Solved

Event ID: 2019 "The server was unable to allocate from the system paged pool . . . "

Posted on 2007-03-22
15
2,938 Views
Last Modified: 2012-08-13
Our SBS with Exchange has developed a strange problem. After having remote email, server access, and server lockups, we would find a long string of "Event ID: 2019 The server was unable to allocate from the system paged pool because the pool was empty" messages. At first, we would restart the server and everything would be fine for a few days. Then all of a sudden the Event ID: 2019 (and occasionally 2020) message would show up again. We had downloaded and installed Symantec Mail Security for SBS about a month ago. We recently implemented their spam filtering, and it seems that the problem showed up right after that. I called Symantec and they asked if we were running NAV. We had been, but removed it to install Mail Security. Symantec says they don't believe their program is the problem source, but said we could download and install the latest revision of Mail Security just to be sure. Symantec believes the problem is a memory leak, and it may be a Microsoft problem. -- That's when I decided to post the problem here. Has anyone seen this problem before? Any help will be greatly appreciated. Thanks.

Leon    
0
Comment
Question by:OleBear
  • 6
  • 6
  • 3
15 Comments
 
LVL 38

Accepted Solution

by:
Hypercat (Deb) earned 225 total points
ID: 18774040
There are lots of potential causes of this issue, and it does relate to a possible memory leak.  Take a look at this page from EventID.net and see if anything there will help you out:

http://www.eventid.net/display.asp?eventid=2019&eventno=661&source=Srv&phase=1
0
 
LVL 74

Assisted Solution

by:Jeffrey Kane - TechSoEasy
Jeffrey Kane - TechSoEasy earned 275 total points
ID: 18791046
What Service Packs are installed on your SBS?  Because If you implemented Symantec's spam filtering, I'd suspect that you don't have Exchange SP2 installed which includes the Intelligent Message Filter... about the best SPAM filter you'll find and it's FREE.  (but that's beside the point).  

But more importantly if you have not installed all 5 components of SBS SP1, you need to do this.  See http://sbsurl.com/sp1 for details and follow those instructions explicitly.

Why did you remove NAV anyhow?  what are you running for your overall Antivirus protection on your network? Now you're just checking email?  What about other files?  What about your workstations?

Jeff
TechSoEasy
0
 

Author Comment

by:OleBear
ID: 18811199
Thank you Hypercat and Jeff at TechSo Easy for your responses.

First, I found the information on memory leaks useful, especially poolmon.exe. I have run that command, but not yet during a flood of ID 2019 errors -- because when that happens, we must restart the server or nobody can work. I'm nonitoring the server now for the first sign of the dreaded 2019 error. However, I'm having difficulty interpreting the poolman results. The columns are Tag - Type - Allocs - Frees - Diff - Bytes - Per Alloc. The first Tag item showing right now is AfdB - what in the world does that mean? What should I be looking for?

Jeff - We are in fact running Exchange SP2, but no, I did not have Intelligent Message Filter implemented. I remember being warned against it, and Symantec being suggested instead. I have it implemented now, but does it take additional customizing to be the most effective? -- As for removing NAV 10 on the server, Symantec told me to do that because of a conflict with the release we have. We have ordered the updated version. As for the workstations, they are all successfully running NAV 10 with auto update turned on.    

Thanks again to both of you.

Leon
0
 
LVL 38

Assisted Solution

by:Hypercat (Deb)
Hypercat (Deb) earned 225 total points
ID: 18811333
The tags are indicative of what driver or program is using the paged memory.  Afdb is a tag used by afd.sys, I believe.  Take a look at this info on running Poolmon, it may be helpful:

http://technet2.microsoft.com/WindowsServer/en/library/00dede78-030c-4d5b-bebf-f5f35f17949e1033.mspx?mfr=true
0
 

