Link to home
Start Free TrialLog in
Avatar of Geckotek
Geckotek

asked on

PDC keeps crashing w/ "The server was unable to allocate from the system nonpaged pool because the pool was empty"

Our server keeps loosing connectivity and upon inspection has the following Event in the System Log:
"The server was unable to allocate from the system nonpaged pool because the pool was empty."

From what I've read, this appears to be a memory leak issue, but I can't seem to track it down.  After several crashes and lots of irritated user calls, I promoted by BDC and was getting ready to wipe the PDC.  Well, before I even got a chance to re-build the PDC, the BDC crashed w/ the same issue.  So something in our network is causing it, but it's not the PDC.

I'm in an Enterprise environment and we recently completed our migration to AD.  The NT servers are still necessary until we are able to migrate our Exchange 5.5 server to 2003.  Also, there is a team currently planning and testing SMS.  Based on what I've read, I'm leaning toward the SMS rollout as a possible cause.  Any input is greatly appreciated.
ASKER CERTIFIED SOLUTION
Avatar of rmullins
rmullins

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of ahmedbahgat
ahmedbahgat

just an idea, that it is poassible that this is a virus infection, this error message appears whenit has more than 4,094 simultaneous open connections, in a way your server may be abused by a network virus for all these connections to be opened, it had a similar problem but with my firewall that dropped connections because they exceeded 2048 and it was caused by a virus infection

unless your SMS deplyment/testing is causing all these connections to be opened

you may have a look at this as well:

http://support.microsoft.com/default.aspx?scid=kb;en-us;272194&Product=nts40

if you run Norton Corporate Edition then you may have a look at this:

http://support.microsoft.com/default.aspx?scid=kb;en-us;272568&Product=nts40

and possibly SMS uses winsock a lot, so you may have a look at this:

http://support.microsoft.com/default.aspx?scid=kb;en-us;293841&Product=nts40

cheers




Is the event log, is the error # 2019???

When you run a TCP/IP sockets based program on a Windows NT computer a non- paged pool memory leak occurs. When the memory leak occurs for a while it causes Windows NT to malfunction and the following out of memory error appears in the system log:

Event ID 2019

Description:
The server was unable to allocate from the system nonpaged pool because the pool was empty.

To determine that there is a memory leak:

   1. Run Performance Monitor.
   2. From the Edit menu, choose Add To Chart.
   3. In the Object field, select Memory.
   4. In the Counter field:
         1. Select Pool Nonpaged Bytes and choose Add.
         2. Select Pool Paged Bytes and choose Add.
   5. Choose Done and watch Performance Monitor in Chart view mode.

      If the Nonpaged value rises rapidly while the TCP/IP sockets program is running then you may be experiencing this problem.

Example configurations under which this problem may occur:

    * Systems Management Server needs to communicate with an SQL server.
    * A SQL default client is configured for sockets - not Named Pipes.
    * TCP/IP is installed on the server, but SQL Server is not set up to use it. SQL Server is designed to use Named Pipes only.
    * Systems Management Server uses the default SQL client configuration for sockets.
    * Systems Management Server attempts to access SQL using sockets repeatedly.

CAUSE
This problem can be caused by a TCP/IP sockets program that continuously attempts to open a socket port that does not exist.

RESOLUTION
To work around this problem, correct your TCP/IP sockets program so that it does not attempt to open the unsupported socket port.
hi, there

to narrow down what the guy's are here saying would it be possible to install / insert a network packet sniffer on the subnet where the server reside if not you could add a additional subnet make a route and then insert a Network packet sniffer to see if there is something going on at the network part.

how much space is left on the OS Partition on each of these server's (are the also running as a print server ?)).
If print server where does the spooler reside on each printer ?.

If there is a lot of space assigned in your enterprise could you try move the print spooler + Page file ...

What does that give us.