Troubleshooting Windows Blue Screen

The blue screen (or blue screen of death, blue screen of doom, or BSOD) is properly known as a “Windows Stop Message”.  It is displayed when the Windows kernel or a driver running in kernel mode encounters an error which cannot be handled.  This error could be something like a process or driver trying to access a memory address which it did not have permission to access, or trying to write to a section of memory which is marked read-only.

Stop messages don’t occur without a reason; they are an indication that the system has a problem somewhere – hardware, software, or device drivers can all be the cause of the fault.  Often a simple reboot will get the system up and running again, but if the underlying problem is not solved, the blue screen will probably come back again.

The aim of this article is to offer a methodical approach to troubleshooting stop messages, with a few simple steps which can take a lot of the guesswork out, and could get your system back up and running more quickly and easily than reinstalling the operating system.

Step 1 – Read the message

It may sound obvious, but the first step is simply to read the message displayed on screen.  Often there is enough information displayed to point you to the cause – if the stop error is caused by a kernel-mode driver, the driver image name is generally shown in the message.

Figure 1 – Windows Stop Message Caused By myfault.sys


Figure 1 is an example of a fairly common stop message – “DRIVER_IRQL_NOT_LESS_OR_EQUAL”.  This stop error is caused when a kernel mode driver attempts an illegal memory access.  The “Technical information” section shows the STOP code, and also lists the specific driver which caused the fault – in this case it’s “myfault.sys”, which is the driver installed by the Sysinternals utility NotMyFault.exe, which I used to trigger this crash.  In a real-world crash, the driver image name could be any kernel-mode driver installed on the system, but once you know the name of the driver it can be located on disk, and the vendor found by checking the file properties.

Figure 2 –Properties of myfault.sys Driver File


In terms of finding quick solutions to the problem, the vendor may have an updated driver you can try, or could have a knowledge base you can search for a resolution. However, not every stop message will make it that easy – sometimes there is little more than a STOP code.

Figure 3 – Windows Stop Message 0x0000007B


Although it looks fairly Spartan, there is still some useful information in this message – the “Technical Information” section includes the STOP code (0x0000007B in Figure 3), and occasionally that can be enough to get started with troubleshooting.  However, unless you already know what error the stop code translates to, this is where we move to step 2: Searching.

Step 2 – Search

If the stop message hasn’t given enough information to start troubleshooting, the next step is to search for more details.  Again, this may sound obvious, but in my interviews I was also surprised by the number of people who did not mention that they would use the Microsoft Support knowledge base, Microsoft TechNet, MSDN, or some other on-line resources when troubleshooting blue screen errors.

For example, a quick search of MSDN or TechNet will reveal that the stop code shown in Figure 3, 0x0000007B, translates as INACCESSIBLE_BOOT_DEVICE, which means that the operating system failed to initialize the storage device it is attempting to boot from during the I/O system initialization. This generally indicates a storage driver problem, and knowing that the problem is caused by the storage subsystem helps to focus troubleshooting to a specific area, which should make the error easier to diagnose.

There are many, many websites offering help with troubleshooting stop errors.  My preference is always to start with Microsoft sites or hardware vendor sites, then broaden my searching to other sites and forums if I can’t find what I need.  In most cases, someone else will have experienced the same problem, and there may be documented solutions or workarounds offered.

Of course, both steps one and two rely on one crucial thing – that you’ve witnessed and/or recorded the stop message.  If you haven’t seen the stop message occur, then you can find the stop error and parameters in the System event log, but unfortunately there are no additional details such as the stack trace. Nevertheless, even withthe details of the stop message, there still may not be enough information for a conclusive diagnosis, and at this point we need to move on to step three: Crash dump analysis.

Step 3 – Analyze

The third and final method in my approach is to perform basic analysis on the crash dump file, which all Windows systems are configured by default to create.  There are three types of crash dump file, and the settings for controlling which type of files are created can be found on the Advanced tab in the System Properties dialogue box.

Figure 4 – Startup and Recovery options

Complete Memory Dump

A complete memory dump contains all the data which was in physical memory at the time of the crash.  Complete dump files require that a page file exists on the system volume, and that it is at least the size of physical memory plus 1MB.  Because complete memory dumps can be very large, they are automatically hidden from the UI on systems with more than 2GB of physical RAM, although this can be overridden with a registry change (which I won’t discuss here).

Kernel Memory Dump

A kernel memory dump contains the kernel-mode read/write pages which were in physical memory at the time of the crash.  The dump file also contains a list of running processes, the stack of the current thread, and the list of loaded device drivers.  Kernel memory dumps are the default on Windows Server 2008 and Windows 7.

Small Memory Dump

A small memory dump (sometimes also called a mini-dump) contains the stop error code and parameters as well as a list of loaded device drivers, and a small amount of other data.  Small memory dumps must be analyzed on a system which has access to exactly the same images as the system which generated the dump file, meaning that it can be difficult to analyse the dump file on a system other than the one on which it was created.

