• Announcements

    • xper

      MSFN Sponsorship and AdBlockers!   07/10/2016

      Dear members, MSFN is made available via subscriptions, donations and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, become a site sponsor and ads will be disabled automatically and by subscribing you get other sponsor benefits.
MagicAndre1981

Trace Windows 7 boot/shutdown/hibernate/standby/resume issues

1,275 posts in this topic

look at the process lifetime graph and you see the Autochk.exe runs. So it checks the disk for errors. run chkdsk for all HDD and check the SMART values.

0

Share this post


Link to post
Share on other sites

chkdsk didn't find any errors on all drives and smart didn't either. I run the boot trace a second time and the autochk.exe disappeared, but the fltmgr.sys was still running the exact same time.

0

Share this post


Link to post
Share on other sites

Run xperf -i boot_BASE+CSWITCH+DRIVERS+POWER_1.etl -o Driverdelay.txt -a drvdelay to dump all driver delays into a txt file. Look what fltmgr.sys does.

0

Share this post


Link to post
Share on other sites

It looks like fltmgr.sys scans my whole c-drive, I can't tell.

I extracted every line with fltmgr.sys, maybe it make sense to you.

link

0

Share this post


Link to post
Share on other sites

Can you please zip the ETL and upload it?

0

Share this post


Link to post
Share on other sites

Update the firmware of your OCZ AGILITY3 from 2.13 to 2.15 and try again.

If it doesn't fix it run a new trace which captures more (IO related) data:

xbootmgr -trace boot -traceFlags BASE+CSWITCH+DRIVERS+POWER+DISK_IO_INIT+FILE_IO+FILE_IO_INIT -stackwalk profile -resultPath C:\temp

zip and upload the new trace.

0

Share this post


Link to post
Share on other sites

I updated the firmware, but no change.

Then I started the new trace, but while booting, it shows me everytime a blue screen o.O.

Right now the error is "SYSTEM_SERVICE_EXCEPTION", sometimes it's a blue screen without a name.

0

Share this post


Link to post
Share on other sites

can you get the dumps and share them? Have you tried to restore Windows with the System restore?

0

Share this post


Link to post
Share on other sites

ok, new error, happend about 2 seconds after the login screen appeared: no name, but the technical information says "msrpc.sys - Address "someHEXnumber" base at "HEX"; DateStamp "HEX" "

dumps

Now the System restore..

0

Share this post


Link to post
Share on other sites

update the network card drivers and check the IPv6 settings and if you don't use IPv6 disable it.


ATTEMPTED_WRITE_TO_READONLY_MEMORY (be) - An attempt was made to write to readonly memory.

Child-SP RetAddr Call Site
fffff880`09967038 fffff800`02e86f57 nt!KeBugCheckEx
fffff880`09967040 fffff800`02edad6e nt! ?? ::FNODOBFM::`string'+0x442cb
fffff880`099671a0 fffff800`02ebdc25 nt!KiPageFault+0x16e
fffff880`09967338 fffff880`0185dc8a nt!RtlEnumerateEntryHashTable+0xbf
fffff880`09967340 fffff880`01603aab tcpip!Ipv6EnumerateAllPaths+0x17a
fffff880`099673f0 fffff880`06a53e29 NETIO!NsiEnumerateObjectsAllParametersEx+0x24f

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.

Child-SP RetAddr Call Site
fffff800`00b9bfe8 fffff800`02e821e9 nt!KeBugCheckEx
fffff800`00b9bff0 fffff800`02e80e60 nt!KiBugCheckDispatch+0x69
fffff800`00b9c130 fffff800`02e8f0fc nt!KiPageFault+0x260
fffff800`00b9c2c0 fffff880`018b4ae9 nt!RtlContractHashTable+0x10c
fffff800`00b9c2f0 fffff880`018b492c tcpip!IppRestructureHashTableUnderLock+0x39
fffff800`00b9c320 fffff880`018b5173 tcpip!IppPathSetTimeout+0x7d
fffff800`00b9c390 fffff880`018b5869 tcpip!IppCompartmentSetTimeout+0x63
fffff800`00b9c400 fffff800`02e8e5fc tcpip!IppTimeout+0x89
fffff800`00b9c430 fffff800`02e8e496 nt!KiProcessTimerDpcTable+0x6c

0

Share this post


Link to post
Share on other sites

I could only boot in safe mode without network drivers, everything else started the bluescreen. After restarting normally, it worked again and the boot trace save option popped up. IPv& is now deactivated.

new trace

0

Share this post


Link to post
Share on other sites

this also shows me the cause :(

Run Process Monitor and activate boot logging. reboot and run ProcMon again, save the log, zip it and upload it.

0

Share this post


Link to post
Share on other sites

Here is the 1minute delay:

10:34:52,0059162 System 00:00:01.1314581 0.0000013 4 RegQueryValue HKLM\System\CurrentControlSet\Control\SESSION MANAGER\MEMORY MANAGEMENT\ExistingPageFiles SUCCESS Type: REG_MULTI_SZ, Length: 42, Data: \??\D:\pagefile.sys

10:35:51,7529699 System 00:01:00.8785118 0.0000000 4 Thread Create SUCCESS Thread ID: 320

So looking for the pagefile on drive D: (WESTERN DIGITAL WD30EZRX-00MMMB0) takes 1minute and causes the fltmgr activity. It is better place the pagefile again on drive C:. Use MoveAndLink to move other files from C: to D:

0

Share this post


Link to post
Share on other sites

Windows needs a pagefile to generate dumps when the PC crashes. Play with the size settings until you find a value which is ok. Is the boot now ok if you move the pagefile to C: ?

0

Share this post


Link to post
Share on other sites

Nope, I tried 8gb on C, 4, none and 500mb, but nothing changed at all.

0

Share this post


Link to post
Share on other sites

Post a picture of the key: HKLM\System\CurrentControlSet\Control\SESSION MANAGER\MEMORY MANAGEMENT

0

Share this post


Link to post
Share on other sites

Have you disabled the pagefile?

0

Share this post


Link to post
Share on other sites

Please make a new ProcMon boot log when you use a pagefile which is on drive C.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.