Windows server 2016 : PAGE_FAULT_IN_NONPAGED_AREA PROCEXP141.SYS failed

[Frigg]

Hello,

I sometimes, but quite often, have this blue screen with stop code PAGE_FAULT_IN_NONPAGED_AREA with PROCEXP141.SYS failed, starting a Windows 2016 server VM.
I have tried to run these vm on another server, and have the same problem.

What can I do ?
Thank you for any help,

Hervé

 

[t.lamprecht]

Hi!

Did you check out:
https://docs.microsoft.com/en-us/wi...r/bug-check-0x50--page-fault-in-nonpaged-area

It seems that this could be caused by various underlying issues, possible NTFS issues on the disk.

I'd work through that page, ensure you have all available BIOS updates on the host installed.

I have tried to run these vm on another server, and have the same problem.

How similar is that server to this one?

Are other Windows VMs also affected, or is that the only one?

Could you please also post the VM config? qm config VMID

 

[Frigg]

Hello Thomas,
Thank you for helping.
Here is the detailed issue in windows.
It is a Kernel Power issue.
But these VM previously stopped smoothly.

-

System

- Provider [ Name] Microsoft-Windows-Kernel-Power [ Guid] {331C3B3A-2005-44C2-AC5E-77220C37D6B4}

EventID 41

Version 4

Level 1

Task 63

Opcode 0

Keywords 0x8000400000000002

- TimeCreated [ SystemTime] 2020-08-22T15:53:09.103677900Z

EventRecordID 581404

Correlation

- Execution [ ProcessID] 4 [ ThreadID] 8

Channel System

Computer W2016-FR.fr.local

- Security [ UserID] S-1-5-18

-

EventData

BugcheckCode

80

BugcheckParameter1

0xffffffff00000010

BugcheckParameter2

0x0

BugcheckParameter3

0xfffff8026ab5102b

BugcheckParameter4

0x2

SleepInProgress

0

PowerButtonTimestamp

0

BootAppStatus

0

Checkpoint

0

ConnectedStandbyInProgress

false

SystemSleepTransitionsToOn

0

CsEntryScenarioInstanceId

0

Servers used to run these VM are really différents. Only the type of HDD are the same: Samsung evo 970.

I only run one VM so I can't tell if other windows VM's could be affected in the same way.

Here is the MV config:

 

[Frigg]

... well I didn't remember it, but it is a problem I have to face since while:
https://forum.proxmox.com/threads/error-46-41-and-6008-at-each-windows-2016-server-start-up.57222/

The thing is that for the first time I saw the blue screen. Previously, I only noticed critical error.

 

[Frigg]

... I also have blue screen with stopcode APC INDEX MiSMATCH

So I've update all Virtio drivers, and it seems to have fixed the issues.

I've also performed a sfc /scannow to repaire eventual dammaged files system.

It would be great if virtio drivers could be maintained updated automatically: I knew for a long date that there were something wrong reading event logs, but it was by chance while launching a console when starting the machine, that I discovered what was happening.
Updating drivers is something that we do not necessarily think about, because it is done automatically in Windows.

 

[Frigg]

... I was too quicky enthusiastic. Still have the issue.
When upgrading the virtio drivers, do I have to reinstall the Quemu agent and Balloon service ? If yes how to proceed ? Do I have to unsinstall previous services andn how ?

 

[aaron]

Hmm, did you update the QXL drivers as well? Try the latest version from the Spice website directly.

https://www.spice-space.org/download.html Windows Guest tools

If you use the latest virtio iso and run the "virtio-win-gt-x64" installer it should update the drivers and agents to the latest version. AFAIK you don't need to manually remove or uninstall previous versions of the services.

 

[Frigg]

Thank you Aaron,

I didn't even knew it was possible to proceed like this !
I read consciensfully the documentation, and made manual update from the device manager...


Just to make sure, following your advice, I've installed this:




Unfortunately, after the first reeboot, I have the same Kernel-power issue.
According to event properties it occures when " The system restarted without shutting down properly first. This error can occur if the system becomes unresponsive, hangs, or loses power unexpectedly. "

BUT I WAS WATCHING THE SHUTTING DOWN ON A CONSOLE AND DIDN'T NOTE ANYTHING but THAT IT WAS SHORT. Is there a way to make sure that the PVE really wait windows proper shutting before stoping power's VM or whatever ?

Any idea ?

Best regards

 

[Frigg]

Hello,
I have analyzed dump files with windows Xindbg tools.
It says that For PAGE_FAULT_IN_NONPAGED_AREA, it is invalid system memory referenced.
Does someon could tell me what I can do to fix this issue ?

You'll find below the report


Thanks for helping

 

[Frigg]

Well well well,

I have tested memories with windows Vm's tools, and PVE memtest86+. It is OK.

You've asked if all Vm were affected.
I've sat up an windows 10 VM, and surprise, surprise, it has the same critical event.

I' have followed windows recommandations without any positive résult
https://docs.microsoft.com/en-us/wi...r/bug-check-0x50--page-fault-in-nonpaged-area

The cause may be found reading vmware's KB: https://kb.vmware.com/s/article/2138677

"This issue occurs when there is heavy memory allocation and deallocation jobs in the Windows guest. It causes stress for vmmemctl.sys resulting in a blue diagnostic screen.
When the vmmemctl driver is claiming memory to save it to the hypervisor, it attempts to lock pages in the guest. If the lock failure occurs number of times and reaches a limit, it causes an overflow error and a blue diagnostic screen."

As it affects all windows VM"s, and RAM are OK on both servers, could it be a kvm issue under Proxmox ?
Could it be because of the VM's Bios : SeaBios instead of OVMF in order to use UEFI at boot start ?
Should I had chosen OVMF bios with Sata disks instead of SCSi ?...
I really need help.
Thanks in advance.

 

[Frigg]

Hello,
COuld someone help me ?

 

[Frigg]

This issue was a Windows one. Nothing to do with Proxmox.
For thoses who may be interested, PROCEXP141.SYS is a driver related to an old verson of procexp.exe edeted by Systinternals, that is related to Microsoft.
The solution was just to update the procexp.exe and some other files related to a third part programm.

By the way, Process explorer is a very useful tool to monitor Windows and even track viruses. You can find it here https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

To untangle the problem, it was necessary to use WinDbg, which is part of Windows Kits. To use it, this video was useful: https://www.youtube.com/watch?v=HsZafL2-hWU