RSS

Windebug: BSOD 0x0000001e (Non-paged pool empty)

07 Jan

One of our application server had BSOD for the past 2 weeks with a similar error. There were a lot of event id complaining “The server was unable to allocate from the system nonpaged pool because the pool was empty” before the server crashed.

The BSOD error was 0x0000001e (0xc0000006, 0xa0001d52, 0x00000000, 0x00370cb4).

The application team was quite insistent that their application couldn’t be the cause of the error and so I raised an issue with Microsoft to help me have a look and here was the result:

> BSOD code was as follows

ExceptionAddress: a0001d52 (win32k!XDCOBJ::bCleanDC+0x00000010)
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 00370cb4
Parameter[2]: c000009a

> A check with virtual memory shows that nonpaged pool was almost used up

0: kd>!vm

*** Virtual Memory Usage ***
Physical Memory: 524165 ( 2096660 Kb)
NonPagedPool Usage: 64660 ( 258640 Kb)
NonPagedPool Max: 68609 ( 274436 Kb)
********** Excessive NonPaged Pool Usage *****

> A print out of all pool tags showed one particular EXE had 473420 allocations in the nonpaged pool

0: kd>!poolfind * 0


81092c80 size: 1c0 previous size: 1a0 (Allocated) Process: 888bcd60
81092e40 size: 1c0 previous size: 1c0 (Allocated) Process: 888bcd60

The process ID is 888bcd60 while each allocation using 0x1c0 bytes.

>Checked out what the process ID was pointing to

0: kd>!process 888bcd60 0

PROCESS 888bcd60 SessionId: 0 Cid: 0388 Peb: 7ffdf000 ParentCid: 0124
DirBase: 171a9000 ObjectTable: 888bed68 TableSize: 81.
Image: myfaultyapp.exe

>Checked the process pool usage and reported using 210 MB out of 250 MB from the nonpaged pool.

0: kd> !process 888bcd60 7

PROCESS 888bcd60 SessionId: 0 Cid: 0388 Peb: 7ffdf000 ParentCid: 0124
DirBase: 171a9000 ObjectTable: 888bed68 TableSize: 81.
Image: Myfaultapp.exe
DeviceMap 89087068
ElapsedTime 23:19:03.0244
QuotaPoolUsage[PagedPool] 17784
QuotaPoolUsage[NonPagedPool] 212123500

Hence the faulty application is myfaultyapp.exe, which was the application which the apps team claimed could never have caused a crash.

Advertisements
 
1 Comment

Posted by on January 7, 2008 in Windows

 

Tags:

One response to “Windebug: BSOD 0x0000001e (Non-paged pool empty)

  1. Kenny Ronald

    March 7, 2008 at 5:44 pm

    A very readable blog entry on debugging a BSOD! Nice job.

     

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: