The server was unable to allocate from the system paged pool because the pool was empty.

This started in December 2002.  We upgraded from Back Office 4.5.  At first I thought it was the virus software.  We are running Symantec AntiVirus Small Business Edition with Anitvirus/Filtering for Microsoft Exchange.  I completely unistalled it and 5 days latter the problem occured.  I have increased the size of my page files.  I have increased the size of my registry.  I have watched the system monitors for memomory leaks.  I am going to run poolmon.exe next to see if I can find a memory leak that way.  I was hoping someone might know right off the bat what my problem is.  Thank you.

1) I would get the latest drivers for ALL of your hardware, including BIOS updates if needed.

2) Run chkdsk and defrag your hard drives.

3) Continue to use Perfmon in log mode to determine what is causing the problem.

4) Add more RAM.

I hope this helps !

There used to be a MSKB article (http://support.microsoft.com/default.aspx?scid=kb;EN-US;126402 - "PagedPoolSize and NonPagedPoolSize Values in Windows NT") that described how to inclrease the pool size, but it is unavailable at this time. Well, let's use the explanation from "Inside Windows 2000" then:

System Memory Pools
At system initialization, the memory manager creates two types of dynamically sized memory pools that the kernel-mode components use to allocate system memory:


Nonpaged pool Consists of ranges of system virtual addresses that are guaranteed to reside in physical memory at all times and thus can be accessed at any time (from any IRQL level and from any process context) without incurring a page fault. One of the reasons nonpaged pool is required is due to the rule described in Chapter 2: page faults can't be satisfied at DPC/dispatch level or above.


Paged pool A region of virtual memory in system space that can be paged in and out of the system. Device drivers that don't need to access the memory from DPC/dispatch level or above can use paged pool. It is accessible from any process context.

Both memory pools are located in the system part of the address space and are mapped in the virtual address space of every process. (In Table 7-10, you'll find out where in the system memory they start.) The executive provides routines to allocate and deallocate from these pools; for information on these routines, see the functions that start with ExAllocatePool in the Windows 2000 DDK documentation.

There are two types of nonpaged pools: one for general use and a small one (four pages) reserved for emergency use when nonpaged pool is full and the caller can't tolerate allocation failures. (This latter pool type should no longer be used; device drivers should be written to properly handle low memory conditions. Driver Verifier, discussed later in this chapter, makes it easier to test such conditions.) Uniprocessor systems have three paged pools; multiprocessor systems have five. Having more than one paged pool reduces the frequency of system code blocking on simultaneous calls to pool routines. Both nonpaged and paged pool start at an initial size based on the amount of physical memory on the system and then grow, if necessary, up to a maximum size computed at system boot time. You can override the initial size of these pools by changing the values NonPagedPoolSize and PagedPoolSize in the registry key HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management from 0 (which causes the system to compute the size) to the size desired in bytes. You can't, however, go beyond the maximum pool sizes listed in Table 7-4.

Table 7-4 Maximum Pool Sizes

Pool Type Maximum Size
Nonpaged 256 MB (128 MB if booted /3GB)
Paged 491.875 MB

If it happened after you uninstalled the anti-virus software, then that's the problem.  Try re-installing it or find a uninstaller that goes and cleans up residues from Symantec.  Are you using Service Pack 3? Try reloading SP3.  There may be services still running trying to run even though you unistalled it.  Check for services
related to Symantec and disable them.  If you are daring you can try deleting keys in the registry relating to symantec.  Make sure you have backups!

Have you tried these?

http://www.jsiinc.com/SUBK/tip5000/rh5047.htm  

http://www.jsiinc.com/subg/tip3400/rh3408.htm

Good luck!

Event ID 2019 or 2020 or "Insufficient System Resources" Error Returned When Logging On
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q272568

Maximum Files on SFM Volume Limited by Paged Pool Memory
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q161870

I think the first one is the one for you.  Deals sepcifically with Norton.  Hope these help.  =)

I will try to unistall Symantec again.  Thanks for the help.

Found this, which I hope will help if all of the above fails: (from Win2000 Tips & Newsletters)

"Servers that run under extremely heavy loads -- meaning they have a lot of services running and a lot of open file handles -- may start logging a great many errors of Event ID 2020. The error information reads:

"Event ID 2020 - The server was unable to allocate from the system paged pool because the pool was empty."

