Re: print spooler and server service problems

From: Bruce Sanderson (bsanders_at_junk.junk)
Date: 11/12/04 

Date: Thu, 11 Nov 2004 20:06:53 -0800

I would suspect a "memory leak" in some process running on the server,
perhaps one of the printer drivers. Another possibility is the combined set
of processes running on the server is using all the available "non paged
pool memory".

Regardless of how much RAM is installed on the computer, "nonpaged pool
memory" is a limited resource in Windows 2000.

I suggest you monitor the amount of non paged pool memory in use. If this
increases more or less monotonically as time goes by, I'd definitely suspect
a memory leak, which is a kind of software defect. To monitor the non paged
pool memory in use:

1. Start Performance Monitor (Programs, Administrative Tools, Performance)
2. right click anywhere in the graph and select Properties
3. click the Add... button
4. from the "Performance Object" drop down list box, select Memory
5. with the "Select counters from list:" radio button selected, click on
"Pool Nonpaged Bytes", then "Add"
6. click Close
7. select the Pool Nonpaged Bytes entry; from the "Scale:" drop down list
box, select the .000001 entry (this should keep the Nonpaged Pool Bytes line
on the graph from being always at the top - maximum)
8. on the System Monitor Properties panel, select the General tab
9. change the "Sample automatically every:" to 30 or 60 seconds (this will
slow down the graph updating so you can see the trend over a longer period
of time)
10. select the Graph tab and add check marks to "Vertical Grid" and
"Horizontal Grid"
11. click the "light bulb" in the icon bar at the top of the graph and click
the Pool Nonpaged Bytes entry in the counter list. This will cause the Pool
Nonpaged Bytes line to be highlighted so you can easily distinguish it from
the other lines on the graph.

See if the Pool Nonpaged Bytes line creeps up over time.

12. Open Task Manager
13. select the Process tab
14. click View, Select Columns
15. click the Non-paged Pool item to add a check mark to it
16. over time, watch the values in the NP Pool column to see which process
gets more Pool Nonpaged memory over time

If the process "spoolsv.exe" appears to be the culprit, suspect a Printer
Driver. Unfortunately, finding out which Printer Driver may not be easy.
Check the printer manufacturers' web sites for newer driver versions.

If a printer driver is the culprit, it is probably not necessary to stop the
"Server" service; stopping and starting the Print Spooler service should be
sufficient. 

-- 
Bruce Sanderson MVP Printing
It is perfectly useless to know the right answer to the wrong question.
"Mike Brearley" <nospam@spam.com> wrote in message 
news:%23Y0PQrmxEHA.3976@TK2MSFTNGP09.phx.gbl...
> I'm having problems with a Windows 2000 file/print server.  About twice a 
> day I get calls that users are no longer able to print (printers seem to 
> vary).  I end up having to stop the print spooler, restart the server 
> service (which restarts a few other things as well) and then re-start the 
> print spooler.  In the process of doing this, my users temporarily lose 
> connection to their open files.
>
> Any ideas?  Here's some of the event viewer errors I'm getting:
>
> Event Type: Error
> Event Source: Print
> Event Category: None
> Event ID: 61
> Date:  11/9/2004
> Time:  9:28:53 AM
> User:  DOMAIN\username
> Computer: SERVERNAME
> Description:
> The document  owned by username failed to print. Win32 error code returned 
> by the print processor: 5 (0x5).
>
>
> Event Type: Error
> Event Source: Srv
> Event Category: None
> Event ID: 2019
> Date:  11/8/2004
> Time:  9:00:24 AM
> User:  N/A
> Computer: SERVERNAME
> Description:
> The server was unable to allocate from the system nonpaged pool because 
> the pool was empty.
> Data:
> 0000: 00 00 04 00 01 00 54 00   ......T.
> 0008: 00 00 00 00 e3 07 00 c0   ....ã..À
> 0010: 00 00 00 00 9a 00 00 c0   ....s..À
> 0018: 00 00 00 00 00 00 00 00   ........
> 0020: 00 00 00 00 00 00 00 00   ........
> 0028: 02 00 00 00               ....
>
>
> -- 
> Posted 'as is'.  If there are any spelling and/or grammar mistakes, they 
> were a direct result of my fingers and brain not being synchronized or my 
> lack of caffeine.
>
> Mike Brearley
>
>