Hello
We have provisioned an Azure VM that is used as an RDS server. The operating system for the Server is 2012r2.
We started using the server on november 7th, and it has bluescreened with the same error 6 times. Both the dump-file and google-searches indicates that the process rdbss.sys might be the cause of the problem. I will attach the dump file below.
Microsoft (R) Windows Debugger Version 10.0.14321.1024 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\*\OneDrive\Documents\113016-42796-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 10 Kernel Version 14393 MP (4 procs) Free x64
Product: Server, suite: TerminalServer DataCenter
Built by: 14393.447.amd64fre.rs1_release_inmarket.161102-0100
Machine Name:
Kernel base = 0xfffff803`71292000 PsLoadedModuleList = 0xfffff803`71597060
Debug session time: Wed Nov 30 12:13:10.387 2016 (UTC + 1:00)
System Uptime: 0 days 3:31:24.083
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
..............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
............................
************* Symbol Loading Error Summary **************
Module name Error
ntoskrnl The system cannot find the file specified
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
*** WARNING: Unable to verify timestamp for rdbss.sys
*** ERROR: Module load completed but symbols could not be loaded for rdbss.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 27, {fcb0027c, ffffdb00e2f683d8, ffffdb00e2f68010, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Followup: MachineOwner
---------
************* Symbol Path validation summary **************
Response Time (ms) Location
OK C:\Users\*\Desktop
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: 00000000fcb0027c
Arg2: ffffdb00e2f683d8
Arg3: ffffdb00e2f68010
Arg4: 0000000000000000
Debugging Details:
------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 14393.447.amd64fre.rs1_release_inmarket.161102-0100
SYSTEM_MANUFACTURER: Microsoft Corporation
VIRTUAL_MACHINE: HyperV
SYSTEM_PRODUCT_NAME: Virtual Machine
SYSTEM_VERSION: 7.0
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 090006
BIOS_DATE: 05/23/2012
BASEBOARD_MANUFACTURER: Microsoft Corporation
BASEBOARD_PRODUCT: Virtual Machine
BASEBOARD_VERSION: 7.0
ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
WRONG_SYMBOLS_TIMESTAMP: 5819bd1f
WRONG_SYMBOLS_SIZE: 820000
FAULTING_MODULE: fffff80371292000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 5819bd1f
DUMP_TYPE: 2
BUGCHECK_P1: fcb0027c
BUGCHECK_P2: ffffdb00e2f683d8
BUGCHECK_P3: ffffdb00e2f68010
BUGCHECK_P4: 0
EXCEPTION_RECORD: ffffdb00e2f683d8 -- (.exr 0xffffdb00e2f683d8)
ExceptionAddress: ffffdb00e2f683e8
ExceptionCode: 0130ec30
ExceptionFlags: 00000001
NumberParameters: -487160856
Parameter[0]: ffffdb00e2f682e0
Parameter[1]: ffffdb00e2f68010
Parameter[2]: ffffae088a586a10
Parameter[3]: ffffae088861e970
Parameter[4]: ffffae088943a6b0
Parameter[5]: 000000000e400200
Parameter[6]: 0000000000000000
Parameter[7]: 0000000000000000
Parameter[8]: 0000000000000000
Parameter[9]: ffffdb00e2f68398
Parameter[10]: ffffdb00e2f68398
Parameter[11]: ffffae087c33e6e0
Parameter[12]: ffffae087c33e6e0
Parameter[13]: 0000000001000000
Parameter[14]: 0000000000000000
CONTEXT: ffffdb00e2f68010 -- (.cxr 0xffffdb00e2f68010)
rax=0000000000000000 rbx=0000000000400800 rcx=0000000000000000
rdx=c040000000000004 rsi=0000000000000001 rdi=0000000000000002
rip=ffffdb00e2f68368 rsp=ffffffffffffffff rbp=ffffffffffffffff
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=000c630500000000
iopl=1 vip vif ov up ei pl nz na pe nc
cs=8048 ss=e2f6 ds=e2f6 es=db00 fs=ffff gs=8048 efl=ffffdb00
8048:8368 ?? ???
