question

Bertha-2970 avatar image
0 Votes"
Bertha-2970 asked Docs-4663 answered

Constant LiveKernelEvent 144 error. Regular BSOD

The issue is the following:


Source
Windows

Summary
Hardware error

Date
‎03/‎07/‎2021 01:03

Status
Not reported

Description
A problem with your hardware caused Windows to stop working correctly.

Problem signature
Problem Event Name: LiveKernelEvent
Code: 144
Parameter 1: 3003
Parameter 2: ffffab0340cc55b0
Parameter 3: 40010002
Parameter 4: 0
OS version: 10_0_19043
Service Pack: 0_0
Product: 768_1
OS Version: 10.0.19043.2.0.0.768.101
Locale ID: 6153

(The locale ID differs, sometimes it is 2057).


I wanted to include a minidump but despite having them enabled, there is no folder and nothing appears in the system folder and after a general search for anything even remotely similar to the name needed provided nothing of use.
This issue has been happening everyday since the 21st of June and sometimes crashes my PC directly to a BSOD.
The error on the BSOD always comes up with Stop Code: WHEA_UNCORRECTABLE_ERROR.

Looking it up and seeing it could potentially be a graphics card issue I instantly uninstalled and reinstalled all of my NVIDIA drivers to no avail. The error persists and grows more frustrating.
The following are my PC specs:

Windows 10 Home.
HP Omen Obelisk Desktop 085-0xxx.
Intel Core i7 9700F. CPU @ 3GHz.
16GB RAM available (15.6GB available).

If there is any way to create a minidump or just resolve this in general I would be sincerely appreciative, I'll try and hand over any information possible.



EDIT: I was able to create a log event of a BSOD containing WHEA_UNCTONTROLLABLE_ERROR on the 2nd of this month at https://1drv.ms/u/s!AkNZH3TDQY7zaun4_8QNxaMB3p0?e=qOvERU. Can it be used at all?

windows-10-generalwindows-10-hardware-performance
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

AndreasBaumgarten avatar image
0 Votes"
AndreasBaumgarten answered Bertha-2970 commented

Hi @Bertha-2970 ,

first of all: I would recommend to create a backup/copy of all your data on this computer !

I most cases I know this Stop Code points to 2 different issues:

  • Driver issue

  • Hardware issue

Maybe it's possible to use another fresh disk and try a fresh installation of Windows 10 with default drivers.
If it's not a driver issue than it might be an issue with a hardware component ... Is the computer still under warranty?


(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello and thank you for considering the issues I'm having.
I've already reinstalled Windows recently and there was no BSOD up until having done this. Something tells me reinstalling the Windows OS may have brought this issue to light perhaps through trying to update certain drivers updates, conflicts or, ore likely, a hardware issue. I ultimately have no idea but only theories right now.

0 Votes 0 ·
GaryNebbett avatar image
0 Votes"
GaryNebbett answered Bertha-2970 commented

Hello @Bertha-2970,

A LiveKernelEvent with code 0x144 and Parameter 1 value of 0x3003 indicates that a USB device failed enumeration.

Live Kernel Events create a memory dump without stopping/crashing the system; the memory dump is detected by Windows Error Reporting (WER), which converts the dump to a minidump and sends a report to Microsoft (if enabled); finally, the dump file is deleted.

You could try searching through \ProgramData\Microsoft\Windows\WER\ for traces of possibly relevant reports.

Gary

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello, thank you for confirming what kind of failure this error is.
In the folder you've mentioned there are archives of the LiveKernelErrors in question but sadly nothing else. These folders I apparently do not have access to as an Admin though.
There is nothing regarding any BSOD as it never goes beyond 0% in status of collecting information etc.

Should I ZIP the files regarding the LiveKernelEvent and upload them regardless?

0 Votes 0 ·
GaryNebbett avatar image
0 Votes"
GaryNebbett answered GaryNebbett published

Hello @Bertha-2970,

There is not necessarily a link between the (harmless) LiveKernelEvent occurrences and the WHEA_UNCORRECTABLE_ERROR.

