Symptoms
The virtual machine fails with a blue diagnostic screen.The dump analysis and call stack in windbg contains entry similar to:
HTTP_DRIVER_CORRUPTED (fa) : The HTTP kernel driver (http.sys) reached a corrupted state and can not recover.
The dump analysis and call stack in windbg contains entry similar to:
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
In the /vmfs/volumes/datastore/virutal_machine/vmware.log file, you see entries similar to:
WinBSOD: ( 4) `The HTTP kernel driver (http.sys) reached a corrupted state and can not recover.'
<snip>
WinBSOD: (24) `Technical information:'
WinBSOD: (26) `*** STOP: 0x000000FA (0x00000001,0x8A7C8390,0xBA23BCA6,0x00000C10)'
WinBSOD: (26) `*** STOP: 0x000000FA (0x00000001,0x8A7C8390,0xBA23BCA6,0x00000C10)'
WinBSOD: (29) `*** HTTP.sys - Address BA23BCA6 base at BA234000, DateStamp 4af41bca'Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.
The virtual machine is running the Windows Server 2003 or 2003R2 operating system.The virtual machine is running one of these VMware Tools versions:
8.6.15
9.0.15
9.4.11 or later
For more information on determining the VMware Tools version installed, see Verifying a VMware Tools build version (1003947).
Resolution
This is a known issue affecting VMware vSphere ESXi 5.x, ESXi 6.0 and NSX 6.x.
Currently, there is no resolution.
Note: The vnetflt.sys driver supports the NSX for vSphere Activity Monitoring Feature. However, it is not used by any vShield Endpoint functionality.
When the vSphere Activity Monitoring Feature with NSX Guest Introspection is not used, disabling the vShield Endpoint TDI Manager does not affect any vShield Endpoint functionality.
To workaround this issue, disable the vnetflt.sys driver:To disable the vnetflt.sys driver:
Note: This procedure modifies the Windows registry. Before making any registry modifications, ensure that you have a current and valid backup of the registry and the virtual machine.
Connect to the affected virtual machine with a console or RDP sessions.Click Start > run, type regedit and click OK.Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vnetflt\ Right-click the Start key and select Modify.Change the value to 4 and click OK.Close the Registry Editor Window.Reboot the virtual machine.
Related Information
To be alerted when this document is updated, click the Subscribe to Article link in the Actions box. Verifying a VMware Tools build versionvShield Endpoint TDI Manager または NSX Network Introspection Driver (vnetflt.sys) ドライバを使用する Windows 仮想マシンで障害が発生して青色の診断画面が表示される使用 vShield Endpoint TDI Manager 或 NSX Network Introspection Driver (vnetflt.sys) 驱动程序的 Windows 虚拟机出现故障并显示蓝色诊断屏幕
