Memory Leak?

  • Thread starter Thread starter Robert Zahm
  • Start date Start date
R

Robert Zahm

I think I have a memory leak, and I'm wondering if this KB applies to my
situation: http://support.microsoft.com/default.aspx?scid=kb;en-us;835517.

This server runs Sophos anti virus, and after updating the NIC drivers and
rejoining the (SBS2003) domain, I see the following in the System event log
(event log started @ 7:56:12):

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 9/16/2005
Time: 8:38:12 AM
User: N/A
Computer: BRADFORD-W2K
Description:
Application popup: Windows - Virtual Memory Minimum Too Low : Your system is
low on virtual memory. Windows is increasing the size of your virtual memory
paging file. During this process, memory requests for some applications may
be denied. For more information, see Help.


Event Type: Warning
Event Source: MRxSmb
Event Category: None
Event ID: 3034
Date: 9/16/2005
Time: 9:07:06 AM
User: N/A
Computer: BRADFORD-W2K
Description:
The redirector was unable to initialize security context or query context
attributes.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 08 00 02 00 56 00 ......V.
0008: 00 00 00 00 da 0b 00 80 ....Ú..€
0010: 00 00 00 00 9a 00 00 c0 ....š..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 7d 04 00 00 9a 00 00 c0 }...š..À


Event Type: Error
Event Source: Srv
Event Category: None
Event ID: 2020
Date: 9/16/2005
Time: 9:07:26 AM
User: N/A
Computer: BRADFORD-W2K
Description:
The server was unable to allocate from the system paged pool because the
pool was empty.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 e4 07 00 c0 ....ä..À
0010: 00 00 00 00 9a 00 00 c0 ....š..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 02 00 00 00 ....


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 9/16/2005
Time: 9:13:44 AM
User: N/A
Computer: BRADFORD-W2K
Description:
The Sophos Message Router service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000
milliseconds: Restart the service.

And then Sophos continues this trend...

Any ideas, or suggestions for tracking down this memory problem would be
appreciated.

Thanks,

Robert Zahm
 
Take a snapshot of Task Manager|Processes just after startup. Then check it
again later to see what process is ballooning.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I think I have a memory leak, and I'm wondering if this KB applies to my
| situation: http://support.microsoft.com/default.aspx?scid=kb;en-us;835517.
|
| This server runs Sophos anti virus, and after updating the NIC drivers and
| rejoining the (SBS2003) domain, I see the following in the System event
log
| (event log started @ 7:56:12):
|
| Event Type: Information
| Event Source: Application Popup
| Event Category: None
| Event ID: 26
| Date: 9/16/2005
| Time: 8:38:12 AM
| User: N/A
| Computer: BRADFORD-W2K
| Description:
| Application popup: Windows - Virtual Memory Minimum Too Low : Your system
is
| low on virtual memory. Windows is increasing the size of your virtual
memory
| paging file. During this process, memory requests for some applications
may
| be denied. For more information, see Help.
|
|
| Event Type: Warning
| Event Source: MRxSmb
| Event Category: None
| Event ID: 3034
| Date: 9/16/2005
| Time: 9:07:06 AM
| User: N/A
| Computer: BRADFORD-W2K
| Description:
| The redirector was unable to initialize security context or query context
| attributes.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 00 00 08 00 02 00 56 00 ......V.
| 0008: 00 00 00 00 da 0b 00 80 ....Ú..?
| 0010: 00 00 00 00 9a 00 00 c0 ....s..À
| 0018: 00 00 00 00 00 00 00 00 ........
| 0020: 00 00 00 00 00 00 00 00 ........
| 0028: 7d 04 00 00 9a 00 00 c0 }...s..À
|
|
| Event Type: Error
| Event Source: Srv
| Event Category: None
| Event ID: 2020
| Date: 9/16/2005
| Time: 9:07:26 AM
| User: N/A
| Computer: BRADFORD-W2K
| Description:
| The server was unable to allocate from the system paged pool because the
| pool was empty.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 00 00 04 00 01 00 54 00 ......T.
| 0008: 00 00 00 00 e4 07 00 c0 ....ä..À
| 0010: 00 00 00 00 9a 00 00 c0 ....s..À
| 0018: 00 00 00 00 00 00 00 00 ........
| 0020: 00 00 00 00 00 00 00 00 ........
| 0028: 02 00 00 00 ....
|
|
| Event Type: Error
| Event Source: Service Control Manager
| Event Category: None
| Event ID: 7031
| Date: 9/16/2005
| Time: 9:13:44 AM
| User: N/A
| Computer: BRADFORD-W2K
| Description:
| The Sophos Message Router service terminated unexpectedly. It has done
this
| 1 time(s). The following corrective action will be taken in 60000
| milliseconds: Restart the service.
|
| And then Sophos continues this trend...
|
| Any ideas, or suggestions for tracking down this memory problem would be
| appreciated.
|
| Thanks,
|
| Robert Zahm
|
|
 
Dave,

A process called RouterNT.exe is the one taking wild swings in memory. This
is a process used by our anti-virus software (Sophos). They claim that it
is an issue with the network card that is causing this.

