BSOD - how do I find out what caused it?

[niallo32]

I have a fully patched Windows 2000 Server running Exchange 2000. When I came into work this morning, there was a BSOD on the screen.

I powered it off and on again and after troubleshooting some Exchange problems, got it back functioning again.

There is a file in C:\winnt called MEMORY.dmp, but is over 500MB in size. There are also other .dmp files with todays date but have junk inside them.

How can I find out what caused the Server to crash?

I can see from the Event log that it crashed @ 5.15am but there is nothing to indicate what the problem actually was.

Thanks

 

[dglienna]

Take a look into Event Viewer, as it should list the events that lead up to the crash.

David

 

[pcmanusa]

One thing you could do is open a ticket with Microsoft. They have teams of people who do nothing but read memory dumps and decipher them.

The bad news, is that opening a server issue ticket will cost your credit card $245.00 but when you've got an issue you'll find no better support than the top level tiers of Microsoft.

Many of them are contractors until you get to the top tier and then you get to the Microsoft Gurus.

 

[niallo32]

Thanks for the replies. The Server Blue Screened last night again, the last Events in the Viewer before it crashed were:

System Log - Event ID - 5781
Dynamic registration or deregistration of one or more DNS records failed because no DNS servers are available.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

------

In Control Panel/System/Advanced/Startup & Recovery/System Failure - 'Automatically Reboot' is not checked

----------

This morning when I rebooted, it took nearly an hour for the System Attendant Service to start and when it did, it's dependent Services - information Store & MTA started in a minute or two. These are the errors I got in the Event Viewer:

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007a (0xc0386f6c, 0xc000009a, 0xe1bdb256, 0x1b52f880). Microsoft Windows 2000 [v15.2195]. A dump was saved in: C:\WINNT\MEMORY.DMP.


System Attendant Service failed to create session for virtual machine EXCHANGE. The error number is 0xc10306ce.

The MTA database recovery operation has completed successfully. Recovery details can be found in the file: D:\Exchsrvr\mtadata\.\MTACHECK.OUT\MTACHECK.LOG. [DB Server MAIN BASE 1 67] (14)

Unexpected error An unknown error has occurred. ID no: 80040a01 Microsoft Exchange System Attendant occurred.

The Metabase Update service failed to start, error '80040a01'.

An error occurred while starting the Microsoft Exchange POP3 Service: server instance number 1 failed to start with error 0x80040a01.

An error occurred while starting the Microsoft Exchange IMAP4 Service: server instance number 1 failed to start with error 0x80040a01.
------

Does anyone have any ideas?

Thanks