Anonymous_User Absent Member.
Absent Member.
1984 views

Re: Blue screen zfd6.5sp1b agent - Alan Adams?

Sorry, been on the road the past two weeks, though I don't really have
more than what Tony already covered.

The line "FAULT ->50d7db07 8a4500 mov al,[ebp+0x0] ss:00a79ee7=??"
from the DRWTSN32.LOG shows things ultimately die during a call into
NETWIN32.DLL. (May or may not actually be during
NETWIN32!NWIsDSServer as suggested; that is just the best DRWTSN32.EXE
can tell without symbol information.)

I would expect the problem is with whomever is calling NETWIN32.DLL
and not an issue with NETWIN32.DLL itself; i.e. someone called
NETWIN32.DLL and specified some invalid memory or similar as one of
the parameters NETWIN32.DLL needed.

In addition to the DRWTSN32.LOG, DRWTSN32.EXE should be attempting to
write a USER.DMP. (Run DRWTSN32.EXE without parameters to bring up
the UI, confirm a "Full" memory dump is being written, and verify the
path it is being written to.)

Opening a support case with Novell & supplying them with the USER.DMP
generated is my best recommendation. No "known issues" that would
have showed up like this in your DRWTSN32.LOG are coming to mind.

joebNO@SPAMbraytonlaw.com wrote:

> Alan Adams, you around? 🙂 Know you have some experience with this issue
> and are a genious at drwatson logs! Anyway, everytime I install the
> zfd6.5 agent sp1b (dated 2/4/2005), upon reboot and typing in my username,
> password, hitting Okay, I get a blue screen... any help appreciated. I've
> also tried disabling LDAP CX Login in the client properties (4.91sp1a)
>
> STOP: C000021a Windows Logon 0xc0000005 , etc etc
>
> I have applied the Sp4 Rollup patch 1, which includes the updated
> NTDLL.DLL file dated 6/3/2005.
>
> DRWATSON Log shows the following:
>
> Application exception occurred:
> App: winlogon.exe (pid=164)
> When: 7/13/2005 @ 14:00:13.017
> Exception number: c0000005 (access violation)



Alan Adams, MCNE
Labels (1)
0 Likes
3 Replies
Anonymous_User Absent Member.
Absent Member.

Re: Blue screen zfd6.5sp1b agent - Alan Adams?

Hey Adam, thats okay! Hope the road was somewhat enjoyable..
I do have a user.dmp file, is there any way I can read that? I tried notepad
but it wasnt very helpful, at least not to me.

--
#novell on efnet
http://www.abend.org

"Alan Adams" <address@withheld.com> wrote in message
news:3mu7e1hk0tuhb03am87kutni2k90gai02j@4ax.com...
> Sorry, been on the road the past two weeks, though I don't really have
> more than what Tony already covered.
>
> The line "FAULT ->50d7db07 8a4500 mov al,[ebp+0x0] ss:00a79ee7=??"
> from the DRWTSN32.LOG shows things ultimately die during a call into
> NETWIN32.DLL. (May or may not actually be during
> NETWIN32!NWIsDSServer as suggested; that is just the best DRWTSN32.EXE
> can tell without symbol information.)
>
> I would expect the problem is with whomever is calling NETWIN32.DLL
> and not an issue with NETWIN32.DLL itself; i.e. someone called
> NETWIN32.DLL and specified some invalid memory or similar as one of
> the parameters NETWIN32.DLL needed.
>
> In addition to the DRWTSN32.LOG, DRWTSN32.EXE should be attempting to
> write a USER.DMP. (Run DRWTSN32.EXE without parameters to bring up
> the UI, confirm a "Full" memory dump is being written, and verify the
> path it is being written to.)
>
> Opening a support case with Novell & supplying them with the USER.DMP
> generated is my best recommendation. No "known issues" that would
> have showed up like this in your DRWTSN32.LOG are coming to mind.
>
> joebNO@SPAMbraytonlaw.com wrote:
>
> > Alan Adams, you around? 🙂 Know you have some experience with this issue
> > and are a genious at drwatson logs! Anyway, everytime I install the
> > zfd6.5 agent sp1b (dated 2/4/2005), upon reboot and typing in my

username,
> > password, hitting Okay, I get a blue screen... any help appreciated.

