• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5391
  • Last Modified:

Memory Leak error, that only occurs, when i rename my server, and give a specific ip address?

I've got a memory leak error on my windows 2003 std edt server. the strange thing is, it ONLY happens if i rename the server, and change its ip address to that of an old server on our domain. I'm trying to upgrade our fileserver, so i've got a brand new dl380, with windows 2003 std edt. It's been running for a month now(on the domain) all ok, no errors at all. On the weekend, i planned to put it live. I took the old fileserver (called fileserver, Win2k) off the domain, and into a workgroup, changed its ip address and re-booted, all ok. I then started work on the new fileserver (called temp2), i dropped it into a workgroup, changed its name to "fileserver" (left in workgroup) and re-booted. I then changed it IP address to reflect the original fileserver's address, re-booted. I then joined the new fileserver, to the domain. Everything looked good all the mapped drives worked fine. BUT, about an hour later, i could't access the new fileserver, tried pinging, but that failed as well. Went to site, checked out the event logs, and there were lots of error messages stating: "the server was unable to allocate from the system nonpaged pool because the pool was empty". I restarted the server this fixed it, but it then died about 2 hours later. I reversed the process of naming it, as stated above, and now its back to Temp2, and there are no problems? How can the change of name and ip address cause these problems?

I've found an article on the hp website which has all the error messages and symptoms that i'm having, but, this error is constant, and was resolved by updating Landesk software, i've attached the errors:

we have a compaq dl380 g2 server with windows 2003 reporting memory leaks once a week, becomes unresponsive and has to be hard reset.
all hardware drivers/bios/firmware has been updated without solving the problem.

the server has the following software installed:
W2K3 Server Std. (member of an AD)
HP Utilities
IBM Tivoli Storage Manager Client
LanDesk 8.5
Symantec Antivirus Client

the server runs for about a week without problems and then becomes unresponsive (no logon possible due to lack of ressources) with the following event entries:

Source: PerfDisc
Category: None
EventID: 2001
Description:Unable to read the disk performance information from the system. Disk performance counters must be enabled...

Source: Userenv
Category: None
EventID: 1053
Description:Windows cannot create registry key Software\Microsoft\Windows\CurrentVersion\Group Policy. (Access is denied. )....

Source: Storage Agents
Category: Alerter
EventID: 773
Description:The Remote Alerter Agent received an error on WaitForMultipleObjects call. The data contains the error code.....

Source: Application PopUp
Category: None
EventID: 333
Description:An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry...

Source: Srv
Category: None
EventID: 2019
Description:The server was unable to allocate from the system nonpaged pool because the pool was empty....

Source: cpqcissm
Category: None
EventID: 56
Description:The driver failed to allocate memory. ...

Source: Foundation Agents
Category: (17)
EventID: 4402
Description:The External Status MIB Agent could not create an SNMP session. The data contains the error code....  
  • 4
  • 4
1 Solution
Michael PfisterCommented:
Try removing ALL HP management agents and tools from your box before renaming it. You can reinstall them afterwards. Also check if there are newer versions to download from HP.

If it doesn't help, also remove before renaming

> IBM Tivoli Storage Manager Client
> LanDesk 8.5
> Symantec Antivirus Client

Hope it helps,


rtl_supportAuthor Commented:
Thanks for your advice, but can i ask, why don't these applications, cause a memory leak, before i rename it? As i said, this problem only occurs, after i've renamed the server, and changed the IP address?

Michael PfisterCommented:
I remember having a lot of troubles with HP agents under different circumstances.
They bring their own web server and stuff I don' t like but you have to install them otherwise you can't manage your servers.
I'd guess they store the server name and/or IP address during setup and if you change it later some subroutines wreak havoc because the name has changed.

You can go and try to find the culprit by using perfmon to watch each process for allocating nonpaged memory and not freeing it.
Start perfmon and select:
Process -> Pool Nonpaged Bytes -> All instances

Ctrl-H turns on highlighting, just browse through the indicator list until you find the one going up. Since you're talking about hours it should go up quite fast.

Hope it helps,

Cloud Class® Course: Amazon Web Services - Basic

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

rtl_supportAuthor Commented:
Thanks for that, it makes sense. I'll try it tonight, and update you tomorrow.
rtl_supportAuthor Commented:

I removed all agents, but still problematic. Managed to get the poolmon logs this morning, when it was in a "locked" state, and found this:

Memory: 1048032K Avail:  654712K  PageFlts:    30   InRam Krnl: 2152K P:19168K
 Commit: 290812K Limit: 960032K Peak: 293552K            Pool N:206316K P:19636K
 System pool information
 Tag  Type     Allocs                  Frees                      Diff       Bytes       Per Alloc

 McOp Nonp    1184743 (   0)               0 (   0)     1184743    104257384 (     0)     88
 McFN Nonp    3451689 ( 642)   2266947 ( 642)    1184742     85312680 (     0)     72
 Even Nonp     106339 (  11)       104168 (  12)           2171        106768 (   -48)     49
 Vad  Nonp      57550 (   6)           55742 (   6)           1808          86784 (     0)     48

I assume thats a mcafee tag (we have mcafee av). I will remove mcafee tonight, once i confirm the tag. I'll keep you posted.
Michael PfisterCommented:
Never saw this with McAfee but everything is possible... I just wonder because you mentioned Symantec Antivirus Client in your original post. I hope you don't have 2 anti-virus programs installed on the same system?!?

And I must admit: I'm not impartial when it comes to HP agents ...;-)
rtl_supportAuthor Commented:

Resolved the problem. It was related to mcafee. And they have a patch to resolve this on there website (you'll need at least patch 11)

Applied the patch, and monitored using poolmon, all ok.

Thanks for your help
Michael PfisterCommented:
Glad I could help, but why only "C"?

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

  • 4
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now