ESXi

 View Only
  • 1.  Windows Server 2012 R2 BSOD 0x0000013c

    Posted Feb 09, 2018 09:51 PM

    Hello,

    One of my Windows 2012 R2 RDS servers crashes with a BSOD INVALID_IO_BOOST_STATE (code: 0x0000013c). Some searching told me that it should be a driver with a memory leak.

    Guest: Windows Server 2012 R2 up to date, hardware version 11, LSI Logic Storage Controller, E1000E NIC, Host: Dell PowerEdge R720, ESXi 6.0.0

    This is the only server with this issue but this is our sole RDS server in our VMWare environment. Do you have any suggestions how to fix?

    When I run the analysis on the minidump, it says the issue is with msoia.exe which is the Microsoft Office Telemetry Agent but when I submitted a Microsoft Office 365 ticket, they referred me to Windows Server (commercial) support. They referred me back to Microsoft Office 365. I've attached my minidump. Should I post my full dump? It's more than a gigabyte in size so I'm holding off unless it's really neaded.

    Thanks in advance!

    Regards,

    Alan Chan



  • 2.  RE: Windows Server 2012 R2 BSOD 0x0000013c

    Posted Feb 09, 2018 11:32 PM

    From the dump

    System Uptime: 0 days 16:51:09.338

    *******************************************************************************

    * *

    * Bugcheck Analysis *

    * *

    *******************************************************************************

    Unknown bugcheck code (13c)

    Unknown bugcheck description

    Arguments:

    Arg1: ffffe000bc12a880

    Arg2: 0000000000000001

    Arg3: 0000000000000000

    Arg4: 0000000000000000

    Debugging Details:

    ------------------

    TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

    DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER

    BUGCHECK_STR: 0x13C

    PROCESS_NAME: msoia.exe

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from fffff801eb3874e5 to fffff801eaf62ba0

    STACK_TEXT: 

    ffffd000`89b318c8 fffff801`eb3874e5 : 00000000`0000013c ffffe000`bc12a880 00000000`00000001 00000000`00000000 : nt!KeBugCheckEx

    ffffd000`89b318d0 fffff801`eb1cc1ac : 00000000`00000000 00000000`00000000 ffffe000`bc12a880 ffffe000`ae21ef20 : nt! ?? ::NNGAKEGL::`string'+0x52345

    ffffd000`89b31940 fffff801`eaea04cf : 00000000`00000000 ffffd000`89b31a99 ffffe000`bc12a880 ffffe000`bc12a850 : nt!ObpRemoveObjectRoutine+0x64

    ffffd000`89b319a0 fffff801`eb1ab4a5 : ffffe000`ae21ef20 00000000`00000000 ffffd000`89b31a99 ffffe801`c0e5d001 : nt!ObfDereferenceObjectWithTag+0x8f

    ffffd000`89b319e0 fffff801`eaf6e3b3 : ffffe801`c1046880 00000000`00000234 00000000`0025fdb0 00000000`0035f5d8 : nt!NtClose+0x205

    ffffd000`89b31b00 00000000`77392352 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

    00000000`0025ea48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77392352

    STACK_COMMAND: kb

    FOLLOWUP_IP:

    nt! ?? ::NNGAKEGL::`string'+52345

    fffff801`eb3874e5 cc int 3

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+52345

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 59ba8548

    FAILURE_BUCKET_ID: X64_0x13C_nt!_??_::NNGAKEGL::_string_+52345

    BUCKET_ID: X64_0x13C_nt!_??_::NNGAKEGL::_string_+52345

    Followup: MachineOwner

    msoia.exe is office related file and not sure if you have MS office working or updated on the Guest PS//

    https://www.file.net/process/msoia.exe.html

    Thanks,

    MS



  • 3.  RE: Windows Server 2012 R2 BSOD 0x0000013c

    Posted Feb 10, 2018 01:30 AM

    You may want to look at or try the workaround specified in this KB.

    https://kb.vmware.com/kb/2149642

    Even though the KB is for ESXi 6.5, you do have Windows Server 2012 R2 Terminal Server.

    I have seen the vmware.log similar to the situation in the KB. It did look like a resource leak but the VM just crashed with a signal 11. Perhaps it is because something (presumably VMware Tools) assumed a resource to be available/allocated successfully and the code continued execution and bam! the VM crashes with signal 11.

    Maybe in your situation, the crashing manifests itself differently (as a BSOD instead of abrupt crash without BSOD of the VM) as the crash might be precipitated by presence of Microsoft Office using the same leaking resource and the lack of that resource is handled differently.



  • 4.  RE: Windows Server 2012 R2 BSOD 0x0000013c
    Best Answer

    Posted Apr 27, 2018 06:32 PM

    I ended up paying for single-incident support for Microsoft Windows and this was the end result that closed the case:

    Symptom: 2012 R2 server named "XXXXXXXXX" is presenting the BSOD 0x0000013c (0xffffe000bc12a880, 0x0000000000000001, 0x0000000000000000, 0x0000000000000000)

    Cause: Office Telemetry binary was having issues with 2 scheduled tasks. 

    Resolution: Update Office and remove the office scheduled tasks using the commands:

    1. schtasks.exe /delete /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016"
      schtasks.exe /delete /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016"

    Once this was implemented, I no longer had any BSOD crashes. It's been almost a month now.