Widows Server 2019 Crashed, analize dump

Question

Hello. Please help me analyze the dump. We have a server 2019 with deduplicated disks. And it suddenly rebooted. Below is the analysis of the dump.

0: kd> !analyze -v6
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8025e6132c7, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000004, Parameter 1 of the exception

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 3983

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 3965

    Key  : Analysis.Init.CPU.mSec
    Value: 26796

    Key  : Analysis.Init.Elapsed.mSec
    Value: 1088312

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 87

    Key  : Dump.Attributes.InsufficientDumpfileSize
    Value: 1

    Key  : Dump.Attributes.RequiredDumpfileSize
    Value: 0x1522f69d6


PROCESSES_ANALYSIS: 1


SERVICE_ANALYSIS: 1


STACKHASH_ANALYSIS: 1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

FILE_IN_CAB:  080323-100656-01.dmp

BUILD_VERSION_STRING:  10.0.17763.4644 (WinBuild.160101.0800)

SYSTEM_MANUFACTURER:  VMware, Inc.

VIRTUAL_MACHINE:  VMware

SYSTEM_PRODUCT_NAME:  VMware Virtual Platform

SYSTEM_VERSION:  None

BIOS_VENDOR:  Phoenix Technologies LTD

BIOS_VERSION:  6.00

BIOS_DATE:  12/12/2018

BASEBOARD_MANUFACTURER:  Intel Corporation

BASEBOARD_PRODUCT:  440BX Desktop Reference Platform

BASEBOARD_VERSION:  None

DUMP_FILE_ATTRIBUTES: 0xc
  Insufficient Dumpfile Size
  Kernel Generated Triage Dump

DUMP_TYPE:  2

BUGCHECK_CODE:  1e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8025e6132c7

BUGCHECK_P3: 0

BUGCHECK_P4: 4

CPU_COUNT: 8

CPU_MHZ:  2397

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3f

CPU_STEPPING: 2

CPU_MICROCODE: 6,3f,2,0 (F,M,S,R)  SIG: 5003303'00000000 (cache) 5003303'00000000 (init)

BLACKBOXBSD: 1 (!blackboxbsd)

Version: 0xa8
Product type: 1

Auto advanced boot: FALSE
Advanced boot menu timeout: 30
Last boot succeeded: TRUE
Last boot shutdown: FALSE
Sleep in progress: FALSE

Power button timestamp: 0x0
System running: TRUE
Connected standby in progress: FALSE
User shutdown in progress: FALSE
System shutdown in progress: FALSE
Sleep in progress: 0
Connected standby scenario instance id: 0
Connected standby entry reason: 0
Connected standby exit reason: 0
System sleep transitions to on: 0
Last reference time: 0x1d9c2185d3a1901
	2023-07-29T12:29:48.323Z
Last reference time checksum: 0x1ed75ac5
Last update boot id: 65

Boot attempt count: 1
Last boot checkpoint: TRUE
Checksum: 0xfc
Last boot id: 65
Last successful shutdown boot id: 64
Last reported abnormal shutdown boot id: 1

Error info boot id: 0
Error info repeat count: 0
Error info other error count: 0
Error info code: 0
Error info status: 0x0

Power button last press time: 0x0
Power button cumulative press count: 0
Power button last press boot id: 0
Power button last power watchdog stage: 0
Power button watchdog armed: FALSE
Power button shutdown in progress: FALSE
Power button last release time: 0x0
Power button cumulative release count: 0
Power button last release boot id: 0
Power button error count: 0
Power button current connected standby phase: 0
Power button transition latest checkpoint id: 0
Power button transition latest checkpoint type: 0
Power button transition latest checkpoint sequence number: 0

Power transition Shutdown Device Type: 0
Power transition Setup In Progress: FALSE
Power transition OOBE In Progress: FALSE
Power transition Sleep Checkpoint Source: 0
Power transition Sleep Checkpoint: 0
Power transition Connected Standby Entry Reason Category: 0
Power transition Connected Standby Exit Reason Category: 0
Power transition Connected Standby Entry Scenario Instance Id: 0x0


BLACKBOXPNP: 1 (!blackboxpnp)

    PnpActivityId      : {00000000-0000-0000-0000-000000000000}
    PnpActivityTime    : 133355349049476893
    PnpEventInformation: 3
    PnpEventInProgress : 0
    PnpProblemCode     : 24
    PnpVetoType        : 0
    DeviceId           : STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot627
    VetoString         : 


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_SESSION_HOST:  DESKTOP-8GHENCD

