SBS 2011 Virtual Memory rapidly increases until it crashes the system. SVC host seems to be taking it all up.

Posted on 2012-09-06
Medium Priority
Last Modified: 2012-09-12
We have an SBS11 STD HP box at a site and it has started for no obvious reason to increase the Virtual Memory size rapidly over a period of about 24 hours. This goes up and up until the Exchange Transport service stops and things start to fall over.
I'm trying to traced what is causing this and am using VMMap which shows svchost.exe taking up way more than it should.  This of course contains a lot of running processes, but I'm finding hard to decipher if these processes inside SVC host are causing this or if it's just ballooning itself.  It could be something else as well, however the other server's I've checked have no where near the large svchost usage in the Virtual Memory.
The standard memory or CPU doesn't have a large svchost process, just the virtual memory.  I've confirmed this increasing virtual memory use with perfmon and the graph spike up at a dramatic rate over 24 hours.  The server has 12GB Ram and the Page file is 22gb.  There was a program added very recently that downloads pathology results for this DR surgery and this requires the Server to be logged on all the time (until we can get it to work as a service.!)  Also, recently the 2nd NIC was enabled and then disabled for a few minutes which isn't great to do in SBS I've heard.  Finally we have had issues with a third party monitoring software agent causing WSUS problems and I've stopped the WSUS IIS application pool at the moment to also free some RAM while we get this sorted.
I've attached a screencap of the current VMMap screen inside the svchost.exe process which shows how much it's using at the moment.
Question by:Wbs_compu
LVL 84

Expert Comment

by:David Johnson, CD, MVP
ID: 38374700
sysinternals process monitor (procmon) http://www.microsoft.com/sysinternals/ will help you isolate the process that is running away..

Author Comment

ID: 38374899
Yep I've tried this but it is using virtual memory and not physical memory.  That's why I'm using sysinternal VMMap instead as this look at virtual memory.  Just not sure how to decipher VMMap.
LVL 84

Accepted Solution

David Johnson, CD, MVP earned 2000 total points
ID: 38374926
I reiterate use procmon.. you have to know which process in svchost.exe is using all the memory in order to use vmmap.exe

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

LVL 28

Expert Comment

ID: 38375423
Run anything as a service -


Works a treat.

Chris B

Author Comment

ID: 38375529
Thanks.  I've found a rouge process which dropped the Virtual Memory from 90% to 50% immediately.  I'm testing over the weekend and will assign points/close this if it's the case.

Cheers for the run as a service one burrcm as well.
LVL 12

Expert Comment

ID: 38375783
If you go into task manager, right click on the svchost process that is consuming the virtual memory and select 'Go to services', what services are running under it?

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are a user of the discontinued Microsoft Office Accounting 2008 (MSOA) and have to move to a new computer running Windows 8, you will be unhappy to discover that it won't install.  In particular, Microsoft SQL Server 2005 Express Edition (SSE…
It’s been over a month into 2017, and there is already a sophisticated Gmail phishing email making it rounds. New techniques and tactics, have given hackers a way to authentically impersonate your contacts.How it Works The attack works by targeti…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question