Crash Dump Analysis Patterns (Part 35)
Monday, November 12th, 2007In kernel or complete memory dumps coming from hanging or slow workstations and servers !irpfind WinDbg command may show IRP Distribution Anomaly pattern when certain drivers have excessive count of active IRPs not observed under normal circumstances. I created two IRP distribution graphs from two problem kernel dumps by preprocessing command output using Visual Studio keyboard macros to eliminate completed IRPs and then using Excel. In one case it was a big number of I/O request packets from 3rd-party antivirus filter driver:
\Driver\3rdPartyAvFilter
In the second case it was the huge number of active IRPs targeted to kernel socket ancillary function driver:
\Driver\AFD
Two other peaks on both graphs are related to NTPS and NTFS, pipes and file system and usually normal. Here is IRP distribution graph from my Vista workstation captured while I was writing this post:
- Dmitry Vostokov @ DumpAnalysis.org -