[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3026
  • Last Modified:

Insufficient Memory Errors when plenty is avaliable

The first sign of this occured when opening sophos Anti-Virus. The first attachment shows the error given off by Sophos.

While trying a screen shot of some of the errors I found that my clipboard was not even working properly. When I print screened the result that pasted into mspaint was 2 colour B&W.
Now I do not even get that when pasting into mspaint I just get the errors saying "Error getting the clipboard data" and "There is not enough memory or resources to complete operation".

When I goto windows/system32 and open the clipbrd.exe I get the errors shown in the 2nd and 3rd attached images. I have 2 of these to show you the resources and the top memory granted applications.

This is running Windows Server 2003 and I do not wish to reset the system. I would like to first work out why it has done this before resulting to a restart.
Any ideas?
img-407124933.pdf
untitled1.GIF
untitled2.GIF
0
bnoyzy
Asked:
bnoyzy
  • 8
  • 3
  • 2
  • +2
1 Solution
 
atternoCommented:
Suspected IRP stack size Issue. Backup your registry and increase the stack size by following the instructions on the page given below.

http://support.microsoft.com/kb/177078

Post back if in need of further assistance.
0
 
bnoyzyAuthor Commented:
Thanks for the reply atterno,
Currently I do not have IRPStackSize in my registry.
Before I go adding the IRPStackSize DWord value to my registry and giving it a default of 15 can you please give me more information on what this actually does and why its used. I can not find much information on exactly what an IRPStack is.

Also looking at the link you refered me to I am not sure if it totally refers to my case but again I do not understand what IRPStack is. I am not suffering from clients of this server unable to connect to their network shares located on the server and I can not find an error message in my event viewer that is similar to the error shown in the link.

All additional information would be greatly appriciated.
0
 
PCBONEZCommented:
All memory errors are not RAM.

Possible:
Too small a virtual memory.
Hard drive too full to allow virtual memory to run.
Failing capacitors in RAM Voltage Regulator or supplying Memory Controller.
0
Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

 
bnoyzyAuthor Commented:
PCBONEZ, Thanks for your reply,
I will have to check what the virtual memory is set at, will get back to you on that one.
Hard drives have over 200GB free space each.
Do not know what I would test or do anything about the third possibility
0
 
warturtleCommented:
Hello,

You might have too many applications running in the background or conflicting software on your server. Do you have 2 antiviruses?? or 2 anti-spyware applications running in the background? Maybe, a HijackThis log might help to see whats running in the background. It can be downloaded from:

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Hope it helps.
0
 
PCBONEZCommented:
Without special equipment all you can to to check caps is a visual.
Look for bloating and leakage.
Also can check if the motherboard has a history of cap problems.
What is the motherboard?
0
 
atternoCommented:
Regarding your query, bnoyzy:

IRPStackSize stands for I/O Request Packets (IRPs) Stack Size.  
The count of IRP stack locations used by default for AFD (Ancillary function driver).    
Specifies how many stack locations the Server service (srv.sys) establishes for I/O Request Packets (IRPs).  
On some Windows Server 2003 RTM/SP1/R2/SP2 Failover Clusters, it might be necessary to increase this number for certain transports or if you have many file system drivers (and kernel filter drivers such as antivirus programs) installed on the system.  
Each stack uses 36 bytes of memory for each  receive buffer and you can increase the IRPStackSize, through the  Windows  registry for some transports, media access control (MAC) drivers, or for  file  system drivers. The default value of the IRPStackSize parameter is 15.
0
 
bdesmondCommented:
I'd suggest that while potentially interesting, your IRP stack size has nothing to do with this, the capacitors in your machine are still good, and your hard drive has more than enough space.

This is a really generic error, alot of things can return it. Can you add the GDI Objects column to Task Manager and post another screenshot? Sort it descending.

