Stop x'00000077 with Status Code x'c00000185

Hi bjsjerome,

Were the three drives you replace in the virtual disk that has the OS or were they a data drive? Is there a paging file on that drive? Did this error start happening after the drive replacement? Both the 0x77 and 0x7A errors point to the same issue which is a Kernel data inpage error. According to Microsoft the error is caused by an issue with the paging file. support.microsoft.com/.../228753

Do you have Openmanage Server Administrator(OMSA) installed? downloads.dell.com/.../OM-SrvAdmin-Dell-Web-WIN-6.5.0-2247_A01.10.exe

You can use this to run a consistency check on the RAID arrays and check for bad blocks.

ftp.dell.com/.../dell-opnmang-srvr-admin-v6.5_User%27s%20Guide3_en-us.pdf pages 137-139

In addition you may want to run our online diagnostics tool to test the drives.

downloads.dell.com/.../dell-onlinediags-win32-2.16.0.165.exe

Quick test is enough in most cases, it does a random read/write test on each drive. The full test tests the whole drive, so start with just a quick test.

Hi Josh,

Thanks for your reply.  The 3 new drives contain on data.  The OS is installed on 1st 2 drives in as Raid 1.  Then 3 are 36gb Drive in a Raid 5 and the 3 146gb Drives as a Raid 5.  I have run consistency checks on all logical drives and I ran chkdsk on all drives.  Initially the chkdsk failed to complete on the larger Array but after the firmware and driver updates it did complete.

I do have open manage installed and it reports that all is well.  I am currently running test on the drives with online diagnostics.  Should I use quick or full test?

Even though the system is configured to do a complete dump, send alert and auto restart  on

System failures, there are no dumps.  

Is there something I could do to force a dump on the next failure?

Thanks Again,

Jerome

If it is configured properly for dumps then no there is nothing we can change to make it dump next time, any methods of forcing a dump are going to show the forced dump as the cause not whatever the real problem is. Does the new array have data on it already? With the issue starting when that was created, disconnecting those drives and seeing if it doesn’t bluescreen may be useful.

I completed the full test on all drives and hold no errors.  I also ran a test of Ram and had no errors.  I than ran a consistency check on the OS drive and had no errors.  Then during the consistency check of the New Data Drive the system crashed and reported a Stop x'00000074 error.    And during reboot the battery/memory error was displayed.

The system has now been up for 10 hours.  But, since I've done nothing to address the problem, it probably luck.

Do you have any other recommendations?  Should there be clues in the event log?  What should I look for?

Thanks,

Jerome

Are the bluescreen errors creating memory dumps? They would be located in c:\windows and c:\windows\minidumps folders, these could help determine the root cause.

There is data on the new drives, in fact this is the primary purpose for the server.  The reason for the new drives was to increase the available space.  Because of this instability, I just purchased a network drive on which I can move the data until the server is stable.  

My guess, is that it will not blue screen.  Because, it seems that when I ran virus scans or chkdsk on the new drives the system crashed.  There was no crash when doing the same on the other drives.  Another factor that seems to have help to stabilize things is I removed my anti-virus software (TrendMicro Worry Free Small Business).

There is however another scenario that caused crashes;  Windows updates.  But last night 2 updates ran successfully.

Once, I move the data.  I can disconnect the drives and see what happens.  Please, instruct me on how to disconnect the logical Drive.  I will do this over the weekend as we are behind in work and are taking advantage of the period of stability.

Thanks,

Jerome

If you can move the data for now. I would just power off tonight, disconnect the new drives and boot back up, if it is stable then it is something with the new drives and we can try to recreate the array.

I found the following error in the event log just before 2 crashes on friday and saturday.:

Event Type: Error

Event Source: Ntfs

Event Category: Disk

Event ID: 55

Date: 6/1/2013

Time: 9:45:46 AM

User: N/A

Computer: DESALVO

Description:

The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolumeShadowCopy17.

For more information, see Help and Support Center at go.microsoft.com/.../events.asp.

Data:

0000: 0d 00 04 00 02 00 52 00   ......R.

0008: 02 00 00 00 37 00 04 c0   ....7..À

0010: 00 00 00 00 02 01 00 c0   .......À

0018: 00 00 00 00 00 00 00 00   ........

0020: 00 00 00 00 00 00 00 00   ........

0028: 81 01 22 00               .".    

I don't know where to find Volumeshadowcopy17.  Is this a clue to The crashes.

Thanks

Jerome

Thanks, that makes it look like it is a shadow copy issue. We can just delete the shadow copies.

technet.microsoft.com/.../cc776119(v=WS.10).aspx

To delete a shadow copy

1. Open Computer Management.

2. In the console tree, right-click Shared Folders, select All Tasks, and then click Configure Shadow Copies.

o Computer Management/System Tools/Shared Folders

3. In the Shadow Copies dialog box, click the shadow copy that you want to delete and click Delete Now.

Notes

• To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure.

• To open Computer Management, click Start, click Control Panel, double-click Administrative Tools, and then double-click Computer Management.

• Shadow copies are not included in backups; once they are deleted, they cannot be restored.