I've
> > also tried disabling LDAP CX Login in the client properties (4.91sp1a)
> >
> > STOP: C000021a Windows Logon 0xc0000005 , etc etc
> >
> > I have applied the Sp4 Rollup patch 1, which includes the updated
> > NTDLL.DLL file dated 6/3/2005.
> >
> > DRWATSON Log shows the following:
> >
> > Application exception occurred:
> > App: winlogon.exe (pid=164)
> > When: 7/13/2005 @ 14:00:13.017
> > Exception number: c0000005 (access violation)

>
>
> Alan Adams, MCNE


0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Blue screen zfd6.5sp1b agent - Alan Adams?

The user.dmp can be read at your end, but without symbol information
for the code that was running at the time of the dump, you wouldn't be
able to tell much more than the ambiguous information the DRWTSN32.LOG
was already able to provide.

(The .DMP is just a raw dump of bytes involved in the process, kind of
like a raw LAN trace. For a LAN trace, you can "read" it by having
something that understands the various sequences of bytes and the
network protocols they represent. In the case of a crash dump, symbol
information for the code that was running (the various DLLs, EXEs,
drivers, etc.; all of which typically come from a wide assortment of
vendors on any given machine/process) is what makes "sense" of the raw
bytes. Which is why sending the dump into Novell is likely required;
because they are the ones who would have the right symbols for the
code running at the time of the crash.)

You can open the .DMP file (both process dumps created by
DRWTSN32.EXE, and also kernel-mode crash dumps such as MEMORY.DMP &
minidumps) using Debugging Tools for Windows
(http://www.microsoft.com/whdc/DevTools/Debugging/default.mspx).
There are several debuggers included; WinDBG being the GUI & easiest
to use.

"Joe Brugaletta" <joebNOSPAM@PLEASEbraytonlaw.com> wrote:

> Hey Adam, thats okay! Hope the road was somewhat enjoyable..
> I do have a user.dmp file, is there any way I can read that? I tried notepad
> but it wasnt very helpful, at least not to me.



Alan Adams, MCNE
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Blue screen zfd6.5sp1b agent - Alan Adams?

Gotcha. Just really wouldnt like to be charged for calling novell support.
I'm sure its something with the workstation, just that zen6.5 agent triggers
it flawlessly.

--
#novell on efnet
http://www.abend.org

"Alan Adams" <address@withheld.com> wrote in message
news:2vcae19ielbc4ni89p6p8ln4mthelgqils@4ax.com...
> The user.dmp can be read at your end, but without symbol information
> for the code that was running at the time of the dump, you wouldn't be
> able to tell much more than the ambiguous information the DRWTSN32.LOG
> was already able to provide.
>
> (The .DMP is just a raw dump of bytes involved in the process, kind of
> like a raw LAN trace. For a LAN trace, you can "read" it by having
> something that understands the various sequences of bytes and the
> network protocols they represent. In the case of a crash dump, symbol
> information for the code that was running (the various DLLs, EXEs,
> drivers, etc.; all of which typically come from a wide assortment of
> vendors on any given machine/process) is what makes "sense" of the raw
> bytes. Which is why sending the dump into Novell is likely required;
> because they are the ones who would have the right symbols for the
> code running at the time of the crash.)
>
> You can open the .DMP file (both process dumps created by
> DRWTSN32.EXE, and also kernel-mode crash dumps such as MEMORY.DMP &
> minidumps) using Debugging Tools for Windows
> (http://www.microsoft.com/whdc/DevTools/Debugging/default.mspx).
> There are several debuggers included; WinDBG being the GUI & easiest
> to use.
>
> "Joe Brugaletta" <joebNOSPAM@PLEASEbraytonlaw.com> wrote:
>
> > Hey Adam, thats okay! Hope the road was somewhat enjoyable..
> > I do have a user.dmp file, is there any way I can read that? I tried

notepad
> > but it wasnt very helpful, at least not to me.

>
>
> Alan Adams, MCNE


0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.