Author Comment

by:OleBear
ID: 18834649
Here are some poolmon results and file handle counts that I'd like you folks to take a look at.
Poolmon -- server running ok -- AfdB Allocs 67773  Frees 6243  Diff 61530 (hightest Diff on list)
Poolmon -- server locked up  -- AfdB Allocs 283426 Frees 6073 Diff 277353 (highest Diff on list)
Poolman -- server restarted  -- AfdB Allocs 2892      Frees 327   Diff 2565 (no longer highest Diff but right after restart)
NCICore.exe  Handles  (after restart) -- 645 -- Mem Usage 11,696K
NCICore.exe  Handles  (locked up) -- 57,349  -- Mem Usage 40,308K
NOTE: NCICore.exe is part of a program installed on the server shortly before we began getting Event ID:2019 errors.  -- Given the reported problems with Symantec's products, we completely uninstalled their products. On Saturday we installed Kaspersky Microsoft Server Anti-virus, and implemented Intelligent Message Filter for spam protection. -- Since then I've been periodically connecting successfully with Remote Web access. However, I just tried again several times and could not get the log-on screen. That usually means the server is locked up. --- This problem is driving us all crazy! So please take a look at my test results and see if they make any sense to you. Thanks.
Leon
0
 
LVL 74

Assisted Solution

by:Jeffrey Kane - TechSoEasy
Jeffrey Kane - TechSoEasy earned 275 total points
ID: 18835689
"but does it take additional customizing to be the most effective"

No, the whole concept of the "INTELLIGENT" message filter is that it works pretty much without any modification.  HOWEVER,  you must set the UCE levels and what action is to be taken with messages that fail the test.  You can tweak those levels a bit if you at first have things set to lenient.

Read the instructions.  They're pretty precise.

I'm glad that you have uninstalled the Symantec filters... because I think that was certainly a problem.

As for not getting the logon screen, this is really a separate issue, and should be posted in a separate question.

I will tell you though... that there are only TWO remote sessions available on an SBS and if you don't log off of your session, it remains active and could keep further connections from being successful.  You can try to connect via RDP Client using the /console switch to connect to the console session (which is essentially a third available session).  If this is not clear and simple for you, please post a separate question for the issue.

Jeff
TechSoEasy
0
 

Author Comment

by:OleBear
ID: 18837389
Jeff - It turns out that I wasn't getting the logon screen because the server was locked up -- with the same Event ID 2019 problem that has been haunting us. And it still is haunting us.

As for IMF, I did in fact read all the stuff on it, and set up the UCE levels and specified a folder where spam is to go. That seems to be working OK now.

Were you able to make any sense out of the poolmon results or the high handle count?
Thanks -- Leon  
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 74

Assisted Solution

by:Jeffrey Kane - TechSoEasy
Jeffrey Kane - TechSoEasy earned 275 total points
ID: 18837493
No, because I really have no Idea how the poolmon works, and it doesn't make any sense to me to look into those processes... because you have actually stated what the problem is... yet you haven't done anything about fixing it.

You said, "NOTE: NCICore.exe is part of a program installed on the server shortly before we began getting Event ID:2019 errors"

SO... why have you not uninstalled this program yet?  Is this program certified and supported to run on a Small Business Server?  Even if it is... get it off your server and see if that solves your problem.

Jeff
TechSoEasy
0
 

Author Comment

by:OleBear
ID: 18838208
"SO... why have you not uninstalled this program yet?  Is this program certified and supported to run on a Small Business Server?  Even if it is... get it off your server and see if that solves your problem."

Well, this program handles the electronic security system for the building we're in. I wasn't sure I could stop it over the wekend. I'm about to contact them this morning to find out what my options are. I'll let you know how that goes. --- This whole ID 2019 problem has been a process of elimination - with indications that it could be Symantec, to spoolsv.exe, to file handles, to memory pool. Not exactly an easy one to solve. -- Leon


0
 
LVL 38

Assisted Solution

by:Hypercat (Deb)
Hypercat (Deb) earned 225 total points
ID: 18838903
No, Leon, it's definitely not an easy one to resolve.  But the nature of the error and the poolmon results point to the application demanding too many handles or maxing out your paged pool, so that's the direction you have to go in.  The application may just be a little leaky and, in combination with SBS, antivirus software, remote administration, etc., it could be causing your problems.
0
 
LVL 74

Assisted Solution

by:Jeffrey Kane - TechSoEasy
Jeffrey Kane - TechSoEasy earned 275 total points
ID: 18855885
You definitely need to uninstall that program and put it on a different machine.  I've seen this type of software many times and would never put it on the server itself.

