Rootop 服务器运维与web架构

系统蓝屏分析工具-windbg

| 暂无评论

系统蓝屏分析工具:windbg

下载地址:http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.11.1.404.msi

 在系统蓝屏的时候可以查看系统内存转储文件:

%SystemRoot%\MEMORY.DMP  此文件描述了系统蓝屏状况及原因。

 windbg工具就可以分析转储文件

EG:

 Microsoft (R) Windows Debugger Version 6.11.0001.404 X86

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [H:\MEMORY.DMP]

Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path.           *

* Use .symfix to have the debugger choose a symbol path.                   *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

*                                                                   *

* The Symbol Path can be set by:                                    *

*   using the _NT_SYMBOL_PATH environment variable.                 *

*   using the -y <symbol_path> argument when starting the debugger. *

*   using .sympath and .sympath+                                    *

*********************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe –

Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 7601.17640.x86fre.win7sp1_gdr.110622-1506

Machine Name:

Kernel base = 0x8404f000 PsLoadedModuleList = 0x841984f0

Debug session time: Thu Nov  3 11:33:09.761 2011 (GMT+8)

System Uptime: 0 days 3:05:28.478

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

*                                                                   *

* The Symbol Path can be set by:                                    *

*   using the _NT_SYMBOL_PATH environment variable.                 *

*   using the -y <symbol_path> argument when starting the debugger. *

*   using .sympath and .sympath+                                    *

*********************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe –

Loading Kernel Symbols

………………………………………………………

……………………………………………………….

………………….

Loading User Symbols

PEB is paged out (Peb.Ldr = 7ffde00c).  Type “.hh dbgerr001” for details

Loading unloaded module list

….

