Solved

Tracerpt.exe consumed 60GB (!) of virtual memory

Posted on 2016-10-31
5
59 Views
Last Modified: 2016-11-07
A PC froze and found this in the event logs.
Event ID 2004
Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: tracerpt.exe (43376) consumed 60695384064 bytes...

I set up perfmon monitoring on a few PCs a few weeks ago. It is set to re-start everyday at 12AM. Have not had any issues with it until this.
This event also has not occurred at any other time other than when the PC froze.

I am only collecting these under Performance Counters
\Memory\% Committed Bytes in Use
\Memory\Available MBytes
\Process(*)\% Privileged Time
\Process(*)\% Processor Time
\Process(*)\% User Time

Any idea how tracerpt.exe grew so large and how I could stop it from happening again?

If I delete the 'NT Kernel' Trace monitor from collection, would it help?
0
Comment
Question by:SeeDk
  • 3
5 Comments
 

Expert Comment

by:Arion Sejdia
ID: 41866904
Tracerpt.exe is a commonly used name for malicious pieces of code.

Boot into Safe Mode (Press F8 continuously on startup)
Use an Anti-Virus in safe mode, Malwarebytes is a good one.

If it keeps freezing, you might have to take it in for repairs.
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 41866967
The genuine tracerpt.exe has to scan the event log. There might be an issue with the event log, but in any case it is a bug I would monitor further for.
On the other hand, if you are not aware of any event log monitoring, why should it run at first place?
0
 

Author Comment

by:SeeDk
ID: 41867066
@Arion
I set up Performance Monitoring (perfmon) on this PC, so it's likely to be related to that rather than a virus. I can check to make sure but perfmon seems to be the issue here. I have it paused now so if it runs again on its own, i'll know it is something else.
https://technet.microsoft.com/en-us/library/cc732700(WS.10).aspx

@Qlemo
I am aware of monitoring. That is why I mentioned in the first post that I enabled perfmon on this PC.
It is set to run at all hours of the day gathering the process info that I listed.
Its only been enabled since last Monday, but it gave me no issues until today.
0
 

Accepted Solution

by:
SeeDk earned 0 total points
ID: 41870479
I think this is resolved now.
The tracerpt.exe process is only started when perfmon has finished collecting data and compiles the information to generate a report. It must have encountered an error while compiling which led to that memory usage.
For my purposes, i don't need the report and can work with only the .blg file.

I disabled the reporting from the Data Manager tab and it has run smoothly the past few days.
No trace (ha!) of the tracerpt.exe process running on the PCs while perfmon is collecting data.
0
 

Author Closing Comment

by:SeeDk
ID: 41876878
found the solution on my own
0

Featured Post

Courses: Start Training Online With Pros, Today

Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup" or a blinking cursor with black screen. A loop for Auto repair will start but fix nothing.  You will be panic as there are no back…
The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now