• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 548
  • Last Modified:

General Registry Questions

In the c:\winnt\system32\config folder, I have 50 or so files that start with RGB with 5 characters following. Most a 0 KB but two are 34 Meg apiece. These files haven't been modified for months and months.
I am wondering if these can be deleted safely.

Also, and i know there is no real concrete answer, but I am wondering how big a typical software hive should be. This is a Windows 2000 server, used for three or four Terminal Service Clients and 15 local users.

I have been fighting a weird EventID 2020 error and I am looking to clean some things up.
0
toe_mas
Asked:
toe_mas
  • 5
  • 5
1 Solution
 
mttydCommented:
not sure what the exact max size for a server registry is.  I would probablly look more into compressing or optimizing the registry rather than looking for items to delete.

Also since this is a server I really wouldn't make modifications unless absolutely needed or you are getting close to the max registry size.
0
 
toe_masAuthor Commented:
I am not looking to delete anything from the registry. I am just wondering if all these rgb***** files can be deleted.
My software hive in 48 Meg right now. The max size is set at 98 Meg and the current size is 68 meg.
0
 
dreamyguyCommented:
event id 2020 means that the system is unable to allocate from the system paged pool.
there are two ways of troubleshooting this issue.
you can either implement http://support.microsoft.com/kb/312362 - Server is unable to allocate memory from the system paged pool which MAY resolve the issue as a workaround

or

Download and install poolmon on the machine and allow it to run for a day. after that compress and upload the poolmon to any ftp site so that I can download it from there, analyze it and revert with the next steps to take.

here's more information about poolmon.
support.microsoft.com/kb/177415 - How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel Mode Memory Leaks

about the files, yes you can delete them safetly, even though i don't think that that would resolve your issue. it's very common to see an inflated registry causing the system to throw up 2020 error messages on a windows 2000 box.

I don't know about the software hive, but as per http://support.microsoft.com/kb/831260, The SYSTEM hive is limited to approximately 10.3MB (may grow up to 12MB) in size in Windows 2000 Server. This is because the SYSTEM hive and the Windows kernel files must fit below 16 MB when Windows starts.

As per the book Windows Internals,

On Windows 2000, there is also a limit on the combined sizes of all loaded registry hives. Windows 2000 uses a type of kernel memory called paged pool to hold registry hives in memory, and therefore, the total amount of loaded registry data is constrained by the amount of paged pool thats available. The amount of paged pool the memory manager creates during its initialization is based on a number of factors, such as the amount of physical memory on the system. On a system where the memory manager creates the largest amount of paged pool possible, the registry size limit is 376 MB. Because a system will not operate smoothly if there is not enough paged pool left over for other uses, Windows 2000 wont let registry data grow to more than 80 percent of paged pool and also honors a user-configurable registry quota if its less than that amount.
0
Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
toe_masAuthor Commented:
Thanks for the help! I didn't expect the removal of those files to fix anything, just cleaning. I installed the support tools the other day, looking for the poolmon to solve the potential memory leak. I have been through a ton of other solutions, it is not the old McAfee or Norton issue.
I am having problems getting a text output from poolmon though, even highlighting and copying and pasting doesn't work. Am I going about that wrong also?
I am not sure how to get the log to you otherwise...
0
 
toe_masAuthor Commented:
The biggest ones are:
vmem 88571904
CM 57807616
MmSt 2635328
Ntff 1220832
Obtb 602112

I will watch these and see how much they grow... or if anything new shows up
0
 
dreamyguyCommented:
you could compress and upload the log to www.ee-stuff.com or any public FTP site so that we can download and analyze it.
0
 
toe_masAuthor Commented:
I am not sure how to get poolmon to generate a log, the /c and /n switches both give me "invalid switch", is there another method?

0
 
dreamyguyCommented:
Yes there is.You can also use a utility called memsnap.

From  http://support.microsoft.com/kb/886670

use Task Scheduler to run the Memsnap.exe tool at certain intervals. For example, you can configure the memsnap -p c:\temp\memsnap.log command to run every hour by using Task Scheduler.

Note The Memsnap.exe tool is located in the Support\Tools folder of your Windows Server 2003 CD. The Memsnap tool records system memory usage to the Memsnap.log log file.

Steps for gathering memsnap.

1. Run memsnap on the problematic server for an entire day.
2. Double Click on 'snapmem.bat' file and let it run for entire day
3. Output of MemSnap is captured in memsnap.log
4. Please the file at an FTP location for further analysis
0
 
dreamyguyCommented:
0
 
dreamyguyCommented:
toe_mas: it's not /c and /n, it's -c and -n

do a poolmon /? and it will give you the list of available switches.
0
 
toe_masAuthor Commented:
0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

  • 5
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now