Jeff
TechSoEasy
0
 

Author Comment

by:OleBear
ID: 18859695
AN UPDATE -- Well, we removed NAV 10, we removed Symantec Mail Security, and we removed the building security program, and things looked pretty good. All the huge handle counts went down, and Poolmon showed that most all allocated memory had been freed. Just for good measure, we stopped Volume Shadow Copy service because others had experienced a memory leak from it. This was last Friday morning. We were feeling pretty good about finally eliminating our 2019 problem.

Then about 10 pm Sunday night I get a call from my 'partner in crime', a person who has been working with me all through this issue, who says she can't log on remotely. And neither can I. My partner volunteers to go to the office and discovers that everything looks pretty clean except that spoolsv.exe NP Pool is 150,532K and handles are 15,022. She stops the spoolsv service, and then I can log in remotely from home again. We restart the server for good measure and spend Monday 'googling' other possible causes of the dreaded 2019. Yesterday, Tuesday, we reconfiigure all printer connections on the server with Standard IP configurations instead of the mix of HP IP and Standard IP that existed. We did this because others had reported memory leaks from HP IP. I called HP and they suggested using Standard IP settings as well.

THE CONCLUSION -- Well, it seems to take about 1.5 or 2 days for that 2019 lockup to occur. So now we are waiting. We've tried just about everything anybody has suggested, and anything we can glean from our google searches. Hopefully that 2019 problem is fixed. But if it is not, I guess we'll be posting it here. So those of you who are familiar with this problem, stay tuned. -- Thanks again.

Leon
0
 
LVL 74

Assisted Solution

by:Jeffrey Kane - TechSoEasy
Jeffrey Kane - TechSoEasy earned 275 total points
ID: 18859828
That would be entirely consistent with this forum post: http://forums.techarena.in/showthread.php?t=361907 which also makes a lot of sense.

So it looks as though you have your problem solved.

You might want to re-enable Volume Shadow Copy.  The memory problems caused by that service have patches available and without VSS you really are reducing your server's backup capabilities.

Also, make sure that when you reinstall your AV, that you have all the proper files and folders excluded.  I do see that as a common memory waster as well.  http://support.microsoft.com/kb/822158 and http://support.microsoft.com/kb/823166 both provide guidance on this.

Jeff
TechSoEasy
0
 

Author Comment

by:OleBear
ID: 18865782
As soon as we can be sure that the dreaded 2019 error doesn't come back, we'll definitely re-enable Volume Shadow Copy - and we want to pay closer attention to both virus and spam filtering.

I have another issue, but I'm not sure this is the best place to bring it up -- But here goes: It would be very convenient if I could connect remotely to the Event Viewer and Task Manager on the SBS. I can log in remotely as administrator to RWW, and get "Connect to Server Desktops" which would seem to allow me to do that, but instead I get a box that says, "Connectivity to the remote computer could not be established . . . " Is there a way for me to make this remote conneciton? Thanks.

Leon
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 18874852
OleBear,

Normally, I would say to please post your separate issue in a new question so that it can get the proper attention it deserves.  By adding to this thread, you only get the eyes of those who are already participating... if that.

But this may be as simple as you not having port 4125 open on your firewall/router.
http://support.microsoft.com/kb/886209

Jeff
TechSoEasy
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

I work for a company that primarily works with small businesses as their outsourced IT vendor. As such the majority of these customers utilize some version of Small Business Server. Due to the economics of running a small business, many of these cus…
You may have discovered the 'Compatibility View Settings' workaround for making your SBS 2008 Remote Web Workplace 'connect to a computer' section stops 'working around' after a Windows 10 client upgrade.  That can be fixed so it 'works around' agai…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now