Resetting default scope
CPU_COUNT: 4
CPU_MHZ: 898
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 2d
CPU_STEPPING: 7
CPU_MICROCODE: 0,0,0,0 (F,M,S,R) SIG: FFFFFFFF'00000000 (cache) 0'00000000 (init)
CUSTOMER_CRASH_COUNT: 1
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: NOOSL9XWDS32
ANALYSIS_SESSION_TIME: 11-30-2016 14:59:32.0276
ANALYSIS_VERSION: 10.0.14321.1024 x86fre
LAST_CONTROL_TRANSFER: from 0000000000000000 to ffffdb00e2f68368
UNALIGNED_STACK_POINTER: ffffffffffffffff
STACK_TEXT:
ffff9b00`e7679488 fffff807`3760fd19 : 00000000`00000027 00000000`fcb0027c ffffdb00`e2f683d8 ffffdb00`e2f68010 : nt+0x14a510
ffff9b00`e7679490 00000000`00000027 : 00000000`fcb0027c ffffdb00`e2f683d8 ffffdb00`e2f68010 00000000`00000000 : rdbss+0xfd19
ffff9b00`e7679498 00000000`fcb0027c : ffffdb00`e2f683d8 ffffdb00`e2f68010 00000000`00000000 00000000`00000000 : 0x27
ffff9b00`e76794a0 ffffdb00`e2f683d8 : ffffdb00`e2f68010 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfcb0027c
ffff9b00`e76794a8 ffffdb00`e2f68010 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffdb00`e2f683d8
ffff9b00`e76794b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffae08`8a654ed0 : 0xffffdb00`e2f68010
STACK_COMMAND: kb
THREAD_SHA1_HASH_MOD_FUNC: 5474fa73798049031c2a0caa39d100f3f2eab020
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 87ff8d166822c95f9c36ce424701def37be42c3e
THREAD_SHA1_HASH_MOD: 5474fa73798049031c2a0caa39d100f3f2eab020
FOLLOWUP_IP:
rdbss+fd19
fffff807`3760fd19 cc int 3
FAULT_INSTR_CODE: cf8b49cc
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
BUGCHECK_STR: 5819BD1F
EXCEPTION_CODE: (NTSTATUS) 0x5819bd1f - <Unable to get error code text>
EXCEPTION_CODE_STR: 5819BD1F
EXCEPTION_STR: WRONG_SYMBOLS
PROCESS_NAME: ntoskrnl.wrong.symbols.exe
IMAGE_NAME: ntoskrnl.wrong.symbols.exe
MODULE_NAME: nt_wrong_symbols
SYMBOL_NAME: nt_wrong_symbols!5819BD1F820000
BUCKET_ID: WRONG_SYMBOLS_X64_14393.447.amd64fre.rs1_release_inmarket.161102-0100_TIMESTAMP_161102-101703
DEFAULT_BUCKET_ID: WRONG_SYMBOLS_X64_14393.447.amd64fre.rs1_release_inmarket.161102-0100_TIMESTAMP_161102-101703
PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS
FAILURE_BUCKET_ID: WRONG_SYMBOLS_X64_14393.447.amd64fre.rs1_release_inmarket.161102-0100_TIMESTAMP_161102-101703_5819BD1F_nt_wrong_symbols!5819BD1F820000
TARGET_TIME: 2016-11-30T11:13:10.000Z
OSBUILD: 14393
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 144
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 Server TerminalServer DataCenter
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2016-11-02 11:17:03
BUILDDATESTAMP_STR: 161102-0100
BUILDLAB_STR: rs1_release_inmarket
BUILDOSVER_STR: 10.0.14393.447.amd64fre.rs1_release_inmarket.161102-0100
ANALYSIS_SESSION_ELAPSED_TIME: 1faa
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:wrong_symbols_x64_14393.447.amd64fre.rs1_release_inmarket.161102-0100_timestamp_161102-101703_5819bd1f_nt_wrong_symbols!5819bd1f820000
FAILURE_ID_HASH: {d82425fb-28f9-fe3c-99c4-cbc6653270b1}
Followup: MachineOwner
---------