This happens if Windows 2000's memory manager can't de-allocate paged pool memory fast enough to keep up with demand. Paged pool memory is system or kernel code that can be swapped out to disk when there's little physical RAM left. De-allocating paged pool memory is the actual swapping process. Normally this swapping starts happening when 80% of the total paged pool is used by system operations, but it may need to happen a lot sooner if the server starts experiencing heavy loads.

To do this, you'll need to edit the Registry. (Make sure you've backed it up, and can restore it in the event you do something untoward.) Run REGEDT32 and open the key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management

Add a REG_DWORD value named PoolUsageMaximum (assuming there isn't one already), and set the value of the key to 40 (decimal). This indicates that the memory manager should begin trimming down allocated paged pool memory when 40% of the total paged pool is in use.

Set the PagedPoolSize REG_DWORD key to 0xFFFFFFFF (hex), which allows the largest possible paged pool permitted. Close down REGEDT32 and reboot."

jhaavie, That's another thing I've tried.  Thanks though.

Have you seen this KB article?

Mapping Shared Local Printers to Central Share Causes Server to Crash, Generates Event ID 2020 from SRV
http://support.microsoft.com/?kbid=286060

jhaavie, That's another thing I've tried.  Thanks though.

I called Symantec and they actually acknowleged that Version 8 does have page file issue as I described.  They gave me a new version 8.01 that is supposed to resolve the problem.  I'm not going to run Symantec on the server.  I will istall it on a workstaion next time.  Thanks for your help.

I am getting the exact same issue as above; but I am running Win2k3 server and exchange 2k3 sp1.   My server locks up exactly every 7 days and the first error is a netlogon error, subsequent errors are EventID 2019 "The server was unable to allocate from the system nonpaged pool because the pool was empty."

Symantec AV 8.1 is running symevnt driver is a version after the fix mentioned in the MS articles.

The /3GB switch has been applied, but we are going to remove it to see if it helps with this problem.  Has any else resolved this issue?

 
 Thanks

I'm still running Symantec 8.1 but I'm managing it from my work station not the server.  Everything has been running great now for a couple years.

We are getting the same issue on a WIN 2k server. Any help is really appeciated

We're having the same sort of problem.

About every 6 -7 days my Fileserver (W2K3 with service pack 1 and all updates) locks up at around 9-10pm. We are running Trend Micro Client  Server Messaging Suite a/v software and Veritas 9.0 for backup.

Initially the fileserver was the machine taking care of backups using a number of external USB drives. But while trying to troubleshoot this problem, I moved the backup management to another server and stopped all Veritas Backup Exec services but the remote agent.

The problem contiues.

Anybody???

Our problem was finally resolved.  It was the RAID SCSI controller that was defective........

There was no indication that the controller was the problem untill we attempted loaded the latest drivers and tried to update the firmware.  This was required to run the latest version of OpenManage once SP1 for Win2K3 is installed.  After the firmware was installed the OS refused to load.....reverting back to the old firmware allowed the OS to load.  Dell sent us a new contoller and we have not had the issue since.

Hope this is helpful......

AG

Hey, that sounds familiar! :-)
Our culprit turned out to be very similar. I have a Promise FastTrak 378 controller controlling 2 SATA disks in a mirrored Raid 1 array.

There is a utility that comes with the Promise controller that is called Promise Raid Message Agent.  This seems to be used to alert you to problems with the disks. I used poolmon.exe (available in the 2003 resource kit) to identify what process was taking up all the memory. I also turned on "Handle count" under processes in Task Manager to see what process was generating all the handles. This was the most informative thing that I did. I immediately saw that the MsgAgt.exe was using/generating thousands of handles. I then did an "end Process" and then checked the services for this exe and sure enough it is listed. I disabled it and the server has now been up for a week with no problems.

KB

kbartlett,

I tried using poolmon.exe and it came up and i seen a bunch of TAQ names which really don't make sense to me as far as what processes are what.  How do I read this graph and determine what process is doing what with the pool?

Thanks.

However for anyone else reading I found my problem to be the belkin bulldog ups software.  The device had been disconnected and the upsd.exe file had 5000 open handles and kept growing by the second.

Here is a pretty good explanation from MS about using poolmon.

http://support.microsoft.com/default.aspx?scid=kb;en-us;177415

I followed the instructions and was confused too. But, there was a nonpaged TAG that was using a large number of "Allocs". I did a Google on the TAG name and was pointed to my Promise controller.

Hope that helps.

Glad to here that you solved you problem.


KB

KB,

Thanks I'll have a look at the article.  Thanks for your input on the handles as that's how I figured out this PIA problem :)

Lee