fhpcis
asked on
Memory Leak?
For the last few weeks, one of my DCs has been freezing up and it needs rebooted to revcover it. After a reboot, I find EVENT ID 2019's (The server was unable to allocate from the system nonpaged pool because the pool was empty) in the eventlog.
I did a memsnap (see below) and noticed that the NP Pool for DNS.exe is running very high, or so I think.
Any other processes that might be causing this performance issue? Has anyone encountered this before?
Thanks in advance for any insight on this.
ProLiant ML350, Windows 2000 Server sp4, 2GB RAM, 2.26Mhz PIII
Process ID Proc.Name Wrkng.Set PagedPool NonPgdPl Pagefile Commit Handles Threads User Gdi
!LogType=memsnap
!ComputerName=FHPC
!buildnumber=2195
!buildtype=retail
!CSDVersion=Service Pack 4
!SystemTime=11\11\2008 20:03:16.0667 (GMT)
!TickCount=249967187
00000000 (null) 16384 0 0 0 0 0 1 0 0
00000008 System 225280 0 0 28672 28672 774 49 0 0
000000CC SMSS.EXE 430080 5932 1252 1110016 1110016 36 6 0 0
000000E4 CSRSS.EXE 1552384 42292 6560 1482752 1482752 650 12 0 0
000000FC WINLOGON.EXE 4202496 39360 70352 7753728 7753728 425 17 7 21
00000118 SERVICES.EXE 14139392 42816 569736 4788224 4788224 752 42 0 4
00000124 LSASS.EXE 91324416 70608 278600 85712896 85712896 981 43 0 6
00000188 termsrv.exe 4300800 18716 13640 2076672 2076672 104 12 0 4
000001E4 svchost.exe 4907008 26400 33884 1691648 1691648 327 11 0 4
00000220 svchost.exe 8863744 43024 45224 3776512 3776512 540 20 4 6
00000248 spoolsv.exe 15802368 52044 141920 10436608 10436608 1289 23 0 17
0000036C beremote.exe 19320832 65920 64480 10698752 10698752 285 16 0 4
00000390 CpqRcmc.exe 3153920 17096 11680 929792 929792 68 3 0 4
000003A4 vcagent.exe 7180288 25944 4044 2195456 2195456 89 4 0 4
000003B4 dfssvc.exe 4165632 18468 14004 1343488 1343488 108 7 0 4
000003CC dlomaintsvcu.ex 4513792 19440 12752 1585152 1585152 102 4 0 4
00000414 inetinfo.exe 13213696 61608 91812 7565312 7565312 742 34 1 4
00000438 LLSSRV.EXE 6651904 22012 15372 3080192 3080192 182 12 1 4
00000458 ntfrs.exe 991232 26700 12604 5914624 5914624 529 20 0 4
00000494 svchost.exe 2646016 15908 3408 692224 692224 73 2 1 4
000004A4 regsvc.exe 1720320 11680 10172 450560 450560 38 2 0 4
000004B0 LOCATOR.EXE 2248704 14176 10848 643072 643072 40 3 0 4
000004C8 mstask.exe 5664768 25440 15668 1437696 1437696 127 7 1 20
000004E4 SNMP.EXE 5185536 20592 51240 2301952 2301952 252 10 0 4
00000538 WinMgmt.exe 2334720 24080 21424 3330048 3330048 202 8 0 4
00000540 winvnc4.exe 4739072 25016 6940 1302528 1302528 96 4 3 8
000005B0 svchost.exe 16232448 40208 10956 10985472 10985472 418 7 0 4
000005D0 cqmgserv.exe 2150400 15164 3912 655360 655360 93 8 0 4
000005E0 cqmgstor.exe 4005888 21592 6288 1236992 1236992 178 8 0 4
0000063C ismserv.exe 7503872 37848 12368 2568192 2568192 334 13 0 8
00000678 msdtc.exe 6090752 26288 14844 1912832 1912832 176 21 0 4
000006D8 sysdown.exe 2727936 16068 3312 794624 794624 45 3 0 4
00000820 explorer.exe 1626112 55716 23636 7725056 7725056 504 14 186 196
00000954 cpqteam.exe 1949696 17812 1876 385024 385024 26 1 2 6
0000094C StatusClient.ex 4403200 21108 5176 1310720 1310720 109 7 0 4
0000068C atiptaxx.exe 3825664 23320 2708 1019904 1019904 79 2 20 42
00000970 OrderReminder.e 1896448 21400 2180 503808 503808 263 2 2 10
00000978 jusched.exe 2199552 16820 2232 577536 577536 27 1 1 4
0000098C jucheck.exe 6029312 31428 5380 2695168 2695168 166 5 3 6
00000998 svchost.exe 3887104 19280 15900 1576960 1576960 157 10 2 6
000009C0 svchost.exe 5931008 22000 14516 2564096 2564096 176 4 1 4
00000A14 HPBPRO.EXE 34463744 1474220 3308 32223232 32223232 181572 5 1 4
00000854 javaw.exe 18944000 26436 21688 16801792 16801792 372 22 0 4
00000D58 DLLHOST.EXE 5804032 20440 4828 1634304 1634304 139 8 0 0
00063108 Fmserver.exe 9273344 23052 94692 6418432 6418432 242 18 1 4
0006B8AC TASKMGR.EXE 1474560 21244 3072 786432 786432 44 3 107 79
00070260 mmc.exe 2486272 39384 5896 2154496 2154496 127 4 69 129
00000660 DNS.EXE 11071488 622448 1483016 8077312 8077312 5143 14 0 4
00071D70 memsnap.exe 1044480 12548 1588 274432 274432 16 1 0 4
I did a memsnap (see below) and noticed that the NP Pool for DNS.exe is running very high, or so I think.
Any other processes that might be causing this performance issue? Has anyone encountered this before?
Thanks in advance for any insight on this.
ProLiant ML350, Windows 2000 Server sp4, 2GB RAM, 2.26Mhz PIII
Process ID Proc.Name Wrkng.Set PagedPool NonPgdPl Pagefile Commit Handles Threads User Gdi
!LogType=memsnap
!ComputerName=FHPC
!buildnumber=2195
!buildtype=retail
!CSDVersion=Service Pack 4
!SystemTime=11\11\2008 20:03:16.0667 (GMT)
!TickCount=249967187
00000000 (null) 16384 0 0 0 0 0 1 0 0
00000008 System 225280 0 0 28672 28672 774 49 0 0
000000CC SMSS.EXE 430080 5932 1252 1110016 1110016 36 6 0 0
000000E4 CSRSS.EXE 1552384 42292 6560 1482752 1482752 650 12 0 0
000000FC WINLOGON.EXE 4202496 39360 70352 7753728 7753728 425 17 7 21
00000118 SERVICES.EXE 14139392 42816 569736 4788224 4788224 752 42 0 4
00000124 LSASS.EXE 91324416 70608 278600 85712896 85712896 981 43 0 6
00000188 termsrv.exe 4300800 18716 13640 2076672 2076672 104 12 0 4
000001E4 svchost.exe 4907008 26400 33884 1691648 1691648 327 11 0 4
00000220 svchost.exe 8863744 43024 45224 3776512 3776512 540 20 4 6
00000248 spoolsv.exe 15802368 52044 141920 10436608 10436608 1289 23 0 17
0000036C beremote.exe 19320832 65920 64480 10698752 10698752 285 16 0 4
00000390 CpqRcmc.exe 3153920 17096 11680 929792 929792 68 3 0 4
000003A4 vcagent.exe 7180288 25944 4044 2195456 2195456 89 4 0 4
000003B4 dfssvc.exe 4165632 18468 14004 1343488 1343488 108 7 0 4
000003CC dlomaintsvcu.ex 4513792 19440 12752 1585152 1585152 102 4 0 4
00000414 inetinfo.exe 13213696 61608 91812 7565312 7565312 742 34 1 4
00000438 LLSSRV.EXE 6651904 22012 15372 3080192 3080192 182 12 1 4
00000458 ntfrs.exe 991232 26700 12604 5914624 5914624 529 20 0 4
00000494 svchost.exe 2646016 15908 3408 692224 692224 73 2 1 4
000004A4 regsvc.exe 1720320 11680 10172 450560 450560 38 2 0 4
000004B0 LOCATOR.EXE 2248704 14176 10848 643072 643072 40 3 0 4
000004C8 mstask.exe 5664768 25440 15668 1437696 1437696 127 7 1 20
000004E4 SNMP.EXE 5185536 20592 51240 2301952 2301952 252 10 0 4
00000538 WinMgmt.exe 2334720 24080 21424 3330048 3330048 202 8 0 4
00000540 winvnc4.exe 4739072 25016 6940 1302528 1302528 96 4 3 8
000005B0 svchost.exe 16232448 40208 10956 10985472 10985472 418 7 0 4
000005D0 cqmgserv.exe 2150400 15164 3912 655360 655360 93 8 0 4
000005E0 cqmgstor.exe 4005888 21592 6288 1236992 1236992 178 8 0 4
0000063C ismserv.exe 7503872 37848 12368 2568192 2568192 334 13 0 8
00000678 msdtc.exe 6090752 26288 14844 1912832 1912832 176 21 0 4
000006D8 sysdown.exe 2727936 16068 3312 794624 794624 45 3 0 4
00000820 explorer.exe 1626112 55716 23636 7725056 7725056 504 14 186 196
00000954 cpqteam.exe 1949696 17812 1876 385024 385024 26 1 2 6
0000094C StatusClient.ex 4403200 21108 5176 1310720 1310720 109 7 0 4
0000068C atiptaxx.exe 3825664 23320 2708 1019904 1019904 79 2 20 42
00000970 OrderReminder.e 1896448 21400 2180 503808 503808 263 2 2 10
00000978 jusched.exe 2199552 16820 2232 577536 577536 27 1 1 4
0000098C jucheck.exe 6029312 31428 5380 2695168 2695168 166 5 3 6
00000998 svchost.exe 3887104 19280 15900 1576960 1576960 157 10 2 6
000009C0 svchost.exe 5931008 22000 14516 2564096 2564096 176 4 1 4
00000A14 HPBPRO.EXE 34463744 1474220 3308 32223232 32223232 181572 5 1 4
00000854 javaw.exe 18944000 26436 21688 16801792 16801792 372 22 0 4
00000D58 DLLHOST.EXE 5804032 20440 4828 1634304 1634304 139 8 0 0
00063108 Fmserver.exe 9273344 23052 94692 6418432 6418432 242 18 1 4
0006B8AC TASKMGR.EXE 1474560 21244 3072 786432 786432 44 3 107 79
00070260 mmc.exe 2486272 39384 5896 2154496 2154496 127 4 69 129
00000660 DNS.EXE 11071488 622448 1483016 8077312 8077312 5143 14 0 4
