Hello list.

Our mailserver abends 26 times this day.
I think, I need a little help here.
Hardware HP Proliant DL 360 G3, 3GB RAM , 72,8 GB HDD
OS: NW 6.5 Sp8
with GW 8.0.0 HP2
1 POA, 1 Domain, 1 Webacc, 1 Gwia
Gwava 4.5
Redline 3.10
BackupExec 11d Client
Messenger 2.0.4
Tobit Faxware 7

The address space from the gwia was removed, memory violation on leter
abends.

Here is the first abend:
Novell Open Enterprise Server, NetWare 6.5
PVER: 6.50.08

Address space GWIA removed Monday, 10 August 2009 11.05.22,408
Abend 0 on P00: Server-5.70.08: Free detected node 0xCF795AC0 has already
been freed

Registers:
CS = 0008 DS = 0023 ES = 0023 FS = 0023 GS = 0023 SS = 0010
EAX = B0437978 EBX = CE7A1548 ECX = 00000035 EDX = 00000000
ESI = CE7A1548 EDI = B0437978 EBP = B0437B94 ESP = B0437968
EIP = 94AA7CF8 FLAGS = 00000246
94AA7CF8 83C40C ADD ESP, 0000000C
EIP in UNKNOWN memory area

The violation occurred while processing the following instruction:
94AA7CF8 83C40C ADD ESP, 0000000C
94AA7CFB 81C400020000 ADD ESP, 00000200
94AA7D01 5F POP EDI
94AA7D02 5E POP ESI
94AA7D03 5B POP EBX
94AA7D04 C3 RET
SYSCALLS.NLM|MARSHAL_AccountCharge:
94AA7D05 53 PUSH EBX
94AA7D06 56 PUSH ESI
94AA7D07 0FB7742424 MOVZX ESI, word ptr [ESP+24]
94AA7D0C 89F3 MOV EBX, ESI



Running process: Server 00:44 Process
Thread Owned by NLM: SERVER.NLM
Stack pointer: B0437968
User Space Stack limit: 0
Scheduling priority: 67371008
Wait state: 50500F0 Waiting for work
Stack: 94AA7CF8 (SYSCALLS.NLM|MARSHAL_Abend+83)
--00000191 (LOADER.NLM|KernelAddressSpace+191)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--B0437978 ?
--65657246 ?
--74656420 ?
--65746365 ?
--6F6E2064 ?
--30206564 ?
--37464378 ?
--43413539 ?
--61682030 ?
--6C612073 ?
--64616572 ?
--65622079 ?
--66206E65 ?
--64656572 ?
--000CF700 ?
--B0437A18 ?
002E5879 (SERVER.NLM|OutputToString+2869)
--0000CF79 (LOADER.NLM|KernelAddressSpace+CF79)
--00000010 (LOADER.NLM|KernelAddressSpace+10)
--B0437A18 ?
--00000010 (LOADER.NLM|KernelAddressSpace+10)
--00CF795A ?
--B0437A18 ?
002E5879 (SERVER.NLM|OutputToString+2869)
--000CF795 ?
--00000010 (LOADER.NLM|KernelAddressSpace+10)
--B0437A18 ?
--00000010 (LOADER.NLM|KernelAddressSpace+10)
--0CF795AC ?
--B0437A18 ?
002E5879 (SERVER.NLM|OutputToString+2869)
--00CF795A ?
--00000010 (LOADER.NLM|KernelAddressSpace+10)
--B0437A18 ?
--B0437A18 ?
002E3CB0 (SERVER.NLM|OutputToString+CA0)
--00000010 (LOADER.NLM|KernelAddressSpace+10)
--00000008 (LOADER.NLM|KernelAddressSpace+8)
002E3B6B (SERVER.NLM|OutputToString+B5B)
--00000030 (LOADER.NLM|KernelAddressSpace+30)
--B0437B3C ?
--39374643 ?
--30434135 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--5547F960 ?
--01D8F665 ?
--464D0180 ?
--B91BF2F8 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--0016AC25 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--CE7A1164 ?
--B0437B14 ?
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--CE7A118F ?
--0000000C (LOADER.NLM|KernelAddressSpace+C)
--00000481 (LOADER.NLM|KernelAddressSpace+481)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
-F53501B8 (USERLIB.NLM|(Data Start)+1B8)
--04FD5800 ?
--04FD5A00 ?
--04FD5A00 ?
--04FD5E00 ?
--CF795AC0 ?
--00000010 (LOADER.NLM|KernelAddressSpace+10)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--0000000C (LOADER.NLM|KernelAddressSpace+C)
--00020000 (LOADER.NLM|BIOSDriveCount+5E90)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000000 (LOADER.NLM|KernelAddressSpace+0)
--00000008 (LOADER.NLM|KernelAddressSpace+8)

Additional Information:
The NetWare OS detected a problem with the system while executing a
process owned by SYSCALLS.NLM. It may be the source of the problem or there
may have been a memory corruption.