Since the system seemingly cannot save a dump file when the WHEA_UNCORRECTABLE_ERROR occurs, you are in a difficult situation. A real IT expert might be able to "debug" the problem further using kernel-mode debugging, but your options are probably limited to "inspiration" (suddenly realizing what might be causing the problem) and "perspiration" (trying everything that could conceivably help).

I checked my \ProgramData\Microsoft\Windows\WER\ folder to see whether there might be any useful information in the files there; the answer is "probably not". However, I did see that I had a similar event (bug code 0x144 and parameter 1 value of 0x3003):

111719-image.png

This event occurred a few seconds after an "application error" with a Conexant audio device:

111680-image.png

You could check if you can correlate your LiveKernelEvent occurrences with other events. There is no guarantee that this would help to resolve the major problem, but it is probably worthwhile going through the process.

Gary


image.png (74.7 KiB)
image.png (66.8 KiB)
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello and thank you so much for this in depth comment. It is reassuring to hear that there is likely no correlation between the two events at the very least.
There were HPCom events happening prior alongside crashes of the same application amongst many others just before LiveKernelEvent 144 happened so I can't seem to pinpoint just what precise applications are the cause as there would be so many to put to a list already, the HP applications are just a concerning one on that list already.

I was able to find and create an event log from a WHEA_UNCONTROLLABLE_ERROR BSOD which occurred just a few days ago at https://1drv.ms/u/s!AkNZH3TDQY7zaun4_8QNxaMB3p0?e=qOvERU

Would this be of any use to you? Again, thank you so much for your help.

0 Votes 0 ·

@Bertha-2970,

Taking that long hexadecimal string, converting it to binary and then dumping it gives:

 00000000: 4350 4552 1002 ffff ffff 0100 0100 0000  CPER............
 00000010: 0700 0000 2a01 0000 2f26 1700 0107 1514  ....*.../&......
 00000020: 3c60 c183 5215 a748 87d1 14d9 467d 7765  <`..R..H....F}we
 00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
 00000040: 8d7c 2157 665e fb44 8033 9b74 cace df5b  .|!Wf^.D.3.t...[
 00000050: 03f8 3300 702e 884e 992c 6f26 daf3 db7a  ..3.p..N.,o&...z
 00000060: ad02 9360 2c6e d701 0800 0000 0000 0000  ...`,n..........
 00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
 00000080: c800 0000 6200 0000 0003 0200 0100 0000  ....b...........
 00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
 000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
 000000b0: 0100 0000 0000 0000 0000 0000 0000 0000  ................
 000000c0: 0000 0000 0000 0000 5354 4f52 504f 5254  ........STORPORT
 000000d0: 0100 6200 0000 0300 0100 0500 1100 0000  ..b.............
 000000e0: d0ab 55ca 110b ea11 8173 806e 6f6e 6963  ..U......s.nonic
 000000f0: 7300 7400 6f00 7200 6e00 7600 6d00 6500  s.t.o.r.n.v.m.e.
 00000100: 0000 0000 0000 0000 0000 0000 0000 0000  ................
 00000110: 4e56 4d65 2020 2020 004d 5446 4448 4241  NVMe    .MTFDHBA
 00000120: 3235 3654 434b 2d31 4100                 256TCK-1A.

It will take me a while to tease the meaning out of the binary data, but perhaps the strings are useful to you.

Gary

0 Votes 0 ·
Docs-4663 avatar image
0 Votes"
Docs-4663 answered Bertha-2970 commented

Please run the V2 log collector and post a share link into this thread using one drive, drop box, or google drive.

https://www.windowsq.com/resources/v2-log-collector.8/
https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html



.
.
.
.
.

Please remember to vote and to mark the replies as answers if they help.

On the bottom of each post there is:

Propose as answer = answered the question

On the left side of each post: Vote = a helpful post
.
.
.
.
.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello I was able to save a log event that happened just a few days ago to the following link: https://1drv.ms/u/s!AkNZH3TDQY7zaun4_8QNxaMB3p0?e=qOvERU

Can this be used by you? Otherwise I can try again. Thank you.

