Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1369
  • Last Modified:

Memory Leak?

For the last few weeks, one of my DCs has been freezing up and it needs rebooted to revcover it.  After a reboot, I find EVENT ID 2019's (The server was unable to allocate from the system nonpaged pool because the pool was empty) in the eventlog.  

I did a memsnap (see below) and noticed that the NP Pool for DNS.exe is running very high, or so I think.

Any other processes that might be causing this performance issue?  Has anyone encountered this before?  

Thanks in advance for any insight on this.

ProLiant ML350, Windows 2000 Server sp4, 2GB RAM, 2.26Mhz PIII


Process ID         Proc.Name Wrkng.Set PagedPool  NonPgdPl  Pagefile    Commit   Handles   Threads      User       Gdi
!LogType=memsnap
!ComputerName=FHPC
!buildnumber=2195
!buildtype=retail
!CSDVersion=Service Pack 4
!SystemTime=11\11\2008 20:03:16.0667 (GMT)
!TickCount=249967187
00000000              (null)     16384         0         0         0         0         0         1         0         0
00000008              System    225280         0         0     28672     28672       774        49         0         0
000000CC            SMSS.EXE    430080      5932      1252   1110016   1110016        36         6         0         0
000000E4           CSRSS.EXE   1552384     42292      6560   1482752   1482752       650        12         0         0
000000FC        WINLOGON.EXE   4202496     39360     70352   7753728   7753728       425        17         7        21
00000118        SERVICES.EXE  14139392     42816    569736   4788224   4788224       752        42         0         4
00000124           LSASS.EXE  91324416     70608    278600  85712896  85712896       981        43         0         6
00000188         termsrv.exe   4300800     18716     13640   2076672   2076672       104        12         0         4
000001E4         svchost.exe   4907008     26400     33884   1691648   1691648       327        11         0         4
00000220         svchost.exe   8863744     43024     45224   3776512   3776512       540        20         4         6
00000248         spoolsv.exe  15802368     52044    141920  10436608  10436608      1289        23         0        17
0000036C        beremote.exe  19320832     65920     64480  10698752  10698752       285        16         0         4
00000390         CpqRcmc.exe   3153920     17096     11680    929792    929792        68         3         0         4
000003A4         vcagent.exe   7180288     25944      4044   2195456   2195456        89         4         0         4
000003B4          dfssvc.exe   4165632     18468     14004   1343488   1343488       108         7         0         4
000003CC     dlomaintsvcu.ex   4513792     19440     12752   1585152   1585152       102         4         0         4
00000414        inetinfo.exe  13213696     61608     91812   7565312   7565312       742        34         1         4
00000438          LLSSRV.EXE   6651904     22012     15372   3080192   3080192       182        12         1         4
00000458           ntfrs.exe    991232     26700     12604   5914624   5914624       529        20         0         4
00000494         svchost.exe   2646016     15908      3408    692224    692224        73         2         1         4
000004A4          regsvc.exe   1720320     11680     10172    450560    450560        38         2         0         4
000004B0         LOCATOR.EXE   2248704     14176     10848    643072    643072        40         3         0         4
000004C8          mstask.exe   5664768     25440     15668   1437696   1437696       127         7         1        20
000004E4            SNMP.EXE   5185536     20592     51240   2301952   2301952       252        10         0         4
00000538         WinMgmt.exe   2334720     24080     21424   3330048   3330048       202         8         0         4
00000540         winvnc4.exe   4739072     25016      6940   1302528   1302528        96         4         3         8
000005B0         svchost.exe  16232448     40208     10956  10985472  10985472       418         7         0         4
000005D0        cqmgserv.exe   2150400     15164      3912    655360    655360        93         8         0         4
000005E0        cqmgstor.exe   4005888     21592      6288   1236992   1236992       178         8         0         4
0000063C         ismserv.exe   7503872     37848     12368   2568192   2568192       334        13         0         8
00000678           msdtc.exe   6090752     26288     14844   1912832   1912832       176        21         0         4
000006D8         sysdown.exe   2727936     16068      3312    794624    794624        45         3         0         4
00000820        explorer.exe   1626112     55716     23636   7725056   7725056       504        14       186       196
00000954         cpqteam.exe   1949696     17812      1876    385024    385024        26         1         2         6
0000094C     StatusClient.ex   4403200     21108      5176   1310720   1310720       109         7         0         4
0000068C        atiptaxx.exe   3825664     23320      2708   1019904   1019904        79         2        20        42
00000970     OrderReminder.e   1896448     21400      2180    503808    503808       263         2         2        10
00000978         jusched.exe   2199552     16820      2232    577536    577536        27         1         1         4
0000098C         jucheck.exe   6029312     31428      5380   2695168   2695168       166         5         3         6
00000998         svchost.exe   3887104     19280     15900   1576960   1576960       157        10         2         6
000009C0         svchost.exe   5931008     22000     14516   2564096   2564096       176         4         1         4
00000A14          HPBPRO.EXE  34463744   1474220      3308  32223232  32223232    181572         5         1         4
00000854           javaw.exe  18944000     26436     21688  16801792  16801792       372        22         0         4
00000D58         DLLHOST.EXE   5804032     20440      4828   1634304   1634304       139         8         0         0
00063108        Fmserver.exe   9273344     23052     94692   6418432   6418432       242        18         1         4
0006B8AC         TASKMGR.EXE   1474560     21244      3072    786432    786432        44         3       107        79
00070260             mmc.exe   2486272     39384      5896   2154496   2154496       127         4        69       129
00000660             DNS.EXE  11071488    622448   1483016   8077312   8077312      5143        14         0         4
00071D70         memsnap.exe   1044480     12548      1588    274432    274432        16         1         0         4
0
fhpcis
Asked:
fhpcis
  • 6
  • 6
1 Solution
 
