How to troubleshoot a BSOD?

Question

Occasionally, I'll see a BSOD when developing with the following environment:

Win7 RTM on AMD64
ASP.NET MVC 1.0
Azure July 2009
VS2008 with SP1

The BSOD occurs after hitting F5 in VS.  Things hang for a few seconds, and then I get a bluescreen.  I have no idea if this is related to Azure, but I have to start somewhere.

I'm still new to Windows, so I could use some pointers.  I opened the minidump file with windbg after loading the symbols for Win7, but I get this error:

Symbol search path is: C:\SYMBOLS
Executable search path is:
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

How should I proceed?  Also, where can I get dumpchk.exe for Win7?

Answer 1

Hello, it is unlikely that Windows Azure SDK will cause a blue screen, especially since it's not touching the hardware, and VS 2008 is using GDI (software rendering) rather than WPF (hardware rendering). Can you check if it is a problem with your hardware or device driver? This is most likely to be a device driver problem. Have you encountering blue screen somewhere else? If so, I suggest you to ask your question on the Windows 7 forum: http://social.technet.microsoft.com/Forums/en-US/w7itprohardware/threads.

---

Lante, shanaolanxing This posting is provided "AS IS" with no warranties, and confers no rights.

Answer 2

OK, thanks.  I'll start investigating this as a win7 problem.

I only encounter bluescreens when launching an Azure app with debugging (F5) in VS.  Quotidian usage hasn't resulted in a crash.

Answer 3

I've been experiencing the BSOD regularly for years and recently I've been experiencing the problem several times a day.  I used the shareware utility BlueScreenView and two drivers that were displayed in the dump list related to either ntoskrnl.exe or Ntfs.sys.  

My PC is running Win XP Pro with SP3.  The PC crashes whether I'm in an application (doesn't matter what application; VS.Net, SQL Server 2005, Norton 360, MS Word document 2003/2007, etc.) or only have browsers open (could be Chrome, IE, FF).  

Any suggestions would be appreciated.

An unrelated question, is there another utility or way to analyze the dump files? Is there a way to used VS.Net 2008?  I ask because maybe the utility I used (BlueScreenView) isn't presenting enough information or the correct information.

Answer 4

AppTricks. I don't think the problem is caused by Windows Azure. Do you know which process is causing the blue screen? If you know, I suggest you to post the question on the forum that is dedicated for the product. Just some general suggestions: You can use WinDbg to analyze the dump files. This will help you to identify the offending process. However, the blue screen mini dump usually contains kernal mode information only. To isolate the actual problem, you will need a user mode dump. After you find out the offending process, you can attach the process to WinDbg, and if something goes wrong, you will be able to debug it. If you're unable to figure out the problem on yourself, you can create a user mode dump, and send it to our customer support of the specific product. They will try to help you.

---

Lante, shanaolanxing This posting is provided "AS IS" with no warranties, and confers no rights.

Answer 5

Without good symbols or if you don't switch to the correct frame for the exception trap, you will almost always see NTOSKRNL as an issue (i.e. a false positive).  Since that is just the 'shell' of the kernel, it is highly unlikely to be the problem (i.e. all of the 'features' of the kernel are implemented in .sys files so any bug should manifest there). 

To debug:
In the OS directory (default \Windows) should be a memory.dmp file from the most recent crash.  If you open it with WinDBG (http://www.microsoft.com/whdc/devtools/debugging/default.mspx) and set the symbols path correctly (see the docs), you can run the command:
!analyze -v <enter>

That will generate a thread stack and identify the most likely culprit.


Pat

---

Pat [MSFT]

Answer 6

Personally, I use WinDBG.

Your symbol path will need to also point to the public symbol store.  You can manually set it in Windbg:

.sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols

There are several different 'flavors' of mini-dumps.  If it is one of the really small ones (<256k) then you will also need to set the image path.

---

Pat [MSFT]