search path is:

SRV*c:temp*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8

procs) Free x86 compatible

Product: Server, suite: Enterprise TerminalServer

SingleUserTS

Built by: 3790.srv03_sp2_gdr.090319-1204

Machine Name:

Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8

Debug session time: Sun Jul 26 12:01:56.656 2009 (GMT+8)

System Uptime: 7 days 5:44:46.856

WARNING: Process directory table base 7FBED8A0 doesn't match CR3

005BF000

WARNING: Process directory table base 7FBED8A0 doesn't match CR3

005BF000

Loading Kernel Symbols

...............................................................

................................................

Loading User Symbols

PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh

dbgerr001" for details

Loading unloaded module list

........................

*******************************************************************************

* *

* Bugcheck

Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging

information.

BugCheck 7F, {8, f774ffe0, 0, 0}

*** ERROR: Module load completed but symbols could

not be loaded for sptd.sys

*** ERROR: Module load completed but symbols could not be loaded

for SYMEVENT.SYS

*** ERROR: Module load completed but symbols could not be loaded

for savrt.sys

PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh

dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffd400c)