JoWickermanCommented:
Hi fhpcis,

The following article explains your issue:

http://support.microsoft.com/kb/822219

Do you have any 3rd party software running on the server?

Cheers.
0
 
JoWickermanCommented:
Hi,

Any luck with this?

Cheers.
0
 
fhpcisAuthor Commented:
Thank you so much, JoWick, for your attention to this.  Unfortunately, I haven't had much luck yet.  From the link you sent me and further researching, I've come to the conclusion that this stems from a software app.  However, I'm not sure which one.  Attached is a list of programs I have installed on the server.  Do you, or anyone, see a red flag?  Thank you in advance.

program-list.txt
0
Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
JoWickermanCommented:
Hi,

I've gone through your list and cannot find anything that might cause the issue. I see that you have about all the updates installed. Have you searched for further updates?
0
 
fhpcisAuthor Commented:
Tomorrow, the following fine updates will be installed:

KB954430
KB954459
KB955069
KB957097
KB890830
0
 
JoWickermanCommented:
Ok, Let it install and let me know if the problem persists.

0
 
fhpcisAuthor Commented:
Will do - thank you again.  I'll be in touch...
0
 
fhpcisAuthor Commented:
Alrighty - all was well for about 7 days after updating the server and rebooting it.  However, today it started getting s-l-o-w again.  Fortunately, before it actually froze up, I was able to open task mgr and check things out.  Here's two things that I found to be alarming...

hpbpro.exe:  93K mem usage, 91K vmem usage
LSASS.exe:  94K mem usage, 89K vmem usage, 87-100% CPU

I know that lsass is the local auth service, so i'm not touching that.  But the hpbpro.exe is HP's port resolver and there's tons about it on google.  I'm also going to search EE and see what I can find about it, as well.

If you or anyone has anything to add, I thank you in advance.

- Mike
0
 
JoWickermanCommented:
Hi Mike,

1. go to start->run, type in msconfig
2. Choose the Startup tab, look for StatusClient and hpbpsttp services, verify that they have their location in "C:ProgramFiles\Hewlett-Packard" folder, and untick them.
3. Then restart your computer

This should solve the hpbpro.exe issue. (It's a HP printer driver know for its memory leaks!!!)

0
 
fhpcisAuthor Commented:
Thank you JoWick.  Since it wasn't included with the OS, I had to get msconfig.exe for win2000 from here:  

http://www2.whidbey.net/djdenham/Msconfig.htm

And I've unticked both services you've suggested and I will be rebooting tomorrow morning (12/19).  

I've ruled out LSASS as a culprit since it seems to be running the same today as it was when it crashed yesterday.  So I'm thinking that it's memory usage is normal.  

Again, thanks for your help.  I'll update this ticket in a week or so at the latest.  Take care...
0
 
JoWickermanCommented:
Yeah, I would love to know if this will sort your issue.

Have a good week.
0
 
fhpcisAuthor Commented:
JoWick - it seems this problem has been solved by disabling those two services.  The server hasn't hung up in two weeks.  Hopefully it will continue to operate without any further instability, thanks to your time and effort.  Thank you very much.  Happy new year.  - Mike
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 6
  • 6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now