! Windows 2008 VM Bluescreens Twice a Month - Production/LIVE Server

[s1xth]

Man, this is really bothering me. I have a production VM running Windows 2008 32bit with 4GB Ram, it is a high load IIS web server that gets hit pretty hard, around 70-80% CPU utilization everyday. Twice a month the last 2 months (and just today) the VM has BLUESCREENed and restarted, thankfyully the restart has been fast enough that no one has noticed, YET. I need to figure out what is causing this, I have a DUMP file (mini) from the crash. The only information I get is that the machine suffered a bluescreen.

Can anyone point me into the right direction with this? I am running firmware 143129, and the latest VMware Tools. Does anyone have any ideas why this could be happening? The vm resides on LOCAL storage, with only one other VM with 4 vCPU's.

Thanks!

[JoeLyons]

This may not be VMware at all,

I would start with good old fashined windows troubleshooting.

Event viewer etc but you said you have a dump file so maybe have a look at debuging that:

http://support.microsoft.com/kb/156280

Joe

Remember to back EVERYTHING up before you change ANYTHING

[s1xth]

Thanks, guess I will start the regular procedure. One thing that does jump out at me is the VMWare tools is running 130750, instead of the latest firmware version of the tools, 14329. Not sure if this matter or not.

[AntonVZhbankov]

So update vmware-tools

---

VMware vExpert '2009

http://blog.vadmin.ru

[s1xth]

I will. I swear I read a post a few months ago that you shouldnt need to update the tools if the VIClient says that they are up to date. So I always assumed they were fine. I think the last time I tried to update them I recieved a message that said tools were unable to be updated because the version currently installed were greater than the ones I was trying to install. There was a post a few months ago about this, not sure what ever happened with that, i am going to try to find it.

edit- found it. According to vmware support they just changed the build number to match the release version. You need to UNINSTALL vmware tools and reinstall them to get the tools package to show 130755. I did this to get it to show up correctly, maybe I should do the same to get to 143129.

http://communities.vmware.com//message/1126372#1126372

[RParker]

I would start with good old fashined windows troubleshooting.

Amen! This is a 100% Windows issue. We have a few Windows 2008 machines and they have no problems, so it must be something to do with this Windows specifically.

[RParker]

the VM has BLUESCREENed and restarted, thankfyully the restart has been fast enough that no one has noticed, YET.

Change the settings to tell windows NOT to restart upon error, and make a note of the bluescreen error message. That's the place to start.

[s1xth]

I would do this, but again, being a production/live server, if this occurs and I cant get to the machine to restart it, could cause problems.

I have analyzed the vmware.logs from esx, and everything looks fine. I am now starting the Windows debugging (this should be fun). I did see that the latest firmware updates available address issues with broadcom nics under high stress, since I have broadcom nics in this box that MAY be something, but there isnt anything in the logs that point to that.

[s1xth]

I attached the debug text file to this post ran through the debugger, does anyone happen to see anything going on that looks out of place?

[s1xth]

Hmm. I noticed something in the dump file, DPMFLTR driver is still be loaded in the module list. I am not protecting this server with DPM at this time, looks like it was never properly removed. I am going to remove it tonight after hours and see if that fixes the problem, I have had problems with the DPMFLTR module in the past. Hopefully thats what it is.

[BenConrad]

I see NETIO.SYS is flagged in your .txt file

There are some MS articles in regards to BSODs with NETIO.SYS (Windows 2008 included)

http://support.microsoft.com/search/default.aspx?mode=a&query=NETIO.SYS&spid=12925&catalog=LCID%3D10...

Ben

[s1xth]

Yeah I saw that too. I was just about to post about that too. I am going to take a deeper look into that hotfix they have available. thanks!!

[s1xth]

Well its back. Went 4 days before a bluescreen, same errors, pointing to NETIO.sys. I guess I should try this patch. Has anyone used this patch? I went to download it and it says its for Windows Vista, and there is a server 2008 download link, wondering if I should install this or not, but I have to do something, the server keeps bluescreening.

[jesse_gardner]

Just wanted to reply to let you know the community isn't ignoring you. I have many Server 2008 VM's without encountering that problem, but have also certainly seen other random problems requiring MS hotfixes. Do you have any MS support available to you? They would be able to analyze your dump file and give you a more confident recommendation.

That being said, if you have no MS support and no other ideas, the hotfix sounds like as good a try as any.

[s1xth]

Jesse..

Thanks for the reply. I don't have MS support available sadly, so i am going to start with that patch and see where that takes me, hopefully doesn't cause more problems. Its an odd thing, and that error in the dump file doesn't seem to point to much.

Thanks for the information!

Sent from my Nokia E71