Thanks,
Brian Desmond
Active Directory MVP
0
 
bnoyzyAuthor Commented:
warturtle, I run only with Sophos for this client and no other applications have changed since before this issue. I will however run hijack this just to ensure nothing is running I do not know about since I assessed this system last.

PCBONEZ, I have checked all capacitors for bloating at the tops or visible leakage the other day and they all looked fine, thanks for the advice.
When I get to the server again I will get its MOBO model and search the net for known cap problems. I will also post the Model num up here as you requested.

atterno, thanks for explaining IRPStack size its a very interesting concept. If all other avenues fail I will try increasing this value and let you know the results.

bdesmond, I have just had a quick read about GDI and GDI+ and I believe there's a chance that this could be what I am witnessing (applications using up all the GDI Objects and not allowing enough for the printscreen process to run at all or properly). Do you know how many GDI Objects Windows Server 2003 can use at one time?
When I get back to this system on Tuesday I will have a look at the GDI Objects in use. Practically all applications using window containers and icons are closed but maybe task manager may show something that hasn't closed correctly and is still holding GDI Objects?
I have my doubts though as I read that when all possible GDI Objects are used up the OS can not even show message boxes and yet I get message boxes giving the vast mem error.

I will update my finding on this on Tuesday.
0
 
bnoyzyAuthor Commented:
Here is a screen shot showing the top processes using GDI Objects while the problem is occuring. This makes me believe this isn't the problem right? I read that XP could handle over 10000 simultaneous GDI Objects so I'm guessing server 2003 would be similar.
memprobWith-GDIObj.jpg
0
 
bnoyzyAuthor Commented:
PCBONES, the MOBO is: intel entry server board se7230nh1-e
0
 
bdesmondCommented:
That looks OK. I'd suggest giving PSS a call - this is involved to troubleshoot and not really something that will be productive asynchronously through this forum.

Another thing to check is look at Available PTEs in perfmon - it's under System or Memory IIRC.

Thanks,
Brian Desmond
Active Directory MVP
0
 
bnoyzyAuthor Commented:
Sorry I do not understand who you refer to when you say PSS.
I've looked in perfmon to see the number of Page Table Entries free and there are over 198000. I don't understand what could be wrong though, if theres ample physical memory and virtual memory is there still a chance it is infact a memory issue?

Just a question while looking at information in perfmon... As I understand, the counter: "page faults / sec" refers to the CPU requesting a page from its stored page table that refers to a location not within physical memory and therefore it has to pull it from virtual memory... but what is "pages / sec"? It surely can not mean sucessful lookups of the page table resulting in data/process information within physical memory as this counter rarely changes from 0. I know this is off topic but I would just like to know to further my understanding of memory.
Do the faults in fact just refer to the section of the page table that reside in the CPUs memory (meaning this might not be much of the entire page table and therefore this is why there are hardly any true page lookups per second as its only counted when found in the CPUs portion of the page table)?

0
 
bdesmondCommented:
PSS = Microsoft Product Support Services - http://support.microsoft.com.

That is a good number for Free PTEs.

Thanks,
Brian Desmond
Active Directory MVP
0
 
bnoyzyAuthor Commented:
Update...
I have just noticed that the problem must be conflicting applications. When I open Acronis True Image Server the problem persists. When I close True Image the problem disappears.
I will try contacting Acronis and if they are no help I will resort to Microsofts phone lines.
0
 
warturtleCommented:
Wow, I almost forgot that I actually posted something in this question until angel posted his comment...lol. Good to see that you found the problem, I was pretty sure as well that its a conflicting application. I have seen this error before and each time the root problem was conflicting applications (antivirus or other applications).
0
 
bnoyzyAuthor Commented:
This is the closest solution found. Thanks everyone who contributed as all information was insightful. Sorry for the delay in closing this question I have been otherwise preoccupied hoping to get back to this one. I believe the closest I could get was acronis conflicting in some way and found no problems when not in use.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 8
  • 3
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now