Quiescing operations cause a Windows virtual machine to panic with a Stop 24 error on ntfs.sys
search cancel

Quiescing operations cause a Windows virtual machine to panic with a Stop 24 error on ntfs.sys

book

Article ID: 341533

calendar_today

Updated On:

Products

VMware vSphere ESXi

Issue/Introduction

Symptoms:
When you attempt to take a snapshot of a virtual machine running Microsoft Windows, you experience these symptoms:
  • The snapshot operation fails
  • The virtual machine panics with the error:

    A problem has been detected and Windows has been shut down to prevent damage to your computer.
    If this is the first time you've seen this Stop error screen restart your computer. If this screen appears again, follow these steps:

    Disable or uninstall any anti-virus, disk defragmentation or backup utilities. Check your hard drive configuration, and check for any updated drivers. Run CHKDSK /F to check for hard drive corruption, and then restart your computer.

    Technical information:

    *** STOP: 0x00000024 (0x00000000001904FB,0xFFFFF88006F62D08,0xFFFFF88006F62560,0xFFFFF880020B0352)
    *** Ntfs.sys - Address FFFFF880020B0352 base at FFFFF88002004000, DateStamp 52e1be8a
    Collecting data for crash dump ...
    Initializing disk for crash dump ...
    Beginning dump of physical memory.
    Physical memory dump complete.
    Contact you system administrator or technical support group for further assistance.
  • In the /vmfs/volumes/datastorename/virtualmachinefolder/vmware.log file, you see entries similar to:

    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: ( 1) `A problem has been detected and Windows has been shut down to prevent damage '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: ( 2) `to your computer. '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: ( 4) `If this is the first time you've seen this Stop error screen, '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: ( 5) `restart your computer. If this screen appears again, follow '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: ( 6) `these steps: '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: ( 8) `Disable or uninstall any anti-virus, disk defragmentation '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: ( 9) `or backup utilities. Check your hard drive configuration, '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (10) `and check for any updated drivers. Run CHKDSK /F to check '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (11) `for hard drive corruption, and then restart your computer. '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (13) `Technical information: '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (15) `*** STOP: 0x00000024 (0x00000000001904FB,0xFFFFF88006F62D08,0xFFFFF88006F62560,0'
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (16) `xFFFFF880020B0352) '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (19) `*** Ntfs.sys - Address FFFFF880020B0352 base at FFFFF88002004000, DateStamp'
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (20) ` 52e1be8a '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (23) `Collecting data for crash dump ... '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (24) `Initializing disk for crash dump ... '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (25) `Beginning dump of physical memory. '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (26) `Dumping physical memory to disk: 0 '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (26) `Dumping physical memory to disk: 5 '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (26) `Dumping physical memory to disk: 10 '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (26) `Dumping physical memory to disk: 15 '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (26) `Dumping physical memory to disk: 20 '
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (26) `Dumping physical memory to disk: 25 '
    <YYYY-MM-DD>T<time>Z| vmx| I120: GuestRpcSendTimedOut: message to toolbox timed out.
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (26) `Dumping physical memory to disk: 30 '
    <YYYY-MM-DD>T<time>Z| vmx| I120: Tools: Tools heartbeat timeout.
    <YYYY-MM-DD>T<time>Z| svga| I120: WinBSOD: (26) `Dumping physical memory to disk: 35
    </time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time></time>
  • Analysis of the virtual machine memory dump reports an access violation in vds.exe
  • The affected virtual machine is running one of these VMware Tools versions:

    • 8.6.15
    • 8.6.16
    • 9.0.15
    • 9.4.11
    • 9.10.0
    • 9.4.12
For more information on determining the VMware Tools version installed, see Verifying a VMware Tools build version (1003947).

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.


Environment

VMware vSphere ESXi 5.0
VMware vSphere ESXi 6.0
VMware vSphere ESXi 5.1
VMware vSphere ESXi 5.5

Resolution

This is a known issue affecting VMware vSphere ESXi 5.x and 6.0.

