Stop: 0x0000007f

[SNosko]

I have a server that has the following config:

Windows 2000
Symantec Antivirus Corp. ED
Backup Exec
Print Services
Exabyte 20 tape library

I get the following blue screen once a week:

Stop: 0x0000007f (0x00000000,0x00000000,0x00000000,0x00000000)UNEXPECTED_KERNEL_MODE_TRAP

Normally, you would think this was a memory error but I've replaced the memory, motherboard, power supply and connectors. I've patched the OS to current levels, I've changed the registry to reflect the correct KStackMinFree value. Any other ideas?

 

[royalraven]

Skim these if you haven't already:

http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prmd_stp_ukdq.asp

http://www.osr.com/ddk/ddtools/bccodes_0ug7.htm

Is it possible you have a CPU issue?

Did you ever have an older Novell client installed? If so, that could be causing this issue as well if it wasn't uninstalled correctly. It's recommended to be on 4.71 or higher to avoid this issue.

Hope this helps...

 

[SNosko]

We have never had Novell here. I forgot to mention that I did replace the CPU. Thanks.

 

[xmsre]

Which version of Backup Exec? Are you using the open file agent? Version of the AV scanning engine? Version of the driver for the tape library?

In your stop 7f, the first dword is 0x00000000. That's a divide by zero error. In Kernal mode, I'd expect an issue with a device driver.

Open file agents and av software tend to top the list of causes, although it could be just about any driver. What kind of stuff was preloaded? Openmanage? LanDesk? Who was the hardware manufacturer? You mention once a week. What's happing at the specific times you get therror? Backups? Signature update?

 

[SNosko]

Those are some very good questions.

1) Backup Exec 8.6 with Open File Agent
2) The tape library drive in Backup Exec. I didn't install the OS driver because BE wants it's own.
3) AV Scan Engine 4.1.0.15
4) Yes to Dell OpenManager
5) Mostly printing at the time of the Blue Screen but this is a print server.

 

[xmsre]

Is the open file agent the infamous otman5.sys? There are a few hotfixes for 8.6, have you applied them?

On a print server, it could also be an issue with the version of unidvr. What printers are installed?

 

[SNosko]

As a matter of fact the otman5.sys is the first thing loaded after rebooting from the blue screen. I have applied hot-fixes to BE 8.6 but I don't remember which ones. Where do I go to find out which hot-fixes I've loaded?

 

[SNosko]

I just uninstalled Otman5.sys and have no reason to reinstall it but here is Veritas' response:

It seems that you come across Stop error-0x0000007f (0x00000000, 0x00000000, 0x00000000, 0x00000000) unexpected_kernel_mode_trap

Also it seems that some one informed you that, it could be the problem with Otman5.sys file. We would like to explain you about the same.


The bug check code of 0x0000007f is UNEXPECTED_KERNEL_MODE_TRAP, a code that appears basically in just one situation -- a stack overflow in the kernel. The file system filter drivers and the underlying file systems are arranged in a "layered" manner, such that I/O requests pass from one layer to another. When a filter driver loads (Storage Replicator, Antivirus, open file managers, disk defragmenter utilities, etc...), it occupies a new layer and on subsequent I/O requests it consumes a little stack space on every thread that comes through it. As other filter drivers load, each occupy another layer and consume a little more stack on each I/O request. The same is true for every new filter driver that might be added. In principle, there is no real limit to how many filters could be layered in this way -- but there is a *practical* limit: when adding one driver too many, and the *fixed-size* kernel stack overflows, it returns the stop error or bug check code of 0x0000007F (0x000000XX, 0x00000000, 0x00000000, 0x00000000).
This is due to the fact that there is a limit to the stack size that cannot be changed.


The OTMAN5.sys is a Backup Exec OFO driver. For Backup Exec 8.6 build 3808, the version should be 1.11.00.152; for Backup Exec 8.6 build 3878, the version should be 1.11.00.153. If the file version is not correct, uninstall the Open File Option through Add/Remove Programs, restart, and reinstall again

 

[xmsre]

It looks like Veritas isn't necessarially admitting it's theirs, but they do state that it's a problem with a driver.

Open file agents and AV filters top the list for this type of error. Other filter drivers like quota software or management software can cause the issue. I recall one issue where if you uninstalled certain versions of Dell openmanage, it failed to remove the class regisrations for AFANT.sys and caused a similar problem.

I think you made a good choice here. If you don't need the filter driver, don't load it. Reducing the number of filters loaded can only reduce the potential for problems.