Avatar of c00kie88
c00kie88
Flag for Australia asked on

lsass.exe - memory leak using poolmon

Hi all,

Im trying to understand poolmon output to determine any memory leak for lsass.exe since lsass.exe memory usage keeps increasing.
From doing some research, my understanding is i have to examine the Diff (allocations minus frees) and Bytes (number of bytes allocated minus number of bytes freed) values for each tag, and note any that continually increase.

When i checked the result, why it does have negative value? (see the attached). What does it mean?

Thank you
253.txt
Windows Server 2003

Avatar of undefined
Last Comment
c00kie88

8/22/2022 - Mon
SOLUTION
Bawer

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
c00kie88

ASKER
Hi Bawer,

I have run AVG antivirus but nothing found. At the moment, the lsass.exe memory usage is over 1GB. When i checked yesterday, it was around 950MB.
I'm a bit concerned since the lsass.exe memory usage keeps increasing. And today is saturday and nobody working in the office.
ASKER CERTIFIED SOLUTION
Bawer

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
c00kie88

ASKER
Hi Bawer,

The system has crashed :( ..It has been restarted and lsass.exe is 45 MB now..

The system is windows 2003 32, running DC and exchange.

Will let you know more next week.

See attached for the msconfig.. I dont know what is regsvr32 /s mqrt for..
msconfig.PNG
Bawer

What was the reason of the crash ?

from the MSCONFIG, remove the Re-Rite6  and the Schedhlp.

"regsvr32 /s mqrt.dll
    This command is used to register Microsoft Message Queue
    DLL. MSMQ is installed as part of Microsoft Personal Web Server.
    Accept this change. "

I do not consider this to be running in the startup , you may un-tick the same and restart the machine. Make sure you have the latest backups since the crash is not a good sign.
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
c00kie88

ASKER
The lsass.exe has gone over 1.5GB. We have 8 GB physical RAM and running windows 2003 32 bits.
Bawer

Have you checked on my previous note
c00kie88

ASKER
Hi Bawer,<br /><br />I'm closing the forum without finding problem/solution since the server has migrated to different hardware. <br />I will assign the full points to you for helping me.<br /><br />Thank you
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.