For basic crash analysis, a kernel memory dump is usually adequate and, as shown in Figure 4, the default location for its creation is %SystemRoot%\MEMORY.DMP.  The tool required for analyzing the crash dump file is WinDbg, the Microsoft Windows Debugger, which can be downloaded from Microsoft's website.

After installation, WinDbg needs to be configured to use the Microsoft Symbol Server.  Once symbols are configured, click the File menu, choose Open Crash Dump, and select the crash dump file you want to analyze. The output from WinDbg will look like this:

Figure 5 – Windows Debugger Analysis


The second to last line, which starts “Probably caused by” indicates the debugger’s best guess at the cause of the crash.  In the example in Figure 5 the debugger is correct - this crash was caused by NotMyFault.  Other information in the analysis indicates that the crash dump file is a kernel memory dump, and that symbol files could not be loaded for myfault.sys (because it is a third party driver, and the symbols are not available on the Microsoft Symbol Server).

More information can be gleaned from the dump file by executing verbose analysis, using the debugger command!analyze -v.

Figure 5 – Verbose Windows Debugger Analysis


The verbose output shows the description of the stop message, which will save you having to search for it, and will also include the stack trace of the thread which was executing at the time of the crash, which could also prove useful if further debugging is needed.

Basic crash dump analysis is easy, the tools are readily available, and a lot of information about the crash can be found in just a few seconds.  If basic analysis doesn’t help to solve the problem, there are many excellent resources available which give much more detailed information about the Windows Debugger and its use, and can provide in-depth guides on how to extract and interpret the data using advanced analysis techniques.

The Debugging Tools for Windows web site is a good resource to start with, as is the book “Windows Internals" (currently at its fifth Edition) by Mark Russinovich, which includes a detailed chapter on crash dump analysis.

I hope that the information and the basic troubleshooting method of Read, Search, and Analyze help to take some of the mystery out of blue screen crashes, and enables more administrators to get their systems back up and running quickly. When it comes to speedy recovery, established procedures and troubleshooting methods are worth their metaphorical weight in gold, as randomly trying different approaches will cost you time, energy and sanity.

Citrix XenServer 6.0 Installing XenServer and XenCenter

XenServer Requirements

XenServer runs directly on your hardware, so there won't be anything between your hardware and XenServer. In other words, XenServer will function literally as the operating system. It will talk directly to your hardware, including your network interface card (NIC) and storage controller.

It requires a 64-bit CPU with Intel VT or AMD-V enabled. Now, this is actually more like a recommended spec. It doesn't mean that XenServer won't install if your CPU isn't Intel VT or AMD-V enabled, it will. However, the features and functionality will be very limited.

Remember, XenServer is a paravirtualized hypervisor. It uses the paravirtualization technique of server virtualization. Therefore, it requires the processor that you have on your physical server to be capable of doing virtualization technology in order for you to leverage its capabilities.

You need a minimum of 2 GB of RAM just to install XenServer, but the recommended is at least 8 GB, especially if you intend to host multiple virtual machines on top of it. XenServer alone will require 16 GB of disk space. But again, you'll need more for your virtual machines.

It can work with a 100 Mb NIC controller. However, what is really recommended is a Gigabit or even a 10 Gigabit Ethernet controller.

XenServer Hardware Capabilities

You can put up to 1 TB of RAM, 16 NICs, and 64 logical processors on one physical host running XenServer. Remember that the logical processors is a combination of the cores, the hyperthreading that’s enabled, etc.

I strongly recommend you check the hardware compatibility list (HCL) at hcl.xensource.com before you purchase any of the hardware or peripherals you intend to attach to your server.

In most cases, when you go to a software vendor and tell them what you’re going to use the server for (e.g. for XenServer), they’ll first check for compatibility. However, since you may tend to buy peripherals like HBAs, NICs, and other items for the server, you want to make sure that those items are also included in the HCL to avoid issues during installation or even after.

XenServer was actually meant to be installed on server class hardware. However, because it’s a Linux distribution and because it’s using the paravirtualization technique of virtualizing, it tends to be compatible with a wide range of desktops or even laptops.

So if you want to experiment, you can actually install XenServer on a laptop or on a workstation. Odds are, it will work.

Actually, XenClient, which is the Citrix’s Type 1 Client Hypervisor (XenServer is primarily for servers class computers, while XenClient is primarily for clients such as laptops and desktops), is built off of the same hypervisor as XenServer. That is why you can get away with installing XenServer on workstation class hardware.

Downloading Citrix XenServer 6 and XenCenter

You can download XenServer and XenCenter from www.citrix.com/xenserver. Or if you have a MyCitrix account, you can go to www.citrix.com/mycitrix and download it from there.

XenServer 6 is a 508 MB (ISO) download, while XenCenter is a 41 MB download.

10 minutes to Xen

Setting up XenServer is fast and easy. Here are the steps:

Burn the downloaded ISO to a CD and insert it into your optical drive or mount it using software like MagicISO.

Make sure VT (or AMD-V) is enabled in your server’s BIOS.

Boot to the CD.

Answer the basic installation questions and reboot.