00071D70 memsnap.exe 1044480 12548 1588 274432 274432 16 1 0 4
Hi,
Any luck with this?
Cheers.
Any luck with this?
Cheers.
ASKER
Thank you so much, JoWick, for your attention to this. Unfortunately, I haven't had much luck yet. From the link you sent me and further researching, I've come to the conclusion that this stems from a software app. However, I'm not sure which one. Attached is a list of programs I have installed on the server. Do you, or anyone, see a red flag? Thank you in advance.
program-list.txt
program-list.txt
Hi,
I've gone through your list and cannot find anything that might cause the issue. I see that you have about all the updates installed. Have you searched for further updates?
I've gone through your list and cannot find anything that might cause the issue. I see that you have about all the updates installed. Have you searched for further updates?
ASKER
Tomorrow, the following fine updates will be installed:
KB954430
KB954459
KB955069
KB957097
KB890830
KB954430
KB954459
KB955069
KB957097
KB890830
Ok, Let it install and let me know if the problem persists.
ASKER
Will do - thank you again. I'll be in touch...
ASKER
Alrighty - all was well for about 7 days after updating the server and rebooting it. However, today it started getting s-l-o-w again. Fortunately, before it actually froze up, I was able to open task mgr and check things out. Here's two things that I found to be alarming...
hpbpro.exe: 93K mem usage, 91K vmem usage
LSASS.exe: 94K mem usage, 89K vmem usage, 87-100% CPU
I know that lsass is the local auth service, so i'm not touching that. But the hpbpro.exe is HP's port resolver and there's tons about it on google. I'm also going to search EE and see what I can find about it, as well.
If you or anyone has anything to add, I thank you in advance.
- Mike
hpbpro.exe: 93K mem usage, 91K vmem usage
LSASS.exe: 94K mem usage, 89K vmem usage, 87-100% CPU
I know that lsass is the local auth service, so i'm not touching that. But the hpbpro.exe is HP's port resolver and there's tons about it on google. I'm also going to search EE and see what I can find about it, as well.
If you or anyone has anything to add, I thank you in advance.
- Mike
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you JoWick. Since it wasn't included with the OS, I had to get msconfig.exe for win2000 from here:
http://www2.whidbey.net/djdenham/Msconfig.htm
And I've unticked both services you've suggested and I will be rebooting tomorrow morning (12/19).
I've ruled out LSASS as a culprit since it seems to be running the same today as it was when it crashed yesterday. So I'm thinking that it's memory usage is normal.
Again, thanks for your help. I'll update this ticket in a week or so at the latest. Take care...
http://www2.whidbey.net/djdenham/Msconfig.htm
And I've unticked both services you've suggested and I will be rebooting tomorrow morning (12/19).
I've ruled out LSASS as a culprit since it seems to be running the same today as it was when it crashed yesterday. So I'm thinking that it's memory usage is normal.
Again, thanks for your help. I'll update this ticket in a week or so at the latest. Take care...
Yeah, I would love to know if this will sort your issue.
Have a good week.
Have a good week.
ASKER
JoWick - it seems this problem has been solved by disabling those two services. The server hasn't hung up in two weeks. Hopefully it will continue to operate without any further instability, thanks to your time and effort. Thank you very much. Happy new year. - Mike
The following article explains your issue:
http://support.microsoft.com/kb/822219
Do you have any 3rd party software running on the server?
Cheers.