Hello,

I have five servers in a backup set. All servers are NW6 SP5 with TSA5UP18 installed. Backup software is BackupExec 9.1 1127. All servers run McAfee Netshield 4.6.3 scanning incoming only and full scans every Sunday. The Backup server and two of the remotes run with no problems. 2 of the remotes abend every few days during backups, and only during backups. The two servers that are abending are also the oldest two servers and have seen numerous upgrades. They started as 4.11 upgraded to 5.1 upgraded to 6.0. Neither server has hyper threading. Other than that there is nothing unique about these two servers. both are simply file and print servers, one host the ZFD database.

Shutting off the Virus Defense is not an option here. We are a college and students have access to these servers. Any suggestions or ideas will be appreciated.

Typical abend log:


Server FSTUDENT halted Tuesday, December 27, 2005 1:30:14.993 am
Abend 1 on P00: Server-5.60.05-4348: Kernel detected an attempted context switch when it was not allowed

Registers:
CS = 0008 DS = 0010 ES = 0010 FS = 0010 GS = 0010 SS = 0010
EAX = 00000000 EBX = 00000001 ECX = 00000000 EDX = FCE23FAC
ESI = 942A5360 EDI = C8893AA0 EBP = 4D1A58E0 ESP = C889393C
EIP = 0021FE28 FLAGS = 00000002
0021FE28 83C404 ADD ESP,00000004
EIP in SERVER.NLM at code start +00018408h

The violation occurred while processing the following instruction:
0021FE28 83C404 ADD ESP,00000004
0021FE2B 5D POP EBP
0021FE2C 5E POP ESI
0021FE2D 5B POP EBX
0021FE2E C3 RET
0021FE2F A19447E0FC MOV EAX,[FCE04794]=FCE25BB7
0021FE34 50 PUSH EAX
0021FE35 E86C07EFFF CALL SERVER.NLM|Abend
0021FE3A 83C404 ADD ESP,00000004
0021FE3D 5D POP EBP



Running process: TSA Open: 97F526C0 Process
Thread Owned by NLM: SERVER.NLM
Stack pointer: C88936F4
OS Stack limit: C888C040
CPU 0 (Thread C888A480) is in a NO SLEEP state
Scheduling priority: 67371008
Wait state: 5050100 Delayed
Stack: --FCE23FAC ?
--4D1A58E0 ?
--942A5360 ?
--C88939D4 ?
0021DD90 (SERVER.NLM|SchedSwitch+48)
--00000001 ?
--4D1A58E0 ?
--C8893AA0 ?
--942A5360 ?
--C88939D4 ?
0032C0DB (SERVER.NLM|RescheduleLastWithDelay+EB)
--00000000 ?
00216554 (SERVER.NLM|StartTempHandicappedThreadAgain+0)
--FFFFFFFF (LOADER.EXE|KernelTempAliasesEnd+FFF)
--C888A480 ?
--4D1A58E0 ?
--942A5360 ?
--C88939B0 ?
0032BFCA (SERVER.NLM|CRescheduleLastWithDelay+6)
--00000202 ?
C8B48991 (THREADS.NLM|ThreadSwitchWithDelay+5)
9415F5B5 (NETSHLD.NLM|REG_Open+B5)
--C88939EC ?
--00000000 ?
000139B0 (LOADER.EXE|PnFarJumpFixup+709)
--98F2B400 ?
--00000000 ?
--9B4E8581 ?
--C8893A74 ?
--C88939DC ?
9416053B (NETSHLD.NLM|REG_IsSessionStampingDisabled+3B)
--C88939D4 ?
--00000002 ?
--00000000 ?
--9B4E8580 ?
--00000000 ?
--00000000 ?
--00000000 ?
--98F2B400 ?
--00000000 ?
--C88939EC ?
941A858D (NETSHLD.NLM|RefreshSessionStampMode+2D)
--90D61880 ?
--43B0DF77 ?
--C88939F4 ?
941A85C8 (NETSHLD.NLM|IsSessionStampingEnabled+8)
--C8893A10 ?
9418186C (NETSHLD.NLM|ProcessPostOpen+C)
--C8893A78 ?
--00000001 ?
--9B4E8580 ?
--00002000 ?
--C8893A74 ?
--C8893A30 ?
94181AFD (NETSHLD.NLM|WatchPostOpen+3D)
--00000000 ?
-0001A63A (LOADER.EXE|startPublicList+842)
--0000005E ?
--00000000 ?
--80000009 ?
--FFFFFFA1 (LOADER.EXE|KernelTempAliasesEnd+FA1)
--C8893C68 ?
C8B32FCC (THREADS.NLM|_DestroyCallBackBlock+260)
--C8893AA0 ?
--00000000 ?
--FFFFFFFF (LOADER.EXE|KernelTempAliasesEnd+FFF)
--C8893C68 ?
--00000006 ?
--0000005E ?
--FFFFFFA1 (LOADER.EXE|KernelTempAliasesEnd+FA1)
C8B31591 (THREADS.NLM|__CHK+21)
--942A5360 ?
--C8893A60 ?
--00000006 ?
--0000005E ?
--FFFFFFA1 (LOADER.EXE|KernelTempAliasesEnd+FA1)
--C8893C68 ?
C9B7866D (LFS.NLM|FSMonitorExit+25)
--C8893AA0 ?
--00000000 ?
--00000000 ?
--00000006 ?
--0000005E ?
--FFFFFFA1 (LOADER.EXE|KernelTempAliasesEnd+FA1)
--C8893C68 ?
--00000000 ?
--9452F040 ?
C9B79123 (LFS.NLM|OpenFile+C6)
CA04548F (NWSA.NSS|ZH_OpenFile+55F)
--0000005E ?
--FFFFFFA1 (LOADER.EXE|KernelTempAliasesEnd+FA1)
--00000004 ?
--0000DB0C ?
--00000000 ?
--00000000 ?
--00000000 ?
--00000006 ?
--80000009 ?
--00000000 ?
--C8893CAC ?

Additional Information:
The NetWare OS detected a problem with the system while executing a process owned by SERVER.NLM. It may be the source of the problem or there may have been a memory corruption.




Ed Connelly
Briarwood College
connellye@briarwood.edu