Perform initial configurations, such as assigning it an IP address, a host name, password, and so on.

Connect to your XenServer using XenCenter.

That entire process should take you only right about 10 minutes and I’m going to walk you through that in a few moments.

XenCenter Installation Requirements

Citrix XenCenter is a Windows-based application which can be installed on either a physical or virtual machine.

   

It should be installed on any of the following Windows flavors: Windows XP, Vista, 7, Server 2003, 2008, and 2008R2. It requires .NET Framework 3.5.

Its minimum CPU requirement is 750 MHz but 1 GHz is recommended. Minimum required RAM is 1 GB but the recommended is 2 GB. It occupies 100 MB of disk space and operates on a NIC with at least 100 Mb speed. Finally, the minimum required screen resolution is 1024 x 768.

Now that we’re done with that, let’s jump into the installation process.

Installing XenServer

Mount the ISO CD on your physical server.

Once it boots up, it’s going to start installing automatically. 

The first thing it will want to know is the type of keyboard you intend to use. Choose one and click OK.

Click OK again.

Feel free to read the License Agreement and then click Accept EULA once you’re done.

My CPU is already enabled with Intel VT. However, I chose to disable it in order to show you what you’ll encounter when installing XenServer on a system that doesn’t have Intel VT (or AMD-V) enabled. So, if your system has Intel VT (or AMD-V) but you’ve forgotten to enable it, this is what you’ll see. 

All you have to do is go back into your BIOS and enable it there. For now, let’s just see what happens when you click OK.

Apparently, the system will proceed to ask you where you would like to install XenServer. In my case, I have 50 GB of local disk space free, so I’m going to go ahead and install my XenServer there. I just select that and click OK.

Select the source of your installation media. In my case, it’s Local media, but it can be HTTP, FTP, or NFS for you. Click OK.

You’ll then be asked whether you wish to install any supplemental packs like drivers of anything of that sort. In my case, I don’t have any so I just select No.

After that, you’ll be asked whether you want to verify the integrity of the ISO you downloaded to make sure it’s not corrupted and that it’s a good ISO to install from. Since I’m sure my ISO’s good, I’ll just opt to skip this part and click OK.

Set a password for your root account and click OK.

You can then choose whether to allow DHCP to assign this installation an IP address or to assign an IP address yourself. In my case, I’ll just let DHCP do the assigning.

Next up will be the Hostname Configuration. Again, you can either let DHCP take care of that for you or you can assign a hostname yourself. I’ve chosen to assign one myself, giving it the name “xs.trainsignal.com”. However, I’ll leave it to DHCP to set the DNS Configuration. As you can see, you may also do things manually. Click OK.

Find your geographical location, select it, and click OK.

Find the city or area you’re in, select it, and click OK.

If you have an NTP server, it is critical that you configure the time settings on your XenServer properly. And really, if you’ll be doing multiple installations of XenServer, you should have an NTP server of some sort running on your network. Once that’s ready, you can select Using NTP on this screen and then enter your NTP server’s IP address on the succeeding screen.

But for this walk through, I’m just going to go ahead and select the Manual time entry option.

Click OK.

At this point, you should be ready to install XenServer, so go ahead and click Install XenServer.

Next you'll see the Preparing for Installation screen.

If you chose to set the time manually like we did, you’ll see something like this:

Enter the correct time (or see to it that everything’s alright) and then click OK.

When you get to the Installation Complete screen, click OK to complete the process.

You’ll then go through one final reboot, immediately after which your XenServer should be up and ready to go. Just be sure to eject the optical media that contained your installer.

What you’ve gone through so far covered the basic configuration of your server. It already included an IP address assignment, so you can connect to that server immediately after. Take note of that IP address because you’re going to need that in a short while.

Installing XenCenter

So now let me take you through the installation process for XenCenter where I can show you how to connect it to your newly configured server.

Download the installation file for XenCenter to a remote Windows environment. 

Once it’s ready, launch the installer. It’s just a simple installation, so basically you just need to keep on clicking Next until you get to the screen with the Install button. Click that.

Click Yes.

And then click Finish.

Tour of XenCenter

Before we wrap things up, let me give you a brief tour of XenCenter. Launch the program from the Start menu.

The first thing it’s going to ask you is whether you want it to periodically check the Internet for updates. I suggest you click Yes.

Here’s how XenCenter looks like (see screenshot below) before any hosts, resource pools, and so on, are added to it.

To connect to the XenServer host you configured earlier, click Add a server.

Enter the IP address I asked you to take note of earlier. Also enter the password you assigned for your root account. Click Add.

One of the first things you want to make sure as you’re adding a new XenServer to XenCenter is to save and restore the server connection state on startup. Check the box that will do just that.

Once you do that, you will be allowed to configure a master password for all the XenServers you’ll be associating with this XenCenter. Click the Require a master password checkbox if that’s what you want to do, and then enter your desired master password in the fields provided.

After you click OK, you’ll be brought back to the main screen, where you’ll see your XenServer already added to XenCenter.