This issue is resolved in:
To work around this issue, perform one of these options:
  • Disable snapshot quiescing within your backup solution.
  • Do not select Quiesce guest file system when taking a snapshot of a virtual machine from the vSphere Client.
  • Downgrade the VMware Tools to previous version that is not affected.


Additional Information

To be alerted when this document is updated, click the Subscribe to Article link in the Actions box..

Bugcheck Analysis example:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880056a4d08
Arg3: fffff880056a4560
Arg4: fffff880018b3352

Debugging Details:
------------------


EXCEPTION_RECORD: fffff880056a4d08 -- (.exr 0xfffff880056a4d08)
ExceptionAddress: fffff880018b3352 (Ntfs!NtfsReadMftRecord+0x0000000000000082)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000018
Attempt to read from address 0000000000000018

CONTEXT: fffff880056a4560 -- (.cxr 0xfffff880056a4560)
rax=000000000381d000 rbx=000000000381cc00 rcx=000000000000000a
rdx=fffff880056a5040 rsi=fffffa80040be8b0 rdi=0000000000000000
rip=fffff880018b3352 rsp=fffff880056a4f40 rbp=0000000000000080
r8=0000000000000400 r9=0000000000000001 r10=0000000000000004
r11=fffff880056a4fe8 r12=fffffa8002550180 r13=fffff8a00decdb48
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
Ntfs!NtfsReadMftRecord+0x82:
fffff880`018b3352 493b4618 cmp rax,qword ptr [r14+18h] ds:002b:00000000`00000018=????????????????
Resetting default scope

PROCESS_NAME: vds.exe

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000018

READ_ADDRESS: 0000000000000018

FOLLOWUP_IP:
Ntfs!NtfsReadMftRecord+82
fffff880`018b3352 493b4618 cmp rax,qword ptr [r14+18h]

FAULTING_IP:
Ntfs!NtfsReadMftRecord+82
fffff880`018b3352 493b4618 cmp rax,qword ptr [r14+18h]

BUGCHECK_STR: 0x24

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from fffff880018aeefc to fffff880018b3352