Loaded Modules:
GWIA.NLM GroupWise Internet Agent (release version)
Version 8.00 13 May 2009
Code Address: F44B6000h Length: 00283FE6h
Data Address: F4435000h Length: 0007FB30h
SCCDA.NLM HTML Export Data Access Module
Version 8.20 7 March 2008
Code Address: F4740000h Length: 000097F0h
Data Address: F473C000h Length: 000024A0h
SCCFA.NLM HTML Export Filter Access Module
Version 8.20 26 February 2008
Code Address: F474D000h Length: 00003F90h
Data Address: F474B000h Length: 00000670h
SCCCH.NLM HTML Export Chunker Module
Version 8.20 26 February 2008
Code Address: F4755000h Length: 0000AD30h
Data Address: F4753000h Length: 00000680h
SCCFI.NLM HTML Export File Identification Module
Version 8.20 26 February 2008
Code Address: F4767000h Length: 00012BC0h
Data Address: F4761000h Length: 00004070h
SCCFUT.NLM HTML Export FUT Module
Version 8.20 26 February 2008
Code Address: F4784000h Length: 000350C0h
Data Address: F477B000h Length: 00007090h
SCCUT.NLM HTML Export Utility Module
Version 8.20 26 February 2008
Code Address: F47E2000h Length: 0004F290h
Data Address: F47BB000h Length: 00025640h
WVCORE.NLM wvcore module
Version 8.20 26 February 2008
Code Address: F4876000h Length: 0000C310h
Data Address: F4833000h Length: 00041240h
NWSNUT.NLM NetWare NLM Utility User Interface
Version 7.00.01 11 July 2008
Code Address: F4887000h Length: 000134EBh
Data Address: F4885000h Length: 00000790h
CALNLM32.NLM NetWare NWCalls Runtime Library
Version 6.01.03 26 August 2008
Code Address: F489F000h Length: 0001CEB9h
Data Address: F489D000h Length: 00000510h
NETNLM32.NLM NetWare NWNet Runtime Library
Version 6.01.03 26 August 2008
Code Address: F48C3000h Length: 00035B77h
Data Address: F48BD000h Length: 00004DA5h
NCPNLM32.NLM NetWare NWNCP Runtime Library
Version 6.01.03 26 August 2008
Code Address: F48FA000h Length: 0001F473h
Data Address: 00000000h Length: 00000000h
GWENN5.NLM GroupWise Engine (release version)
Version 8.00 13 May 2009
Code Address: F49FE000h Length: 00514086h
Data Address: F491B000h Length: 000E18ECh
GWXIS12.NLM XML Integration Service
Version 1.02 13 May 2009
Code Address: F4F87000h Length: 00118282h
Data Address: F4F14000h Length: 0007119Fh
CLIB.NLM (Legacy) Standard C Runtime Library for NLMs
Version 5.90.15 10 March 2008
Code Address: F50A5000h Length: 0001898Eh
Data Address: F50A1000h Length: 00002FB0h
NIT.NLM NetWare Interface Tools Library for NLMs
Version 5.90.15 10 March 2008
Code Address: F50C2000h Length: 0001C694h
Data Address: F50C0000h Length: 00000690h
CLXNLM32.NLM NetWare NWCLX Runtime Library
Version 6.01.03 26 August 2008
Code Address: F50E2000h Length: 000011F3h
Data Address: F50E0000h Length: 000001B0h
LOCNLM32.NLM NetWare NWLocale Runtime Library
Version 6.01.03 26 February 2008
Code Address: F50E7000h Length: 000044BBh
Data Address: F50E5000h Length: 00000B30h
UNICODE.NLM NetWare Unicode Runtime Library (UniLib-based) [optimized]
Version 7.00 26 October 2004
Code Address: F50EF000h Length: 000016F5h
Data Address: F50ED000h Length: 00000504h
CLNNLM32.NLM NetWare NWClient Runtime Library
Version 6.01.03 26 August 2008
Code Address: F50F4000h Length: 00001CC2h
Data Address: F50F2000h Length: 00000150h
NLMLIB.NLM Novell NLM Runtime Library
Version 5.90.15 10 March 2008
Code Address: F50FC000h Length: 000263EDh
Data Address: F50F7000h Length: 000038C0h
REQUESTR.NLM Novell NCP Requestor for NLMs
Version 5.90.15 10 March 2008
Code Address: F5127000h Length: 00020DE3h
Data Address: F5124000h Length: 000010D0h
THREADS.NLM Novell Threads Package for NLMs
Version 5.90.15 10 March 2008
Code Address: F515C000h Length: 00018CF8h
Data Address: F5149000h Length: 000116A0h
LIBC.NLM Standard C Runtime Library for NLMs [optimized, 7]
Version 9.00.05 3 October 2008
Code Address: F527E000h Length: 000D0CD6h
Data Address: F523B000h Length: 000415E0h
USERLIB.NLM NetWare Operating System Function Library
Version 5.60 29 September 2008
Code Address: F5353000h Length: 000048DEh
Data Address: F5350000h Length: 000011F0h
************************************************** *******

Here ends the first abend.
Can I have a problem wit my RAM???

Thanks in advance for your friendly help.

Best regards.

Dirk