Link to home
Start Free TrialLog in
Avatar of Swamp_Thing
Swamp_ThingFlag for United States of America

asked on

Windows 2000 Server loses network connectivity randomly about twice a month: "System Nonpaged Pool" entry in system log

One of the servers that we have here at my work has an strange issue...  About twice a month, usually a week to a week and a half into the month and the same at the end of the month it loses network connectivity.  Everyone has mapped network drives on their PCs that access this server and when it "loses network connectivity", no one can access the mapped drives.  You cannot browse to the server via the My Network Places shortcut on the desktop or connect via Remote Desktop to the server.  When we go into our server room log into the server, everything seems to be in check.  There are no error messages up besides "Error, could not print" because there are mapped printers on that server.  The only remedy for this issue is to reboot the server.  This is extremely annoying because we'll sometimes have to travel into work on a Saturday or Sunday at 7:00am just to press the "restart" button on the server.

We noticed that there is an entry in the System Log in the Event Viewer each time that this happens.  It is shown below:

==================================
Date: 5/10/2007                   Source: Srv
Time: 10:23:50 AM              Category: None
Type: Error                          Event ID: 2019
User: N/A
Computer: (our server name)

Description:
The server was unable to allocate from the system nonpaged pool because the pool was empty.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
===========================================


Avatar of Swamp_Thing
Swamp_Thing
Flag of United States of America image

ASKER

I did some research on this and it seems like there are two main areas of a "pool" error like this: Paged and Nonpaged.  The Nonpaged issue deals with (if i'm not mistaken), memory that is reserved on the hard drive like the pagefile (might even be part of the page file but i'm not sure).  I checked each instance of this entry in the System Log and it is always a NONPAGED entry.
Here is some info on the Server:

Windows 2000 Service Pack 4
Intel Xeon CPU @ 2.4GHz
2GB RAM

C:\ is 20GB, w/ 14.4GB FREE
F:\ is 253GB, w/ 23.5GB FREE
(The F:\ drive is the one that A LOT of people read/write to.  This is the one that everyone's mapped drive points to.)
This is info on the Page File:

=========================
Virtual Memory
Drive          Page File Size (MB)
C:               2046 - 4092
E:               (blank)

Page file size for selected drive (C:\)
Initial Size (MB): 2046
Max. Size (MB): 4092

Total paging file size for all drives
Minimum allowed: 2MB
Recommended: 3070MB
Currently allocated: 2046MB

Registry Size
Current registry size: 21MB
Max. registry size (MB): 114
========================
From http://kb.swsoft.com/en/1675 is obtained this information:

"The error means the server has problem with Non Paged (NP)  Pool. NP pool on Windows 2003 x86 systems has limit 256 MB, it used for kernel operations (drivers), GUI and some others. In case NP pool is overloaded, the system becomes slow and unresponsive, some software components can't work normally (for example IIS refuses connections).
NP pool memory leaks can be caused by incorrect software work or malware."

The part that popped out at me was the "(for example IIS refuses connections)", which would explain why the server appears to be in working condition but in the background no connections can be made.
In the link that I posted directly above this one, I read the whole page but didn't do the "vzquery" thing that it discussed because I was getting a message in the cmd prompt saying that it was an unrecognized command.  Anyways, I downloaded What's Running and installed it on the server.  I followed the advice in the link to look for the process that has the most Nonpaged Pool usage.  What's Running shows the "SERVICES.EXE" service consuming a steady 488K and the "spoolsv.exe" service consuming a fluxuation 270-295K.  I guess I won't know who the culprit is until the server goes down again and I can see who's consuming the most of the Nonpaged Pool.

My plan is that the next time the server loses connectivity I'm going to look at task manager or What's Running to see what process is consuming the most of the nonpaged pool.  I think that IIS is refusing connections like mentioned in my last post.
ASKER CERTIFIED SOLUTION
Avatar of EE_AutoDeleter
EE_AutoDeleter

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial