Re: SBS 2003 Premium R2 server becomes more unstable, page file gr

I was more concerned that you had file space A/V scanning things that should be excluded. It appears not.

I think the immediate task is to get the page file down to a proper size.

Note that after a restart, it may take more than a day for your memory use to stabilize, but it should stabilize and it's not uncommon for SBS boxes to run for months without a restart, if it wasn't for those pesky patch tuesdays.

--
Les Connor [SBS MVP]


"ipadl" <ipadl@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:B52C715B-2EEC-402D-8E0C-53F3EB6C3B48@xxxxxxxxxxxxxxxx
Les,

I've throttled SQL to 512kMB for each instance. . . actually, I'm not sure
if I've applied that to the WSUS instance but it hasn't grown above 120MB at
this point. I haven't done anything to exchange, but there was some evidence
in other literature that an unpatched exchange would leak memory at times or
use it and not give any back to the pool for other apps. I need to check the
SP version of Exchange.

As for anti-virus and anti-spam, not long after the server was up and
working (1-2 weeks), we implemented Antigen which scans Exchange, but this
may be all. We have found a few solutions that we'd like to implement, but
haven't do to the server's instability. I'd ultimately like to have a
network managed AV/AS system. Is this one step that we should implement
right away?

Seth

"Les Connor [SBS MVP]" wrote:

What have you got for file space anti-virus scanning application, and what
exclusions are set?

--
Les Connor [SBS MVP]


"ipadl" <ipadl@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:545AC080-883D-4C89-9857-3A6783DCFA30@xxxxxxxxxxxxxxxx
> Les,
>
> Thanks for the reply. I'll try to set the PF to be system managed this
> evening and see what I find. Please read the last response to Dave, as > it
> gives more info and insight into what happened after some patches,
> hotfixes,
> and downloads from last night. Thanks,
>
> Seth
>
> "Les Connor [SBS MVP]" wrote:
>
>> Switch to a system managed pagefile, as a suggestion.
>>
>> -- >> Les Connor [SBS MVP]
>>
>>
>> "ipadl" <ipadl@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
>> news:A681F3C6-67DE-4541-838F-DF6C8AE583B9@xxxxxxxxxxxxxxxx
>> > Dave,
>> >
>> > I'm hoping that this is true and that as we've applied hotfixes that
>> > we've
>> > created a stable environment. At this point, we have the page file >> > set
>> > up
>> > as
>> > follows:
>> >
>> > 4 GB RAM
>> > Drive E (System Partition, Raid 1): 3 GB PF (min and max)
>> > Drive F (File Partition, Raid 5): 3 GB PF (min and max)
>> >
>> > The total page file size that we have set is 6GB. Under the PF >> > Useage
>> > in
>> > the Task Manager, we see the 9.29 GB (current value). This should >> > be
>> > according to MS specs and your suggestion of the PF being 1.5x the >> > RAM
>> > ,
>> > correct? The server hasn't crashed yet, but it has in the past. >> > It's
>> > been
>> > up currently for 2 days and 15 hours. Strangely enough (and >> > possible
>> > unrelated), we've also heard on two occaisions the fans kick up to a
>> > higher
>> > rate when the server has gone down. This usually stays high for
>> > several
>> > minutes and then drops down to a lower rate again.
>> >
>> > Thanks again for your help. I appreciate your suggestions. Where
>> > should
>> > we
>> > go from here?
>> >
>> > Seth
>> >
>> > "Dave Nickason [SBS MVP]" wrote:
>> >
>> >> Pure speculation here - disregarding that VM Size column in Task
>> >> Manager,
>> >> the rest of your memory usage info seems consistent with a normally
>> >> functioning SBS. I just caught from your previous post that you >> >> have
>> >> the
>> >> page file configured to 10 GB - is that right? My speculation >> >> would
>> >> be
>> >> that
>> >> because the system has that size of page file available, it's just
>> >> going
>> >> ahead and using it. Kind of like a system that would be fine with >> >> 2
>> >> GB
>> >> of
>> >> RAM, but when you up it to 4 GB, it uses more for no other reason >> >> than
>> >> that
>> >> it's there to be used.
>> >>
>> >> I wonder what would happen if you set the page file to a fixed size >> >> of
>> >> 1.5
>> >> times RAM and rebooted. That would be a standard configuration, >> >> and
>> >> my
>> >> guess is that the system would then just start using a more typical
>> >> amount
>> >> of page file.
>> >>
>> >> I'd give that a try - configure a page file to have a fixed size >> >> equal
>> >> to
>> >> 1.5 times the amount of physical RAM in the server. Reboot to >> >> apply
>> >> that
>> >> setting, and see what happens. If the system does not start >> >> reporting
>> >> virtual memory or similar errors, I'd see if the instability is
>> >> remedied,
>> >> and if not, I'd troubleshoot it differently, looking for a >> >> different
>> >> cause.
>> >>
>> >>
>> >> "ipadl" <ipadl@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
>> >> news:46D9D4B1-DB4E-4ABF-9F43-717BC2E403A8@xxxxxxxxxxxxxxxx
>> >> > Dave,
>> >> >
>> >> > Thanks for the reply. In the task manager, the Mem Useage >> >> > doesn't
>> >> > account
>> >> > for much. The VM Size is what seems to be getting large (Mem >> >> > Useage
>> >> > vs.
>> >> > VM
>> >> > Size included below)! I didn't note the Commit Charge at the >> >> > time
>> >> > that
>> >> > I
>> >> > had
>> >> > taken that data and I deleted my screen shot after building the
>> >> > spread***,
>> >> > but right now we're looking at a PF size of 9.34 GB with a Commit
>> >> > Charge
>> >> > of
>> >> > 9571M / 9749M.
>> >> >
>> >> > I spoke to Microsoft again today about the hotfixes that you
>> >> > suggested,
>> >> > and
>> >> > unlike before, they had a replacement for the hotfix from article
>> >> > 916089.
>> >> > The new article is 927891. It didn't look like it was really all
>> >> > that
>> >> > similar and I won't apply it until this evening, but this is what
>> >> > Microsoft
>> >> > said was the fix.
>> >> >
>> >> > Any other thoughts? The wuauserv is still part of the svchost >> >> > which
>> >> > seems
>> >> > to be rather large on the VM size. Could this still be the >> >> > culprit
>> >> > to
>> >> > this
>> >> > memory leak? I'll see if the server crashes today. When the PF
>> >> > gets
>> >> > up
>> >> > around 9.4 GB it gets really unstable.
>> >> >
>> >> > Image Name Mem Usage (K) VM Size (K)
>> >> > store.exe 609,584 623,068
>> >> > svchost.exe 62,188 605,276
>> >> > wspsrv.exe 27,120 596,512
>> >> > w3wp.exe 34,508 591,664
>> >> > lsass.exe 41,296 589,908
>> >> > inetinfo.exe 33,392 584,112
>> >> > mad.exe 21,856 570,804
>> >> > winlogon.exe 3,904 567,600
>> >> > services.exe 97,904 560,292
>> >> > ntfrs.exe 1,852 560,028
>> >> > sqlservr.exe 547,040 558,156
>> >> > sqlagent.EXE 3,100 552,880
>> >> > dfssvc.exe 4,744 552,792
>> >> > crss.exe 3,096 550,936
>> >> > tbsrvc.exe 2,764 550,496
>> >> > sqlservr.exe 253,864 262,940
>> >> > w3wp.exe 76,612 77,544
>> >> > sqlservr.exe 39,820 50,524
>> >> > mmc.exe 28,800 26,864
>> >> > hpsmhd.exe 16,740 15,736
>> >> > explorer.exe 20,052 13,664
>> >> > wmiprvse.exe 14,932 13,052
>> >> > exmgmt.exe 10,420 11,076
>> >> > dns.exe 6,824 10,760
>> >> > mspdmin.exe 13,836 10,252
>> >> > explorer.exe 14,248 10,216
>> >> > mssearch.exe 1,368 9,728
>> >> > OWSTIMER.EXE 10,584 8,564
>> >> > hpsmhd.exe 10,732 8,332
>> >> > svchost.exe 8,456 8,272
>> >> > ismserv.exe 7,096 7,364
>> >> > wins.exe 6,192 7,340
>> >> > wmiprvse.exe 9,884 6,676
>> >> > winlogon.exe 2,600 5,864
>> >> > svchost.exe 4,912 5,312
>> >> > svchost.exe 6,444 4,788
>> >> > spoolsv.exe 5,088 4,500
>> >> > W3Prefch.exe 5,968 3,744
>> >> > llssrv.exe 5,288 3,648
>> >> > dmadmin.exe 4,512 3,544
>> >> > svchost.exe 4,608 3,448
>> >> > svchost.exe 3,864 3,376
>> >> > msdtc.exe 4,268 2,208
>> >> > sqlmangr.exe 5,136 2,096
>> >> > sqlmangr.exe 5,220 2,084
>> >> > smhstart.exe 3,120 2,040
>> >> > crss.exe 4,560 1,924
>> >> > isastg.exe 3,812 1,776
>> >> > sbscrexe.exe 4,336 1,572
>> >> > taskmgr.exe 4,356 1,560
>> >> > tcpsvcs.exe 2,128 1,440
>> >> > svchost.exe 3,596 1,424
>> >> > sqlwriter.exe 3,604 1,268
>> >> >
>> >> >
>> >> > "Dave Nickason [SBS MVP]" wrote:
>> >> >
>> >> >> So at the time you got the information below, the system was
>> >> >> showing 9
>> >> >> GB
>> >> >> PF
>> >> >> Usage? Those figures only add up to a little under 2 GB for >> >> >> memory
>> >> >> usage,
>> >> >> and even peak is only a little over 2. What figures are you
>> >> >> showing
>> >> >> under
>> >> >> Commit Charge on the Performance tab?
>> >> >>
>> >> >>
>> >> >> "ipadl" <ipadl@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
>> >> >> news:B677EFD4-B9E5-4DB3-B280-729D1C338FAD@xxxxxxxxxxxxxxxx
>> >> >> > Les et al,
>> >> >> >
>> >> >> > We've applied those patches and it seems as though the page >> >> >> > file
>> >> >> > is
>> >> >> > continuing to do it's old thing. It is growing to >> >> >> > approximately
>> >> >> > 9
>> >> >> > GB
>> >> >> > (out
>> >> >> > of
>> >> >> > 10GB that we have set aside) and sometimes growing larger,
>> >> >> > choking
>> >> >> > other
>> >> >> > applications. SQL has been limited to 512KB. Are there any
>> >> >> > other
>> >> >> > ideas
>> >> >> > as
>> >> >> > to how to diagnose this problem? I'm going to try to insert a
>> >> >> > spread***
>> >> >> > into this post with a bunch of Processes that my help us find >> >> >> > a
>> >> >> > problem.
>> >> >> > If
>> >> >> > there is a better way to do this, let me know. Thanks in >> >> >> > advance
>> >> >> > for
>> >> >> > your
>> >> >> > help.
>> >> >> >
>> >> >> > Image Name PID Username Session ID CPU Mem Usage (K) Peak Mem
>> >> >> > Usage
>> >> >> > (K)
>> >> >> > Mem
>> >> >> > Delta (K) VM Size (K) Paged Pool (K)
>> >> >> > store.exe 3620 SYSTEM 0 00 609,584 627,276 0 623,068 122
>> >> >> > svchost.exe 928 SYSTEM 0 00 62,188 116,240 0 605,276 131
>> >> >> > wspsrv.exe 5428 NETWORK SERVICE 0 00 27,120 39,512 0 596,512 >> >> >> > 206
>> >> >> > w3wp.exe 7964 SYSTEM 0 00 34,508 34,896 0 591,664 74
>> >> >> > lsass.exe 476 SYSTEM 0 00 41,296 43,724 0 589,908 181
>> >> >> > inetinfo.exe 1656 SYSTEM 0 00 33,392 33,440 0 584,112 144
>> >> >> > mad.exe 3072 SYSTEM 0 00 21,856 24,320 0 570,804 89
>> >> >> > winlogon.exe 416 SYSTEM 0 00 3,904 23,880 0 567,600 59
>> >> >> > services.exe 464 SYSTEM 0 00 97,904 97,904 0 560,292 127
>> >> >> > ntfrs.exe 2312 SYSTEM 0 00 1,852 8,372 0 560,028 31
>> >> >> > sqlservr.exe 1844 SYSTEM 0 00 547,040 547,256 0 558,156 54
>> >> >> > sqlagent.EXE 2580 SYSTEM 0 00 3,100 6,100 0 552,880 34
>> >> >> > dfssvc.exe 1480 SYSTEM 0 00 4,744 4,844 0 552,792 33
>> >> >> > crss.exe 6796 SYSTEM 0 00 3,096 3,124 0 550,936 29
>> >> >> > tbsrvc.exe 2840 SYSTEM 0 00 2,764 3,036 0 550,496 24
>> >> >> > sqlservr.exe 1916 SYSTEM 0 00 253,864 253,992 0 262,940 49
>> >> >> > w3wp.exe 1336 NETWORK SERVICE 0 00 76,612 76,744 0 77,544 93
>> >> >> > sqlservr.exe 1944 SYSTEM 0 00 39,820 39,836 0 50,524 40
>> >> >> > mmc.exe 6616 Nomadserv 0 00 28,800 28,800 0 26,864 109
>> >> >> > hpsmhd.exe 3800 SYSTEM 0 00 16,740 16,748 0 15,736 44
>> >> >> > explorer.exe 7708 Nomadserv 0 00 20,052 20,420 0 13,664 77
>> >> >> > wmiprvse.exe 4944 SYSTEM 0 00 14,932 15,100 0 13,052 58
>> >> >> > exmgmt.exe 2952 SYSTEM 0 00 10,420 11,176 0 11,076 44
>> >> >> > dns.exe 1500 SYSTEM 0 00 6,824 6,836 0 10,760 40
>> >> >> > mspdmin.exe 3456 SYSTEM 0 00 13,836 13,976 0 10,252 64
>> >> >> > explorer.exe 436 Nomadserv 0 00 14,248 14,324 0 10,216 65
>> >> >> > mssearch.exe 3100 SYSTEM 0 00 1,368 9,056 0 9,728 45
>> >> >> > OWSTIMER.EXE 2564 NETWORK SERVICE 0 00 10,584 10,628 0 8,564 >> >> >> > 43
>> >> >> > hpsmhd.exe 3444 SYSTEM 0 00 10,732 10,740 0 8,332 36
>> >> >> > svchost.exe 3180 SYSTEM 0 00 8,456 9,448 0 8,272 27
>> >> >> > ismserv.exe 1732 SYSTEM 0 00 7,096 7,104 0 7,364 47
>> >> >> > wins.exe 2868 SYSTEM 0 00 6,192 6,208 0 7,340 30
>> >> >> > wmiprvse.exe 4748 NETWORK SERVICE 0 00 9,884 12,244 0 6,676 40
>> >> >> > winlogon.exe 6000 SYSTEM 0 00 2,600 8,348 0 5,864 47
>> >> >> > svchost.exe 864 NETWORK SERVICE 0 00 4,912 4,932 0 5,312 35
>> >> >> > svchost.exe 900 LOCAL SERVICE 0 00 6,444 6,460 0 4,788 34
>> >> >> > spoolsv.exe 1272 SYSTEM 0 00 5,088 5,096 0 4,500 24
>> >> >> > W3Prefch.exe 5464 SYSTEM 0 00 5,968 5,980 0 3,744 43
>> >> >> > llssrv.exe 1764 NETWORK SERVICE 0 00 5,288 6,220 0 3,648 31
>> >> >> > dmadmin.exe 5856 SYSTEM 0 00 4,512 4,520 0 3,544 25
>> >> >> > svchost.exe 5792 SYSTEM 0 00 4,608 4,612 0 3,448 33
>> >> >> > svchost.exe 2824 SYSTEM 0 00 3,864 3,920 0 3,376 31
>> >> >> > msdtc.exe 1300 NETWORK SERVICE 0 00 4,268 4,296 0 2,208 22
>> >> >> > sqlmangr.exe 3724 Nomadserv 0 00 5,136 6,636 0 2,096 39
>> >> >> > sqlmangr.exe 7792 Nomadserv 0 00 5,220 6,676 0 2,084 39
>> >> >> > smhstart.exe 2776 SYSTEM 0 00 3,120 3,128 0 2,040 17
>> >> >> > crss.exe 392 SYSTEM 0 00 4,560 4,616 0 1,924 68
>> >> >> > isastg.exe 1696 NETWORK SERVICE 0 00 3,812 3,824 0 1,776 30
>> >> >> > sbscrexe.exe 2424 SYSTEM 0 00 4,336 4,560 0 1,572 31
>> >> >> > taskmgr.exe 3576 Nomadserv 0 00 4,356 4,356 0 1,560 33
>> >> >> > tcpsvcs.exe 2480 SYSTEM 0 00 2,128 2,136 0 1,440 17
>> >> >> > svchost.exe 804 NETWORK SERVICE 0 00 3,596 3,608 0 1,424 24
>> >> >> > sqlwriter.exe 2716 SYSTEM 0 00 3,604 3,612 0 1,268 22
>> >> >> >
>> >> >> >

.

Loading