Share via

Win2016 system restart abnormally. Evtx log and DMP log have been collected. Please see what the problem is,

fulong qin 1 Reputation point
2021-01-27T09:58:06.377+00:00

Win2016 system restart abnormally. Evtx log and DMP log have been collected. Please see what the problem is,
On Tue 2020/9/29 11:33:02 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\092920-18062-01.dmp
This was probably caused by the following module: ntoskrnl.exe(nt+0x153FA0)
Bugcheck code: 0x133 (0x0, 0x501, 0x500, 0x0)
Error: DPC_WATCHDOG_VIOLATION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft? Windows? Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL or above. This could be caused by either a non-responding driver or non-responding hardware. This bug check can also occur because of overheated CPUs (thermal issue).
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time

Evtx log has been collected, DMP log download link:
https://teambition.icu/s/9a76823c-cf7d-49ff-8238-68c47c29e740

60935-image.png

60913-%E5%9B%BE%E7%89%872.png

Another example of WinDbg analysis MEMORY.DMP
On Mon 2021/1/25 11:02:37 your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: usbxhci.sys (usbxhci+0x21f16)
Bugcheck code: 0x133 (0x0, 0x501, 0x500, 0x0)
Error: DPC_WATCHDOG_VIOLATION
file path: C:\Windows\system32\drivers\usbxhci.sys
product: Microsoft? Windows? Operating System
company: Microsoft Corporation
description: USB XHCI 驱动程序
Bug check description: The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL or above. This could be caused by either a non-responding driver or non-responding hardware. This bug check can also occur because of overheated CPUs (thermal issue).
The crash took place in a storage driver or controller driver. Since there is no other responsible driver detected, this could be pointing to a malfunctioning drive or corrupted disk. It's suggested that you run CHKDSK.

If the log download link of the attachment cannot be accessed, which platform do you need? I will upload the log. Thank you.

Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,436 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. fulong qin 1 Reputation point
    2021-01-28T01:19:43.72+00:00

    windbug:

    Microsoft (R) Windows Debugger Version 10.0.19041.1 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Users\Hasee\Desktop\南山达实智能\MEMORY\MEMORY.DMP]
    Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

    Symbol search path is: srv*
    Executable search path is:
    Windows 8.1 Kernel Version 9600 MP (16 procs) Free x64
    Product: Server, suite: TerminalServer SingleUserTS
    Built by: 9600.17031.amd64fre.winblue_gdr.140221-1952
    Machine Name:
    Kernel base = 0xfffff800aca09000 PsLoadedModuleList = 0xfffff800accd32d0
    Debug session time: Mon Jan 25 11:02:37.005 2021 (UTC + 8:00)
    System Uptime: 117 days 23:01:12.518
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...........
    Loading User Symbols

    Loading unloaded module list
    ......
    For analysis of this file, run !analyze -v
    14: kd> !analyze -v

    • *
    • Bugcheck Analysis *
    • *

    DPC_WATCHDOG_VIOLATION (133)
    The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
    or above.
    Arguments:
    Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
    component can usually be identified with a stack trace.
    Arg2: 0000000000000501, The DPC time count (in ticks).
    Arg3: 0000000000000500, The DPC time allotment (in ticks).
    Arg4: 0000000000000000, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
    additional information regarding this single DPC timeout

    Debugging Details:

    KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
Value: 1

Key  : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on SWT-QIN

Key  : Analysis.DebugData
Value: CreateObject

Key  : Analysis.DebugModel
Value: CreateObject

Key  : Analysis.Elapsed.Sec
Value: 1

Key  : Analysis.Memory.CommitPeak.Mb
Value: 92

Key  : Analysis.System
Value: CreateObject

    BUGCHECK_CODE: 133

    BUGCHECK_P1: 0

    BUGCHECK_P2: 501

    BUGCHECK_P3: 500

    BUGCHECK_P4: 0

    DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED

    PROCESS_NAME: System

    STACK_TEXT:
    ffffd0006e1ffc98 fffff800acb9cad6 : 0000000000000133 0000000000000000 0000000000000501 0000000000000500 : nt!KeBugCheckEx
    ffffd0006e1ffca0 fffff800acabcf85 : 00000000000003f6 0000000000000000 0000000000000000 ffffdff03f446fb0 : nt! ?? ::FNODOBFM::string'+0x2f626 ffffd0006e1ffd30 fffff800ad19a7b5 : ffffe0007ad9a0f0 fffff800acaf3426 0000000000000000 ffffd0006e240180 : nt!KeClockInterruptNotify+0x95 ffffd0006e1fff40 fffff800acad8363 : ffffd0006f0c0dc0 0000000000000000 ffffcfea09cb4db3 0000000000000000 : hal!HalpTimerClockIpiRoutine+0x15 ffffd0006e1fff70 fffff800acb5e42a : ffffe00079003e00 ffffe0007d066010 00000000000000a9 ffffe0007d0660b8 : nt!KiCallInterruptServiceRoutine+0xa3 ffffd0006e1fffb0 fffff800acb5e80f : 0000000000000000 00000000000000ff 00000000000000a9 ffffe0007d09cab0 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea ffffd0006e271060 fffff801af79ccb3 : ffffe0007cfa5202 ffffe0007d0bc990 ffffe0007cf766d8 00000000ffffffff : nt!KiInterruptDispatchLBControl+0x11f ffffd0006e2711f0 fffff800aca62810 : ffffd0006e271380 000000025f784694 ffffd0006e271330 ffffd0006e240180 : usb80236!CancelSendsTimerDpc+0x5b ffffd0006e271230 fffff800acb60aea : ffffd0006e240180 ffffd0006e240180 ffffd0006e2531c0 ffffe0007aa96880 : nt!KiRetireDpcList+0x4f0 ffffd0006e2714e0 0000000000000000 : ffffd0006e272000 ffffd0006e26b000 0000000000000000 00000000`00000000 : nt!KiIdleLoop+0x5a

    SYMBOL_NAME: usb80236!CancelSendsTimerDpc+5b

    MODULE_NAME: usb80236

    IMAGE_NAME: usb80236.sys

    STACK_COMMAND: .thread ; .cxr ; kb

    BUCKET_ID_FUNC_OFFSET: 5b

    FAILURE_BUCKET_ID: 0x133_DPC_usb80236!CancelSendsTimerDpc

    OS_VERSION: 8.1.9600.17031

    BUILDLAB_STR: winblue_gdr

    OSPLATFORM_TYPE: x64

    OSNAME: Windows 8.1

    FAILURE_ID_HASH: {a33649e0-3f49-3074-35df-91e00215eed4}

    Followup: MachineOwner

    0 comments
  2. Carl Fan 6,836 Reputation points
    2021-01-29T09:43:54.667+00:00

    Hi,
    DPC_WATCHDOG_VIOLATION (133). It's related to DPC time out.
    According to the memory dump, it is ntoskrnl.exe. Maybe related to usb80236.sys.
    So firstly, please check for update to install new security updates. It will update system files version.
    Then go to the manufacturer's official website to update the driver such as BIOS, Motherboard chipset， USB.
    Hope this helps and please help to accept as Answer if the response is useful.
    Best Regards,
    Carl

    0 comments