Hi All,

We have Groupwise 7 sp 2 running on a netware 6.5 sp7 server.
The server has abended a couple of times in the last couple weeks and I would l;ike some help with interpreting the abend log. The problem appears to be with the GWIA, but I am not sure where to begin with locating a cause.

Below is an excerpt of the abend log:

************************************************** ***********
Novell Open Enterprise Server, NetWare 6.5
PVER: 6.50.07

Server LAWMAIL halted Tuesday, June 9, 2009 1:23:50.508 pm
Abend 1 on P02: Server-5.70.07: Page Fault Processor Exception (Error code 00000000)

Registers:
CS = 0008 DS = 0010 ES = 0010 FS = 0010 GS = 0023 SS = 0010
EAX = 000053B4 EBX = 53B40540 ECX = 000053B4 EDX = 527A3600
ESI = 53B40540 EDI = 000053B4 EBP = 50400C4C ESP = 50400C38
EIP = A5937981 FLAGS = 00010206
A5937981 8B4104 MOV EAX, [ECX+04]=?
EIP in GWIA.NLM at code start +00112981h
Access Location: 0x000053B8

The violation occurred while processing the following instruction:
A5937981 8B4104 MOV EAX, [ECX+04]
A5937984 89E5 MOV EBP, ESP
A5937986 89EC MOV ESP, EBP
A5937988 5D POP EBP
A5937989 C3 RET
A593798A 0000 ADD [EAX], AL
A593798C 0000 ADD [EAX], AL
A593798E 0000 ADD [EAX], AL
GWIA.NLM|?getProps_NgwiCalSelect__QAEPAVNgwRmLinkL ist__XZ:
A5937990 55 PUSH EBP
A5937991 8B4120 MOV EAX, [ECX+20]