*** ERROR: Module load completed but symbols could not be loaded for ndis.sys

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {14, 2, 0, 8d0866fa}

*** ERROR: Module load completed but symbols could not be loaded for L1C62x86.sys

*** ERROR: Module load completed but symbols could not be loaded for pacer.sys

*** ERROR: Module load completed but symbols could not be loaded for tcpip.sys

*** ERROR: Module load completed but symbols could not be loaded for NETIO.SYS

*** ERROR: Module load completed but symbols could not be loaded for nsiproxy.sys

*** ERROR: Module load completed but symbols could not be loaded for Hookport.sys

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

***                                                                   ***

***                                                                   ***

***    Your debugger is not using the correct symbols                 ***

***                                                                   ***

***    In order for this command to work properly, your symbol path   ***

***    must point to .pdb files that have full type information.      ***

***                                                                   ***

***    Certain .pdb files (such as the public OS symbols) do not      ***

***    contain the required information.  Contact the group that      ***

***    provided you with these symbols if you need this command to    ***

***    work.                                                          ***

***                                                                   ***

***    Type referenced: nt!_KPRCB                                     ***

***                                                                   ***

*************************************************************************

*************************************************************************

***                                                                   ***

***                                                                   ***

***    Your debugger is not using the correct symbols                 ***

***                                                                   ***

***    In order for this command to work properly, your symbol path   ***

***    must point to .pdb files that have full type information.      ***

***                                                                   ***

***    Certain .pdb files (such as the public OS symbols) do not      ***

***    contain the required information.  Contact the group that      ***

***    provided you with these symbols if you need this command to    ***

***    work.                                                          ***

***                                                                   ***

***    Type referenced: nt!KPRCB                                      ***

***                                                                   ***

*************************************************************************

*************************************************************************

***                                                                   ***

***                                                                   ***

***    Your debugger is not using the correct symbols                 ***

***                                                                   ***

***    In order for this command to work properly, your symbol path   ***

***    must point to .pdb files that have full type information.      ***

***                                                                   ***

***    Certain .pdb files (such as the public OS symbols) do not      ***

***    contain the required information.  Contact the group that      ***

***    provided you with these symbols if you need this command to    ***

***    work.                                                          ***

***                                                                   ***

***    Type referenced: nt!_KPRCB                                     ***

***                                                                   ***

*************************************************************************

*************************************************************************

***                                                                   ***

***                                                                   ***

***    Your debugger is not using the correct symbols                 ***

***                                                                   ***

***    In order for this command to work properly, your symbol path   ***

***    must point to .pdb files that have full type information.      ***

***                                                                   ***

***    Certain .pdb files (such as the public OS symbols) do not      ***

***    contain the required information.  Contact the group that      ***

***    provided you with these symbols if you need this command to    ***

***    work.                                                          ***

***                                                                   ***

***    Type referenced: nt!KPRCB                                      ***

***                                                                   ***

*************************************************************************

*************************************************************************

***                                                                   ***

***                                                                   ***

***    Your debugger is not using the correct symbols                 ***

***                                                                   ***

***    In order for this command to work properly, your symbol path   ***

***    must point to .pdb files that have full type information.      ***

***                                                                   ***

***    Certain .pdb files (such as the public OS symbols) do not      ***

***    contain the required information.  Contact the group that      ***

***    provided you with these symbols if you need this command to    ***

***    work.                                                          ***

***                                                                   ***

***    Type referenced: nt!_KPRCB                                     ***

***                                                                   ***

*************************************************************************

*************************************************************************

***                                                                   ***

***                                                                   ***

***    Your debugger is not using the correct symbols                 ***

***                                                                   ***

***    In order for this command to work properly, your symbol path   ***

***    must point to .pdb files that have full type information.      ***

***                                                                   ***

***    Certain .pdb files (such as the public OS symbols) do not      ***

***    contain the required information.  Contact the group that      ***

***    provided you with these symbols if you need this command to    ***

***    work.                                                          ***

***                                                                   ***

***    Type referenced: nt!_KPRCB                                     ***

***                                                                   ***

*************************************************************************

*************************************************************************

***                                                                   ***

***                                                                   ***

***    Your debugger is not using the correct symbols                 ***

***                                                                   ***

***    In order for this command to work properly, your symbol path   ***

***    must point to .pdb files that have full type information.      ***

***                                                                   ***

***    Certain .pdb files (such as the public OS symbols) do not      ***

***    contain the required information.  Contact the group that      ***

***    provided you with these symbols if you need this command to    ***

***    work.                                                          ***

***                                                                   ***

***    Type referenced: nt!_KPRCB                                     ***

***                                                                   ***

*************************************************************************

*************************************************************************

***                                                                   ***

***                                                                   ***

***    Your debugger is not using the correct symbols                 ***

***                                                                   ***

***    In order for this command to work properly, your symbol path   ***

***    must point to .pdb files that have full type information.      ***

***                                                                   ***

***    Certain .pdb files (such as the public OS symbols) do not      ***

***    contain the required information.  Contact the group that      ***

***    provided you with these symbols if you need this command to    ***

***    work.                                                          ***

***                                                                   ***

***    Type referenced: nt!_KPRCB                                     ***

***                                                                   ***

*************************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

*                                                                   *

* The Symbol Path can be set by:                                    *

*   using the _NT_SYMBOL_PATH environment variable.                 *

*   using the -y <symbol_path> argument when starting the debugger. *

*   using .sympath and .sympath+                                    *

*********************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

*                                                                   *

* The Symbol Path can be set by:                                    *

*   using the _NT_SYMBOL_PATH environment variable.                 *

*   using the -y <symbol_path> argument when starting the debugger. *

*   using .sympath and .sympath+                                    *

*********************************************************************

Probably caused by : L1C62x86.sys ( L1C62x86+4ce3 )

Followup: MachineOwner

———

上面一大堆无用的信息,到最后发现是L1C62x86.sys的原因导致蓝屏,看其拓展名是某个驱动程序的问题,google之:

L1c62x86.sys with description Atheros L1c PCI-E Gigabit Ethernet Controller is a driver file from company Atheros Communications, Inc. belonging to product Atheros L1c PCI-E Gigabit Ethernet Controller.

The file is digitally signed from Atheros Communications Inc. – VeriSign Time Stamping Services Signer – G2

We do not recommend removing digitally signed files from Atheros Communications Inc.

找到原因,网卡驱动的问题,估计没什么太大问题,暂时不更新驱动了,如果后期因其原因导致蓝屏频繁,需要升级下驱动即可。

原创文章,转载请注明。本文链接地址: http://www.rootop.org/pages/898.html

赞赏

微信赞赏支付宝赞赏

作者:Venus

专注于 服务器运维与web架构 E-mail:venus#rootop.org

发表评论