STACK_TEXT:
fffff880`056a4f40 fffff880`018aeefc : fffffa80`040be8b0 fffffa80`02550180 fffff8a0`0decdb48 00000000`00000001 : Ntfs!NtfsReadMftRecord+0x82
fffff880`056a4ff0 fffff880`018bcb18 : fffff8a0`14267010 fffff8a0`0decdc70 fffff880`056a5400 fffff880`056a5200 : Ntfs!NtfsLookupInFileRecord+0x6c
fffff880`056a5080 fffff880`018a34d9 : fffffa80`040be8b0 fffff880`056a5400 fffffa80`040be8b0 fffff8a0`0decdb40 : Ntfs!NtfsWriteFileSizes+0xa8
fffff880`056a51e0 fffff880`018aa81c : fffffa80`040be8b0 fffff8a0`0decdc70 fffff8a0`0decdb40 fffffa80`02550180 : Ntfs!NtfsCommonClose+0x559
fffff880`056a52b0 fffff880`013aabcf : fffff880`056a5400 fffffa80`035c6ab0 fffff880`056a5401 00000000`00000005 : Ntfs!NtfsFsdClose+0x2dc
fffff880`056a53b0 fffff880`013a96df : fffffa80`041c86c0 fffffa80`035c6ab0 fffffa80`01b71500 fffffa80`035c6ab0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`056a5440 fffff800`0198928e : fffffa80`043358b0 fffffa80`032d0420 00000000`00000000 fffffa80`041c86c0 : fltmgr!FltpDispatch+0xcf
fffff880`056a54a0 fffff800`01693f34 : 00000000`00000001 fffff880`056a5960 fffffa80`018ad080 00000000`00000000 : nt!IopDeleteFile+0x11e
fffff880`056a5530 fffff880`018c5116 : fffff880`056a5960 fffff8a0`0decdc70 fffff8a0`0decdb00 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`056a5590 fffff880`018f3290 : fffff8a0`0decdc70 fffff880`056a5960 fffff8a0`0decdb40 fffffa80`02550180 : Ntfs!NtfsDeleteInternalAttributeStream+0x106
fffff880`056a55e0 fffff880`018d465f : fffffa80`0340f010 fffffa80`02550180 fffff880`056a5900 fffffa80`035c8a01 : Ntfs!NtfsPerformDismountOnVcb+0x2c0
fffff880`056a56f0 fffff880`018d43ee : fffffa80`02550101 fffffa80`02550180 00000000`00000000 fffffa80`0253bce0 : Ntfs!NtfsLockVolumeInternal+0xff
fffff880`056a5770 fffff880`018c0fe3 : fffffa80`0340f010 00000000`00000001 fffffa80`041c8600 fffffa80`02550180 : Ntfs!NtfsLockVolume+0x1fe
fffff880`056a5840 fffff880`018c12fd : fffffa80`0340f010 00000000`00000000 fffff880`056a5960 00000000`00000000 : Ntfs!NtfsUserFsRequest+0x1b3
fffff880`056a5880 fffff880`013aabcf : fffff880`056a59d0 fffffa80`035c87f0 fffff880`056a5901 fffffa80`0340f010 : Ntfs!NtfsFsdFileSystemControl+0x13d
fffff880`056a5920 fffff880`013ca95e : fffffa80`041c86c0 fffffa80`03731960 fffffa80`041c8600 fffffa80`035c87f0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`056a59b0 fffff800`019a9b37 : fffffa80`03731960 fffff880`056a5ca0 fffffa80`035c8b00 fffffa80`035c87f0 : fltmgr!FltpFsControl+0xee
fffff880`056a5a10 fffff800`01966142 : fffffa80`043d9270 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`056a5b40 fffff800`01689153 : fffff880`056a5ca0 00000000`00000000 00000000`00000000 fffff800`01983600 : nt!NtFsControlFile+0x56
fffff880`056a5bb0 00000000`77b0164a : 000007fe`fd8bec28 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00efe228 000007fe`fd8bec28 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!ZwFsControlFile+0xa
00000000`00efe230 00000000`778a5cff : 00000000`00090018 00000000`00000000 000073f9`ec14a8ad 000007fe`f44993ff : KERNELBASE!DeviceIoControl+0xec
00000000`00efe2a0 000007fe`f449ee60 : 00000000`00000000 00000000`00000000 00000000`000001c4 00000000`00000101 : kernel32!DeviceIoControlImplementation+0x7f
00000000`00efe2f0 000007fe`f449ef0f : 00000000`00108c01 00000000`00000000 00000000`00000000 00000000`000001c4 : vdsutil!LockVolume+0x64
00000000`00efe350 00000000`ff2a6b79 : 00000000`00108c40 00000000`002dc7d8 000007fe`f4491a70 000007fe`00000000 : vdsutil!LockDismountVolume+0x3b
00000000`00efe3b0 000007fe`ff5efe85 : 00000000`002dc7d8 00000000`00000000 00000000`00000003 000007fe`ff5efe46 : vds!CVdsVolume::Dismount+0x2b1
00000000`00efe490 000007fe`ff69b68e : 00000000`00000003 00000000`00142080 000007fe`f5626d38 00000000`00117050 : RPCRT4!Invoke+0x65
00000000`00efe4f0 000007fe`ff5f2356 : 00000000`00efeb58 00000000`0010ad50 00000000`00000000 00000000`00efebb0 : RPCRT4!Ndr64StubWorker+0x61b