The KB article that I referred to talks about a memory leak with RPC calls.
So my assumption is that Sophos is making many RPC calls, and the memory
leak referred to by the article is then causing the memory issues. My only
concern is that I don't want to install a hotfix if this isn't the issue.
The KB article specifically refers to Microsoft Operations Manager (MOM),
and I'm wondering if this could be caused by the enterprise anti-virus
software we have installed as well.

Thanks,

Rob


Dave Patrick said:
Take a snapshot of Task Manager|Processes just after startup. Then check
it
again later to see what process is ballooning.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I think I have a memory leak, and I'm wondering if this KB applies to my
| situation:
http://support.microsoft.com/default.aspx?scid=kb;en-us;835517.
|
| This server runs Sophos anti virus, and after updating the NIC drivers
and
| rejoining the (SBS2003) domain, I see the following in the System event
log
| (event log started @ 7:56:12):
|
| Event Type: Information
| Event Source: Application Popup
| Event Category: None
| Event ID: 26
| Date: 9/16/2005
| Time: 8:38:12 AM
| User: N/A
| Computer: BRADFORD-W2K
| Description:
| Application popup: Windows - Virtual Memory Minimum Too Low : Your
system
is
| low on virtual memory. Windows is increasing the size of your virtual
memory
| paging file. During this process, memory requests for some applications
may
| be denied. For more information, see Help.
|
|
| Event Type: Warning
| Event Source: MRxSmb
| Event Category: None
| Event ID: 3034
| Date: 9/16/2005
| Time: 9:07:06 AM
| User: N/A
| Computer: BRADFORD-W2K
| Description:
| The redirector was unable to initialize security context or query
context
| attributes.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 00 00 08 00 02 00 56 00 ......V.
| 0008: 00 00 00 00 da 0b 00 80 ....Ú..?
| 0010: 00 00 00 00 9a 00 00 c0 ....s..À
| 0018: 00 00 00 00 00 00 00 00 ........
| 0020: 00 00 00 00 00 00 00 00 ........
| 0028: 7d 04 00 00 9a 00 00 c0 }...s..À
|
|
| Event Type: Error
| Event Source: Srv
| Event Category: None
| Event ID: 2020
| Date: 9/16/2005
| Time: 9:07:26 AM
| User: N/A
| Computer: BRADFORD-W2K
| Description:
| The server was unable to allocate from the system paged pool because the
| pool was empty.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 00 00 04 00 01 00 54 00 ......T.
| 0008: 00 00 00 00 e4 07 00 c0 ....ä..À
| 0010: 00 00 00 00 9a 00 00 c0 ....s..À
| 0018: 00 00 00 00 00 00 00 00 ........
| 0020: 00 00 00 00 00 00 00 00 ........
| 0028: 02 00 00 00 ....
|
|
| Event Type: Error
| Event Source: Service Control Manager
| Event Category: None
| Event ID: 7031
| Date: 9/16/2005
| Time: 9:13:44 AM
| User: N/A
| Computer: BRADFORD-W2K
| Description:
| The Sophos Message Router service terminated unexpectedly. It has done
this
| 1 time(s). The following corrective action will be taken in 60000
| milliseconds: Restart the service.
|
| And then Sophos continues this trend...
|
| Any ideas, or suggestions for tracking down this memory problem would be
| appreciated.
|
| Thanks,
|
| Robert Zahm
|
|
Click to expand...
 
It certainly looks promising. Maybe you can get Sophos to give you more
details of their issue. This may put you and the product support engineer in
a better position to decide if the hotfix is applicable.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Dave,
|
| A process called RouterNT.exe is the one taking wild swings in memory.
This
| is a process used by our anti-virus software (Sophos). They claim that it
| is an issue with the network card that is causing this.
|
| The KB article that I referred to talks about a memory leak with RPC
calls.
| So my assumption is that Sophos is making many RPC calls, and the memory
| leak referred to by the article is then causing the memory issues. My
only
| concern is that I don't want to install a hotfix if this isn't the issue.
| The KB article specifically refers to Microsoft Operations Manager (MOM),
| and I'm wondering if this could be caused by the enterprise anti-virus
| software we have installed as well.
|
| Thanks,
|
| Rob
 
Dave,

Thanks, I've done that as well; I posted here in an attempt to cover all the
bases before installing a hotfix, you never know if someone else has had the
exact same issue.

Thanks,

Rob
 
Back
Top