Running process: GWIMAP-Handler_5 Process
Thread Owned by NLM: GWIA.NLM
Stack pointer: 5040060C
OS Stack limit: 503F20C0
Scheduling priority: 67371008
Wait state: 3030070 Yielded CPU
Stack: --50400C4C ?
A595D7FA (GWIA.NLM|?Add_NgwRmLinkList__QAEXPAVNgwCollectabl e___Z+3A)
-A5A6CBB0 (GWIA.NLM|??_7NgwRmRecievedHFParser__6B_+8)
--53B40540 ?
--53B40005 ?
--50400C58 ?
A58F37E1 (GWIA.NLM|?Add_NgwRmKeyWordHF__QAEXPAVNgwRmEnumStr ___Z+11)
--53B40540 ?
--50400C80 ?
A58F378B (GWIA.NLM|?Parse_NgwRmTokenParser__UAEKPAVNgwRmHea derField___Z+DB)
--53B40540 ?
A59652D7 (GWIA.NLM|??0NgwRmReceivedHF__QAE_PAVNgwRmHeader__ PAVNgwRmEnumStr__PAVNgwRmHeaderFieldParser___Z+17)
--5CDED3C0 ?
--A5B20440 ?
--527A3600 ?
--527A3600 ?
--A5B20440 ?
-A5A6CCA0 (GWIA.NLM|??_7NgwRmReceivedHF__6B_+8)
--50400CB8 ?
A59640DD (GWIA.NLM|?Parse_NgwRmRecievedHFParser__UAEKPAVNgw RmHeaderField___Z+FD)
--527A3600 ?
-A5A64C90 (GWIA.NLM|??_7NgwRmBufIStream__6B_+8)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--527A3600 ?
A5958B4C (GWIA.NLM|?CreateHeaderField_NgwRmHeaderRegistry__ QAEPAVNgwRmHeaderField__PAVNgwRmHeader__PAEG_Z+2C)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--53B40040 ?
-A5A6C404 (GWIA.NLM|??_7NgwRmMimePipe__6B_+8)
--50400CB8 ?
--5CDED3C0 ?
--527A3600 ?
-A5A6CBB0 (GWIA.NLM|??_7NgwRmRecievedHFParser__6B_+8)
--50400CD0 ?
A595CD71 (GWIA.NLM|?ParseSelf_NgwRmHeaderField__UAEKXZ+21)
--527A3600 ?
-A5A6C450 (GWIA.NLM|??_7NgwRmTextHF__6B_+8)
-A5A6CCA0 (GWIA.NLM|??_7NgwRmReceivedHF__6B_+8)
--50400D1C ?
--50400CE0 ?
A59645BB (GWIA.NLM|?Parse_NgwRmAuxHFParser__QAEKGPAEK_Z+AB)
-A5A6C450 (GWIA.NLM|??_7NgwRmTextHF__6B_+8)
--50400D1C ?
--50400CF8 ?
A5964667 (GWIA.NLM|?MakeHF_NgwRmAuxHFParser__QAEPAVNgwRmHea derField__GPAEK_Z+17)
--00000034 (LOADER.NLM|KernelAddressSpace+34)
--52A62D20 ?
--00000067 (LOADER.NLM|KernelAddressSpace+67)
--583B3B80 ?
--50400D38 ?
A5964081 (GWIA.NLM|?Parse_NgwRmRecievedHFParser__UAEKPAVNgw RmHeaderField___Z+A1)
--00000034 (LOADER.NLM|KernelAddressSpace+34)
--52A62D20 ?
--00000067 (LOADER.NLM|KernelAddressSpace+67)
--50400D28 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--483FC420 ?
--53B40920 ?
-A5A6CB58 (GWIA.NLM|??_7NgwRmAuxHFParser__6B_+8)
--527A3600 ?
--5CDED3C0 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--5CDED460 ?
--483FC420 ?
-A5A6CBB0 (GWIA.NLM|??_7NgwRmRecievedHFParser__6B_+8)
--50400D50 ?
A595CD71 (GWIA.NLM|?ParseSelf_NgwRmHeaderField__UAEKXZ+21)
--483FC420 ?
--00000005 (LOADER.NLM|KernelAddressSpace+5)
-A5A6CCA0 (GWIA.NLM|??_7NgwRmReceivedHF__6B_+8)
--5CDED460 ?
--50400D7C ?
A595967C (GWIA.NLM|?ParseSelf_NgwRmHeader__UAEKH_Z+15C)
--583B3C40 ?
--53B40160 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--53B40005 ?
--483FC420 ?
--A5B28A00 ?
--A5B28A60 ?
-A5A6C359 (GWIA.NLM|??_7NgwRmHeader__6B_+8)
--583B3940 ?
--50400DA4 ?
A595A198 (GWIA.NLM|?ParseSelf_NgwRmMimeEntity__UAEKXZ+48)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--583B3940 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--5CDED460 ?
A5959F1D (GWIA.NLM|??0NgwRmMimeEntity__QAE_PAVNgwRmSkeleton ___Z+D)
--A5B28A60 ?
-A5A6C301 (GWIA.NLM|??_7NgwRmMimeEntity__6B_+8)
--5C7752C0 ?
--50400DB4 ?
A5959311 (GWIA.NLM|?ParseSelf_NgwRmSkeleton__QAEKXZ+41)
--50400E08 ?
--5C7752C0 ?
--50400DC8 ?
A58F32B2 (GWIA.NLM|?CreateSkeleton_NgwRmMimeParser__QAEKPAV NgwRmStreamSource__PAPAVNgwRmSkeleton___Z+32)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--410FBCA0 ?
--50400E08 ?

Additional Information:
The CPU encountered a problem executing code in GWIA.NLM. The problem may be in that module or in data passed to that module by a process owned by GWIA.NLM.

Loaded Modules:
VS.NLM GWAVA - AntiVirus Agent for GroupWise (build 393)
Version 3.70 January 17, 2007
Code Address: 4922A000h Length: 0009876Bh
Data Address: 492ED000h Length: 0004D1BCh

************************************************** ***********


Your advise is appreciated.

Regards
Alan