You are on page 1of 3

The following is an example how to Read NSD and find out which task/database crashed the server.

The
following NSD is an example from GKR011N. The blue text is actual text from NSD

Open NSD file in windows notepad and search for "fatal" string on Windows platform. (You would search
for "panic" on UNIX platform in vi editor)
############################################################
### FATAL THREAD 11/51 [ nSERVER:0cd0: 2148]
### FP=0x3f76d464, PC=0x77f813b1, SP=0x3f76d340, stksize=292
### EAX=0x3e879a00, EBX=0x00000112, ECX=0x01511d48, EDX=0x010d52de
### ESI=0x00000000, EDI=0x00002822, CS=0x0000001b, SS=0x00000023
### DS=0x00000023, ES=0x00000023, FS=0x00000038, GS=0x00000000 Flags=0x00000246
Exception code: 80000003 (BREAKPOINT)
############################################################
[ 1] 0x77f813b1 ntdll.DbgBreakPoint+0 (1d4b,3f76d49c,3f76d4a0,3f76d490)
@[ 2] 0x600aaf0b nnotes._NIFCGAccess@8+187 (3f76d60e,802,3f76e138,1a9e8e8)
@[ 3] 0x600aa883 nnotes._AddToPrivateQueue@16+531 (3f76e138,0,3f76d5fc,3e879a38)
@[ 4] 0x6088bcff nnotes._AddNameCollectionEntry@48+2271 (3f76e138,0,ffff,3e879a38)
@[ 5] 0x60103c04 nnotes._ProcessDeferredNAB@4+1764 (3e879a38,1,3f76e660,3f76e3ac)
@[ 6] 0x6088f21b nnotes._NextNameDatabase@28+91 (609f00a4,3f76e368,3f76e390,0)
@[ 7] 0x6088f1b2 nnotes._NIFNextNameDatabase@24+34 (609f00a4,3f76e368,3f76e390,0)
@[ 8] 0x6088d3a1 nnotes._NAMEGetNSModifiedTimeExtended@8+625 (e,3f76e660,164,60b91020)
@[ 9] 0x606c8a67 nnotes._GetNameModifiedTime@4+87 (3f76e660,0,0,0)
@[10] 0x606c86fa nnotes._FindNameInGroupCache@4+26 (b5,31d64ecc,1,400)
@[11] 0x606c7576 nnotes._UAFGetAccessGroupsExtend@8+134 (0,b5,3f76f910,1001e0d2)
@[12] 0x606c74de nnotes._UAFGetAccessGroups@4+14 (b5,31d64f72,31d64ecc,1a60000)
@[13] 0x1001e0d2 nserverl._CreateNamesList@8+498 (3edf0000,3f76fe00,5f9c002e,31d64ecc)
@[14] 0x1001bcc2 nserverl._DoSessionMessage@8+450 (10d64ecc,1af46cf4,251c0000,31d64ecc)
@[15] 0x1001b26b nserverl._ReceiveComplete@8+315 (31d64ecc,1af46cf4,1af46cf4,c59313a)
@[16] 0x100194b7 nserverl._DbServer@8+1175 (aab80074,4de80001,0,31d61444)
@[17] 0x1002c1f8 nserverl._WorkThreadTask@8+1576 (3edf0e90,0,3,60044594)
@[18] 0x100016cb nserverl._Scheduler@4+763 (0,60044594,0,3f06fac4)
@[19] 0x60114924 nnotes._ThreadWrapper@4+212 (0,3f06fac4,60044594,0)
[20] 0x7c57b388 KERNEL32.lstrcmpiW+183

############################################################
### PASS 2 : FATAL THREAD with STACK FRAMES 11/51 [ nSERVER:0cd0: 2148]

In this case we found [nServer:0cd0:2148]. We know for sure that server crashed on nserver which is
server thread iteself, but we are trying to identify something more i.e, the database which has caused the
crash.
0cd0 is the process id and 2148 is physical thread id.
We now have to find out corresponding virtual thread.

Now you have to search for "TLS Mapping" in nsd file. In notepad press F3 key 3 times to go to following
text in NSD
(This is called process table)
look for the line that has process id and and Physical thread like below :-

** Detach from process [nNOTESMM:0d14]


** Attach to process [ nSERVER:0cd0]
** Using Glob block map
Found Memcheck symbol @60c0a580
------ TLS Mapping -----
NativeTID VirtualTID PrimalTID
[ nSERVER:0cd0: 2528] [ nSERVER:0cd0: 2] [ nSERVER:0cd0: 2]
[ nSERVER:0cd0: 1660] [ nSERVER:0cd0] [ nSERVER:0cd0: 4]
[ nSERVER:0cd0: 2036] [ nSERVER:0cd0: 5] [ nSERVER:0cd0: 5]
[ nSERVER:0cd0: 600] [ nSERVER:0cd0: 6] [ nSERVER:0cd0: 6]
[ nSERVER:0cd0: 2388] [ nSERVER:0cd0: 7] [ nSERVER:0cd0: 7]
[ nSERVER:0cd0: 3224] [ nSERVER:0cd0] [ nSERVER:0cd0: 8]
[ nSERVER:0cd0: 1512] [ nSERVER:0cd0] [ nSERVER:0cd0: 9]
[ nSERVER:0cd0: 1704] [ nSERVER:0cd0: 10] [ nSERVER:0cd0: 10]
[ nSERVER:0cd0: 3212] [ nSERVER:0cd0] [ nSERVER:0cd0: 11]
[ nSERVER:0cd0: 940] [ nSERVER:0cd0] [ nSERVER:0cd0: 12]
[ nSERVER:0cd0: 2472] [ nSERVER:0cd0: 882] [ nSERVER:0cd0: 13]
[ nSERVER:0cd0: 936] [ nSERVER:0cd0: 144] [ nSERVER:0cd0: 14]
[ nSERVER:0cd0: 2340] [ nSERVER:0cd0: 866] [ nSERVER:0cd0: 15]
[ nSERVER:0cd0: 620] [ nSERVER:0cd0: 856] [ nSERVER:0cd0: 16]
[ nSERVER:0cd0: 2148] [ nSERVER:0cd0: 128] [ nSERVER:0cd0: 17]
[ nSERVER:0cd0: 3172] [ nSERVER:0cd0: 868] [ nSERVER:0cd0: 18]
[ nSERVER:0cd0: 2552] [ nSERVER:0cd0: 849] [ nSERVER:0cd0: 19]
[ nSERVER:0cd0: 3496] [ nSERVER:0cd0: 883] [ nSERVER:0cd0: 20]
[ nSERVER:0cd0: 3360] [ nSERVER:0cd0: 807] [ nSERVER:0cd0: 21]
[ nSERVER:0cd0: 2628] [ nSERVER:0cd0: 874] [ nSERVER:0cd0: 22]
[ nSERVER:0cd0: 152] [ nSERVER:0cd0: 860] [ nSERVER:0cd0: 23]
[ nSERVER:0cd0: 3344] [ nSERVER:0cd0: 887] [ nSERVER:0cd0: 24]
[ nSERVER:0cd0: 3376] [ nSERVER:0cd0: 196] [ nSERVER:0cd0: 25]
[ nSERVER:0cd0: 2328] [ nSERVER:0cd0: 876] [ nSERVER:0cd0: 26]
[ nSERVER:0cd0: 2324] [ nSERVER:0cd0: 140] [ nSERVER:0cd0: 27]
[ nSERVER:0cd0: 1380] [ nSERVER:0cd0: 871] [ nSERVER:0cd0: 28]
[ nSERVER:0cd0: 1776] [ nSERVER:0cd0: 29] [ nSERVER:0cd0: 29]
[ nSERVER:0cd0: 652] [ nSERVER:0cd0: 243] [ nSERVER:0cd0: 30]
[ nSERVER:0cd0: 648] [ nSERVER:0cd0: 853] [ nSERVER:0cd0: 31]

In this case the virutal thread id is 128


Now go back to the top of the NSD and then search for the string "open databases" in nsd file.
(This is called open database table)
Look for the process id that we found earlier and the Virtual Thread id i,e, 0cd0 and 128 like below :-

G:\Lotus\Domino\Data\mail1.box
Version = 43.0
SizeLimit = 0, WarningThreshold = 0
ReplicaID = c1256f2d:00364d2c
bContQueue = NSFPool [ 1: 62884]
FDGHandle = 0xf01c1338, RefCnt = 4, Dirty = Y
DB Sem = (FRWSEM:0x0244) state=0, waiters=0, refcnt=0, nlrdrs=0 Writer=[]
SemContQueue ( RWSEM:#0:0x029d) rdcnt=-1, refcnt=0 Writer=[] n=0, wcnt=-1, Users=-1,
Owner=[]
By: [ nSERVER:0cd0: 8] DBH= 73, User=
By: [ nSMTP:0a48: 8] DBH= 238, User=
By: [ nntask:08d8: 2] DBH= 372, User=CN=GKR011N/OU=KR/O=Gillette
By: [ nSMTP:0a48: 10] DBH= 1431, User=
CN=GBO650N/O=CollabTools!!names.nsf
Version = 43.0
SizeLimit = 0, WarningThreshold = 0
ReplicaID = 85256d26:0060fb2e
bContQueue = NSFPool [ 0:4294967295]
FDGHandle = 0x00000000, RefCnt = 89, Dirty = Y
DB Sem = (FRWSEM:0x0244) state=0, waiters=0, refcnt=0, nlrdrs=0 Writer=[]
SemContQueue ( RWSEM:#0:0x029d) rdcnt=-1, refcnt=0 Writer=[] n=0, wcnt=-1, Users=-1,
Owner=[]
By: [ nSERVER:0cd0: 128] DBH= 740, User=CN=GKR011N/OU=KR/O=Gillette
By: [ nSERVER:0cd0: 165] DBH= 1811, User=CN=GKR011N/OU=KR/O=Gillette
By: [ nSERVER:0cd0: 5] DBH= 50, User=CN=GKR011N/OU=KR/O=Gillette
By: [ nSERVER:0cd0: 5] DBH= 65, User=CN=GKR011N/OU=KR/O=Gillette
By: [ nSERVER:0cd0: 5] DBH= 85, User=CN=GKR011N/OU=KR/O=Gillette
By: [ nSERVER:0cd0: 5] DBH= 94, User=CN=GKR011N/OU=KR/O=Gillette
By: [ nSMTP:0a48: 4] DBH= 167, User=CN=GKR011N/OU=KR/O=Gillette
By: [ nSMTP:0a48: 4] DBH= 222, User=CN=GKR011N/OU=KR/O=Gillette

from the above text we have identified that server crashed on mail1.box