00000000`00efeab0 000007fe`ff040883 : 00000000`00000000 00000000`00000000 000007fe`f5634960 00000000`0010b290 : RPCRT4!NdrStubCall3+0xb5
00000000`00efeb10 000007fe`ff040ccd : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : ole32!CStdStubBuffer_Invoke+0x5b [d:\w7rtm\com\rpc\ndrole\stub.cxx @ 1586]
00000000`00efeb40 000007fe`ff040c43 : 00000000`00117050 00000000`0016c254 00000000`00118d20 00000000`ff254a60 : ole32!SyncStubInvoke+0x5d [d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1187]
00000000`00efebb0 000007fe`feefa4f0 : 00000000`00117050 00000000`00116bc0 00000000`00117050 00000000`00000000 : ole32!StubInvoke+0xdb [d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1396]
00000000`00efec60 000007fe`ff0414d6 : 00000000`00000000 00000000`00000010 00000000`0016ebf0 00000000`0010b290 : ole32!CCtxComChnl::ContextInvoke+0x190 [d:\w7rtm\com\ole32\com\dcomrem\ctxchnl.cxx @ 1262]
00000000`00efedf0 000007fe`ff04122b : 00000000`d0908070 00000000`00116bc0 00000000`001171b0 00000000`00142080 : ole32!AppInvoke+0xc2 [d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1086]
00000000`00efee60 000007fe`ff03fd6d : 00000000`00116bc0 00000000`00116bc0 00000000`0010b290 00000000`00070005 : ole32!ComInvokeWithLockAndIPID+0x52b [d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1727]
00000000`00efeff0 000007fe`ff5e3134 : 000007fe`ff0a9930 00000000`00000000 00000000`00118250 000007fe`ff5dd0d7 : ole32!ThreadInvoke+0x30d [d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 4751]
00000000`00eff090 000007fe`ff5e3296 : 000007fe`ff050ab0 00000000`00000001 00000000`00eff300 000007fe`feed8ffc : RPCRT4!DispatchToStubInCNoAvrf+0x14
00000000`00eff0c0 000007fe`ff5e5ac0 : 00000000`0016c230 00000000`00000000 00000000`00eff3e4 00000000`0016c230 : RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x146
00000000`00eff1e0 000007fe`ff5e59fb : 00000000`00000000 00000000`00eff300 00000000`00eff300 00000000`00118250 : RPCRT4!RPC_INTERFACE::DispatchToStub+0xa0
00000000`00eff220 000007fe`ff5e5992 : 00000000`0016c230 00000000`0016c230 00000000`0016c230 000007fe`ff5e44a0 : RPCRT4!RPC_INTERFACE::DispatchToStubWithObject+0x5b
00000000`00eff2a0 000007fe`ff5e366d : 00000000`00000001 00000000`00000000 000007fe`ff5c0000 00000000`0016c230 : RPCRT4!LRPC_SCALL::DispatchRequest+0x42c
00000000`00eff380 000007fe`ff623d96 : 00000000`00115910 00000000`00115910 00000000`00115910 00000000`00000000 : RPCRT4!LRPC_SCALL::HandleRequest+0x20d
00000000`00eff4b0 000007fe`ff623be0 : 00000000`00000000 00000000`00118100 00000000`00000004 00000000`00000000 : RPCRT4!LRPC_SASSOCIATION::HandleRequest+0xf6
00000000`00eff520 000007fe`ff5e3441 : 00000000`001084a0 00000000`00111740 00000000`001084a0 40000000`00000000 : RPCRT4!LRPC_ADDRESS::HandleRequest+0x100
00000000`00eff5a0 000007fe`ff600485 : 00000000`00000000 00000000`001115d0 00000000`00000000 00000000`00000000 : RPCRT4!LRPC_ADDRESS::ProcessIO+0x500
00000000`00eff6a0 00000000`77acb6bb : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : RPCRT4!LrpcIoComplete+0xa5
00000000`00eff730 00000000`77acff2f : 00000000`00000000 00000000`00000000 00000000`0000ffff 00000000`00000000 : ntdll!TppAlpcpExecuteCallback+0x26b
00000000`00eff7c0 00000000`778a59ed : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!TppWorkerThread+0x3f8
00000000`00effac0 00000000`77adc541 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`00effaf0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d

Verifying a VMware Tools build version
VMware ESXi 5.0, Patch Release ESXi500-201510001
VMware ESXi 5.1, Patch Release ESXi510-201510001
VMware ESXi 6.0, Patch ESXi600-201507403-BG: Updates tools-light
静默操作导致 Windows 虚拟机 ntfs.sys 中出现 Stop 24 严重错误
静止操作を行うと ntfs.sys に関する Stop エラー 24 が発生して、Windows 仮想マシンがパニックになる

Powered by Wolken Software