Crashing/Restarting HP Microserver WHS2011 x64 - diagnostics attached

simion levi · 05 Sep 2013

Summary: Unexpected reboot occurred with dump showing CRITICAL_OBJECT_TERMINATION bugcheck code 0x000000f4, pointing to ntoskrnl.exe. I'd be grateful for any pointers to where I should start, hopefully the diagnostics provided can tell you more than this.

System in question is an N40L HP Microserver - standard build except for the addition of 4GB extra RAM and 4 storage drives for media (2x3TB WD red, 2x1TB Samsung F3 - all SATA 7200rpm).
WHS 2011 x64 (based on Server 2008 I understand) with Drivebender providing drive pooling across the media drives, but not touching the OS drive. System drive is the supplied 250GB HP part (Seagate).

The system had been restarting every so often - commonly only once or twice a week, but occasionally several times within an hour when the server had some load. SMART errors started appearing on the system drive and the restarts became more common, so I've very recently had this replaced under warranty. The replacement drive appears to be brand new rather than refurbished, as far as I can tell, and it tests through SMART, chkdsk and Seatools as OK.

The server had been running for ~1 week straight since the drive replacement without a hiccup, until today when it restarted again, with the above error showing in the event log. I'm hoping this is tied to a driver issue rather than hardware now, but am not very familiar with the bug checking process or tools available, so your guidance would be very useful.

YoYo155 · 05 Sep 2013

Welcome to SF :) .

One bugcheck isn't much to go on but it will have to do.
(also missing from the file you uploaded are the event log files)

Code:

BugCheck F4, {3, fffffa800538fb30, fffffa800538fe10, fffff80001bc5350}

----- ETW minidump data unavailable-----
Probably caused by : csrss.exe

0xF4 BCC is usually storage, but considering you already tested the new drive
and the debugger is blaming csrss (Client/Server Runtime Subsystem) which is operational
at the desktop level I'd start with with Driver Verifier.

I don't see any virus protection on the machine, how do you keep it safe?

Arc said:

Enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

simion levi · 08 Sep 2013

Many thanks - I've had Driver Verifier running for a day and no crashes.

Before I got it running, the server had crashed again with the same error - and my SMART monitoring software warned of 6 pending bad sectors on the OS drive upon restarting. I'm not sure if the hardware is responsible for the crash or rather bad sectors are being caused by the crash as it occurs whilst the drives are active. It seems a bit suspect that two harddrives in a row would have suffered problems. I've reseated RAM and all power & data cables, no obvious problems but worth a go.

YoYo155 · 08 Sep 2013

Thanks for the update :) .
Maybe the PSU is the culprit, you can try and test the voltages, doing so might void your warrenty! so consult you OEM before following this tutorial.

PSU - Test DC Output Voltage