SBS 2011 Virtual Memory rapidly increases until it crashes the system. SVC host seems to be taking it all up.

Posted on 2012-09-06
Last Modified: 2012-09-12
We have an SBS11 STD HP box at a site and it has started for no obvious reason to increase the Virtual Memory size rapidly over a period of about 24 hours. This goes up and up until the Exchange Transport service stops and things start to fall over.
I'm trying to traced what is causing this and am using VMMap which shows svchost.exe taking up way more than it should.  This of course contains a lot of running processes, but I'm finding hard to decipher if these processes inside SVC host are causing this or if it's just ballooning itself.  It could be something else as well, however the other server's I've checked have no where near the large svchost usage in the Virtual Memory.
The standard memory or CPU doesn't have a large svchost process, just the virtual memory.  I've confirmed this increasing virtual memory use with perfmon and the graph spike up at a dramatic rate over 24 hours.  The server has 12GB Ram and the Page file is 22gb.  There was a program added very recently that downloads pathology results for this DR surgery and this requires the Server to be logged on all the time (until we can get it to work as a service.!)  Also, recently the 2nd NIC was enabled and then disabled for a few minutes which isn't great to do in SBS I've heard.  Finally we have had issues with a third party monitoring software agent causing WSUS problems and I've stopped the WSUS IIS application pool at the moment to also free some RAM while we get this sorted.
I've attached a screencap of the current VMMap screen inside the svchost.exe process which shows how much it's using at the moment.
Question by:Wbs_compu
    LVL 77

    Expert Comment

    by:David Johnson, CD, MVP
    sysinternals process monitor (procmon) will help you isolate the process that is running away..

    Author Comment

    Yep I've tried this but it is using virtual memory and not physical memory.  That's why I'm using sysinternal VMMap instead as this look at virtual memory.  Just not sure how to decipher VMMap.
    LVL 77

    Accepted Solution

    I reiterate use procmon.. you have to know which process in svchost.exe is using all the memory in order to use vmmap.exe
    LVL 28

    Expert Comment

    Run anything as a service -

    Works a treat.

    Chris B

    Author Comment

    Thanks.  I've found a rouge process which dropped the Virtual Memory from 90% to 50% immediately.  I'm testing over the weekend and will assign points/close this if it's the case.

    Cheers for the run as a service one burrcm as well.
    LVL 12

    Expert Comment

    If you go into task manager, right click on the svchost process that is consuming the virtual memory and select 'Go to services', what services are running under it?

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    I’m often asked about newer and larger USB drives connected to SBS2008 and 2011 failing Windows Server Backup vs the older USB drives not failing. As disk space continues to grow and drive technology change SBS2008 and some SBS2011 end up with the f…
    Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
    This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
    Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now