ANALYSIS_SESSION_TIME:  08-04-2023 14:15:54.0152

ANALYSIS_VERSION: 10.0.22621.1778 amd64fre

LAST_CONTROL_TRANSFER:  from fffff8025ac05baf to fffff8025abbc330

STACK_TEXT:  
ffff9f02`f8c3c238 fffff802`5ac05baf     : 00000000`0000001e ffffffff`c0000005 fffff802`5e6132c7 00000000`00000000 : nt!KeBugCheckEx
ffff9f02`f8c3c240 fffff802`5abcfe02     : 00000000`00000000 ffff9f02`f8c3cad0 00000000`00001000 00000000`00000004 : nt!KiDispatchException+0x18104f
ffff9f02`f8c3c8f0 fffff802`5abcb9e8     : 00000000`00000001 ffff9f02`f8c3cc68 ffff9f02`f8c3cb69 fffff802`5ad4d04d : nt!KiExceptionDispatch+0xc2
ffff9f02`f8c3cad0 fffff802`5e6132c7     : ffffb182`52397f58 ffffb182`52399558 ffffa182`565ad940 ffff9f02`f8c3cda0 : nt!KiPageFault+0x428
ffff9f02`f8c3cc60 fffff802`5e5ff23c     : 00000000`00000000 ffffa182`565ad640 ffffa182`01b36210 ffffa182`565ad640 : srv2!Smb2ExecuteCreateReal+0x14067
ffff9f02`f8c3cdd0 fffff802`5e60d626     : ffffa182`014aa600 00000000`00000000 00000000`00000000 00000000`00000000 : srv2!Smb2ExecuteCreate+0x3c
ffff9f02`f8c3ce10 fffff802`5e601eea     : ffffa182`01b36110 00000000`00000000 fffff802`5e5eb000 ffffa182`01b36110 : srv2!Smb2ExecuteProviderCallback+0x56
ffff9f02`f8c3ce70 fffff802`5e601e0e     : ffffa182`565ad640 00000000`00002979 00000000`00000000 fffff802`5e5b5f3a : srv2!Srv2CallProviders+0x9a
ffff9f02`f8c3ceb0 fffff802`5e5fe4b8     : ffffa182`071e60c8 ffffa182`565ad650 ffffa182`13f8e701 ffffa182`071e6000 : srv2!Srv2ProcessPacket+0x9e
ffff9f02`f8c3cf00 fffff802`5abc087e     : ffff9f02`f8c300a0 00000000`00000000 ffffffff`ee1e5d00 ffff9f02`f8c3cfd1 : srv2!RfspThreadPoolNodeWorkerProcessWorkItems+0x138
ffff9f02`f8c3cf80 fffff802`5abc083c     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x2e
ffff9f02`fab56980 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


THREAD_SHA1_HASH_MOD_FUNC:  347495c1b79358979e672c384978aafb39e82285

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  bc4a7b5301f25a665cec824a8096f2089622034f

THREAD_SHA1_HASH_MOD:  44458cba88b4d47331d3f39e7548774403d75ac8

FOLLOWUP_IP: 
srv2!Smb2ExecuteCreateReal+14067
fffff802`5e6132c7 0fb75f04        movzx   ebx,word ptr [rdi+4]

FAULT_INSTR_CODE:  45fb70f

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  srv2!Smb2ExecuteCreateReal+14067

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: srv2

IMAGE_NAME:  srv2.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  50707515

IMAGE_VERSION:  10.0.17763.4504

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  14067

FAILURE_BUCKET_ID:  AV_srv2!Smb2ExecuteCreateReal

BUCKET_ID:  AV_srv2!Smb2ExecuteCreateReal

PRIMARY_PROBLEM_CLASS:  AV_srv2!Smb2ExecuteCreateReal

OS_BUILD:  0

OS_REVISION:  0

TARGET_TIME:  2023-08-03T11:51:57.000Z

OSSERVICEPACK:  0

SUITE_MASK:  272

PRODUCT_TYPE:  3

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 Server TerminalServer SingleUserTS

OSBUILD_TIMESTAMP:  1975-12-15T21:24:47Z

ANALYSIS_SESSION_ELAPSED_TIME:  f7d

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_srv2!smb2executecreatereal

FAILURE_ID_HASH:  {26076312-b064-6e1b-4ee4-14eeb7303ff1}

Followup:     MachineOwner
---------

Answer 1

Hi,

Srv2.sys is causing this issue, can you check if the server is fully patched and updated with recent hotfixes for the server? Check if any changes might have occured and SMB is used this file is used, check the memory and resource utilisation on the server increase memory and monitor the server.

Hope this helps.

JS

==

Please accept as answer and do a Thumbs-up to upvote this response if you are satisfied with the community help. Your upvote will be beneficial for the community users facing similar issues.