RE: 2003 SBS stalling randomly

Hi,

Thank you for posting here. Sorry for the delayed response due to weekend.

According to your description, I understand you encountered a couple of
error event on your SBS Server.

First, let focus on event 2019, based on my research, this problem occurs
because of a memory leak in cryptographic services (Cryptsvc.dll). Any
application that is using cryptographic services, such as the Volume Shadow
Copy service, may experience this problem. To resolve this issue, please
install the follow hotfix:

A memory leak occurs in an application using the Volume Shadow Copy Service
on a computer that is running Windows Server 2003
http://support.microsoft.com/?id=870973


Meanwhile, this issue could also be caused by some third party software
such as Symantec, Panda, also there are some related event
So, if the issue still happens after installing the hotfix, to avoid any
affect from third party software, please perform a clean boot, and then
check if there is any change.

To perform a clean boot, follow the steps below:

A. Click Start, click Run, type "msconfig" (without the quotation marks)
and click OK.
B. Select "Selective Startup" and remove the check box for "Load Startup
Items".
C. On the "Services" tab, click Enable All.
D. Check "Hide all Microsoft Services", click Disable All and clear "Hide
all Microsoft Services".
E. Click the OK button and then Click Yes to restart your computer.
F. Try again.


If the issue still persists, please help me collect the following
information for further research:

1. What program are you using for the backup? Is it Veritas backupexec or
SBSbackup?

2. What is the version of your SBS server? Do you have SQL server installed?

3. Meanwhile, please use the Memory Pool Monitor utility, Poolmon.exe, as a
troubleshooting tool to monitor memory tags. Poolmon displays data that the
operating system collects about memory allocations from the system paged
and nonpaged kernel pools, and the memory pools used for Terminal Services
sessions. The data is grouped by pool allocation tag.

The following steps outline a procedure for using Poolmon to detect a
memory leak:

a. Start Poolmon in default mode (no additional parameters).

b. Press P twice to display allocations from only the paged pool. (The P
key toggles the display between paged, non-paged, and both.)

c. Press B to sort the Bytes column in descending order.

d. Let Poolmon run for a few hours. Because starting Poolmon changes the
data, you must let it run until it reaches a steady state before the data
is reliable.

e. Save the information generated by Poolmon, either as a screenshot, or by
copying it from the command window and pasting it into Notepad.

f. Returning to Poolmon, press P twice again, this time to display only
allocations from the non-paged pool.

Repeat steps 3, 5 and 6 approximately every half-hour for at least two
hours.

When data collection is complete, examine the Diff (allocations minus
frees) and Bytes (number of bytes allocated minus number of bytes freed)
values for each tag, and note any that continually increase. Next, stop
Poolmon, wait for a few hours, and then restart Poolmon. Examine the
allocations that were increasing, and determine whether the bytes are now
freed. Allocations that have still not been freed, or have continued to
increase in size are the likely culprits.

Related Knowledge Base article:

177415 How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel
Mode Memory Leaks
http://support.microsoft.com/?id=177415

Hope this helps, if you have any other concerns or need more help, please
feel free to let me know.

Have a nice day!

Best Regards,

Chace Zhang (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.


--------------------
| From: "Blue Wezza" <blue-wezza@xxxxxxxxxxxxxxxx>
| Subject: 2003 SBS stalling randomly
| Date: Wed, 30 Aug 2006 10:01:07 +0100
| Lines: 48
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
| X-RFC2646: Format=Flowed; Original
| Message-ID: <esJjVLBzGHA.3704@xxxxxxxxxxxxxxxxxxxx>
| Newsgroups:
microsoft.public.windows.server.general,microsoft.public.windows.server.sbs
| NNTP-Posting-Host: giotto.gotadsl.co.uk 213.208.127.200
| Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP02.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:294025
microsoft.public.windows.server.general:103806
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Hi all,
|
| I have a 2003 SBS server which has worked superbly for the past nine
months,
| however the past couple of weeks the server has needed to be restarted
after
| becoming unresponsive. The application log file (400 MB large!) is filled
| with over a million of these messages:
|
| LDAP Bind was unsuccessful on directory SVR for distinguished name ''.
| Directory returned error:[0x51] Server Down.
|
| So much so that the real cause seems to have been lost through being
| replaced by this message.
|
| The system log file is again purged by the freqency of the messages, with
| these six messages reccuring:
|
| 1.The Windows Installer service failed to start due to the following
error:
| This application has failed to start because the application
configuration
| is incorrect. Reinstalling the application may fix this problem. [THIS
| RELATES TO PANDA ANTIVIRUS' VIRUS DATABASE]
|
| 2.Generate Activation Context failed for C:\WINDOWS\system32\msiexec.exe.
| Reference error message: Insufficient system resources exist to complete
the
| requested service. [AGAIN THIS RELATES TO PANDA ANTIVIRUS' VIRUS DATABASE]
|
| 3.Resolve Partial Assembly failed for Microsoft.Windows.Common-Controls.
| Reference error message: Insufficient system resources exist to complete
the
| requested service.
|
| 4.The server was unable to allocate from the system nonpaged pool because
| the pool was empty.
|
| 5.An I/O operation initiated by the Registry failed unrecoverably. The
| Registry could not read in, or write out, or flush, one of the files that
| contain the system's image of the Registry.
|
| 6.IIS Logging was unable to create the file
| C:\WINDOWS\System32\LogFiles\SMTPSVC1\ex060829.log. The data is the error.
|
| The security log has 190,000 success audits dating back several weeks.
|
| If anyone has any ideas i would really appreciate your help!
|
| Thanks
|
| Wesley
|
|
|

.