0 Votes 0 ·
CarlFan-MSFT avatar image
0 Votes"
CarlFan-MSFT answered

Hi,
Some idea below:
I am not sure that LiveKernelEvent 144 is related to graphics card. Because dump is usually a valid file to help you check a BSOD problem.
Based on my search, always USB's > Sata DVD/Bluray Drive > Graphic Card.
Also I suggest that try booting your PC in safe mode and try booting your PC in clean boot.
https://support.microsoft.com/en-us/topic/how-to-perform-a-clean-boot-in-windows-da2f9573-6eec-00ad-2f8a-a97a1807f3dd
For driver issue, I consider you could use driver verifier to check if any dump you could get.
https://www.makeuseof.com/how-to-use-driver-verifier-windows-10/
Meanwhile, You mentioned this issue happened after 21st of June. For Windows 10 21h1, 21st of June update is refer to June 21, 2021—KB5003690. So uninstall it to check.
Hope this helps and please help to accept as Answer if the response is useful.
Best Regards,
Carl

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

GaryNebbett avatar image
0 Votes"
GaryNebbett answered GaryNebbett edited

A dump of the data from offset 0x0 to offset 0xC8 (where the text "STORPORT" starts) is:

    +0x000 Header           : _WHEA_ERROR_RECORD_HEADER
       +0x000 Signature        : 0x52455043
       +0x004 Revision         : _WHEA_REVISION
       +0x006 SignatureEnd     : 0xffffffff
       +0x00a SectionCount     : 1
       +0x00c Severity         : 1 ( WheaErrSevFatal )
       +0x010 ValidBits        : _WHEA_ERROR_RECORD_HEADER_VALIDBITS
       +0x014 Length           : 0x12a
       +0x018 Timestamp        : _WHEA_TIMESTAMP
       +0x020 PlatformId       : _GUID {83c1603c-1552-48a7-87d1-14d9467d7765}
       +0x030 PartitionId      : _GUID {00000000-0000-0000-0000-000000000000}
       +0x040 CreatorId        : _GUID {57217c8d-5e66-44fb-8033-9b74cacedf5b}
       +0x050 NotifyType       : _GUID {0033f803-2e70-4e88-992c-6f26daf3db7a}
       +0x060 RecordId         : 0x01d76e2c`609302ad
       +0x068 Flags            : _WHEA_ERROR_RECORD_HEADER_FLAGS
       +0x06c PersistenceInfo  : _WHEA_PERSISTENCE_INFO
       +0x074 Reserved         : [12]  ""
    +0x080 SectionDescriptor : [1] _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR
       +0x000 SectionOffset    : 0xc8
       +0x004 SectionLength    : 0x62
       +0x008 Revision         : _WHEA_REVISION
       +0x00a ValidBits        : _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS
       +0x00b Reserved         : 0 ''
       +0x00c Flags            : _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS
       +0x010 SectionType      : _GUID {00000000-0000-0000-0000-000000000000}
       +0x020 FRUId            : _GUID {00000000-0000-0000-0000-000000000000}
       +0x030 SectionSeverity  : 1 ( WheaErrSevFatal )
       +0x034 FRUText          : [20]  ""

The remaining data, still requiring interpretation, is:

 00000001`400000c8  53 54 4f 52 50 4f 52 54-01 00 62 00 00 00 03 00  STORPORT..b.....
 00000001`400000d8  01 00 05 00 11 00 00 00-d0 ab 55 ca 11 0b ea 11  ..........U.....
 00000001`400000e8  81 73 80 6e 6f 6e 69 63-73 00 74 00 6f 00 72 00  .s.nonics.t.o.r.
 00000001`400000f8  6e 00 76 00 6d 00 65 00-00 00 00 00 00 00 00 00  n.v.m.e.........
 00000001`40000108  00 00 00 00 00 00 00 00-4e 56 4d 65 20 20 20 20  ........NVMe
 00000001`40000118  00 4d 54 46 44 48 42 41-32 35 36 54 43 4b 2d 31  .MTFDHBA256TCK-1
 00000001`40000128  41 00                                            A.

Gary

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Docs-4663 avatar image
0 Votes"
Docs-4663 answered

V2 logs can be scanned and troubleshooted.

When available please post a share link.

.
.
.
.
.

Please remember to vote and to mark the replies as answers if they help.

On the bottom of each post there is:

Propose as answer = answered the question

On the left side of each post: Vote = a helpful post
.
.
.
.
.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.