Windows Bug Check Analysis

This article is a guide on using bug check analysis to investigate why a Microsoft® Windows® server
crashed. A server crash, also known as Blue Screen of Death or BSOD, displays an error screen and can cause
the server to shut down or restart unexpectedly. The following terms are common when discussing server
crashes.

• Blue screen: When certain hardware problems occurs, a blue error screen displays.
• Crash dump file: This file, stored on the hard drive, contains information collected when the system
  generates a STOP code. The memory.dmp file contains information that the debugger needs to analyze.
• Debugger: Use this program to analyze the dump file
• STOP code: This error code identifies what stopped the system kernel from running.

Analyzing a bug check code

Microsoft provides WinDbg to debug the crash dump. You can download the debugger.

The system creates a memory.dmp file at the time of the crash. Use WinDbg to analyze the file and determine
the cause of the crash.

Run WinDbg

To use WinDbg, you need do the following tasks.

Add the symbol path

After you install WinDbg, perform the following steps to add the symbol file path for debugging:

1. Open WinDBG > File > Symbol File Path... and enter the following:

   SRVC:\Windows\symbol_cachehttps://msdl.microsoft.com/download/symbols

2. Click OK.

Windows might store the dump file in the following locations:

Open the memory.dmp file

To open the dump file, perform the following steps:

1. Go to File > Open Crash Dump... > Open the MEMORY.DMP file.

2. Click or type "!analyze -v to get the detailed debugging information.

3. Wait for the analysis to complete.

Read the crash dump

After the analysis completes, review the output to determine the cause of the crash. For example, driver issues or memory corruption might have caused the crash. The output of the analysis provides you with the details.

Example causes include the following possibilities:

FAILURE_BUCKET_ID:  X64_0xA_termdd!IcaDereferenceChannel+8c
The cause of the error was due to termdd.sys.

FAILURE_BUCKET_ID: 0xd1_e1k6232+16171
The cause was the Intel network adapter(e1k6232.sys) drivers

Use Driver Verifier, if necessary

If faulty drivers caused the crash, you can use Driver Verifier to examine the system's drivers.
Use the Windows-native Driver Verifier utility to test system drivers to find any improper behaviors.

To use Driver Verifier, perform the following steps:

1. Open a command prompt as the administrator.

2. Type verifier to open the Driver Verifier Manager.

3. Select the task you want and click Next. The default is Create standard settings.

4. Select which drivers to verify and click Next.

5. Depending on the options selected, you might need to restart the server. In that case, the system notifies
   you before the verifier executes your options.

6. After the verifier finishes, review the output of the verifier.

Bug check codes

The following table lists some of the bug check codes you might encounter: