Hi Johnny
Sounds like you have a memory leak. You might want to record a PERFMON log
as follows:
i. Reboot the server.
ii. Start -> Run -> PERFMON -> OK.
iii. Expand "Performance Logs and Alerts".
iv. Right-click "Counter Logs" and select "New Log Settings".
v. Type a name and select OK.
vi. Note the log location for later.
vii. Click the Add button under Counters.
viii. Click the "All Counters" and "All Instances" radio buttons.
ix. Select the following from the "Performance Object" dropdown, being sure
to "Add" each one as you select it;
Memory, Process, Processor, Thread, System
x. Click "Done".
xi. Set "Sample Data Every" to the time in which it takes the problem to
occur divided by 100.
For example if it were 2 weeks, we would use 14 days x 24 hours /
100 = approx 3 hours.
It's better to slightly oversample than undersample.
xii. Click OK.
xiii. Wait for the issue to occur and then harvest the PERFMON log that
you've created.
At this point you'd need to look at the data in the log and look for trends.
You'd start by loading the memory counters and looking for a counter that
ramps. We'd expect to see a ramp associated with nonpaged pool. Once this
is confirmed, you'd load up the corresponding counter for all processes and
look for one that closely matches what you're seeing in the memory counters.
It's also possible that the leak is in a kernel mode component that's not
reflected in PERFMON. That's more difficult to track down ...
177415 How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel
Mode
http://support.microsoft.com/?id=177415
Lastly, if you know what software was installed on the server prior to the
problem starting, uninstall it and see if it goes away ... you mentioned
Altiris agent and McAfee 8.0. Just remove them entirely and see what
happens. You might luck out.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: (e-mail address removed)
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no rights.
Johnny Wright said:
Hi Mark
The full event discription is:
Source: SRV
Catagory: None
Event ID: 2019
The server was unable to allocate from the system nonpaged pool because
the
pool was empty.
Once this happens, users that are already connected to the server can no
longer access shares on it and any users that run their logon script do
not
map the drive to this server.
I have edited the registry to add a reg_word of PoolUsageMaximum with a
value of 40 and set the PagedPoolsize to 0xFFFFFFFF. I have also upgraded
McAfee VirusScan on the servers to 8.0i, as recommend by Network
Accosicates.
This has not worked because the 2019 error occured again last night at
9:14
p.m. I had calls on my voice-mail this morning about people not be able
to
connected to the server.
Any help to resolve this is greatly appreciated.
Johnny
Mark Renoden said:
Hi Johnny
Are you able to provide the full event description? Sometimes there are
different descriptions for the same event ID. Also, are you able to
confirm
that the loss of network connectivity occurs at the same time these
events
are logged or are you just putting two and two together?
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: (e-mail address removed)
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
Johnny Wright said:
With in the last 2 weeks I have been getting event 2019 showing up in
the
event view on 2 of my Windows servers. One is a 2003 Domain Controller
and
the other is a 2000 Member Server. When this event occurs users lose
access
to shared drives, the servers can't find the DHCP or DNS server and the
servers do not respond to pings. I have been rebooting the server
which
temporarily fixes the problem. Now another server is experiencing the
same
thing and it sits at a remote site so rebooting is a much bigger issue.
The only changes to these servers in the past month are (1) installed
Altiris agent, (2) upgraded to McAfee 8.0 and (3) updated most current
MS
security patches.
Can anyone tell me how to resolve this issue?
Thanks in advance for any help.
Johnny
