Nonpaged pool - low memory

Printable View

16-11-2004
Schnitro

Nonpaged pool - low memory

I'm running a Windows 2003 Standard Server and every week I need to reboot
the server since I keep getting Nonpaging errors (event 2019 in the event
log). It appears that over a period of hours (overnight), the server begins
to lose memory. I have listed all of the major events preceding the low
memory condition below. Please review. Any idea on how I can fix this
problem? Has my Server been hacked? Events listed below.

-----------------------------------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 11/15/2004
Time: 7:00:16 PM
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
The Volume Shadow Copy service was successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:00:16 PM
User: N/A
Computer: SERVER
Description:
The Volume Shadow Copy service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: MRxSmb
Event Category: None
Event ID: 8003
Date: 11/15/2004
Time: 7:00:19 PM
User: N/A
Computer: SERVER
Description:
The master browser has received a server announcement from the computer
SCOTT that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{61E66CD5-F2B0-4CDF-A27. The master browser is stopping or an
election is being forced.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..Ã€
0010: 00 00 00 00 00 00 00 00 ........
0018: e2 00 00 00 00 00 00 00 Ã¢.......
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: VolSnap
Event Category: None
Event ID: 21
Date: 11/15/2004
Time: 7:00:43 PM
User: N/A
Computer: SERVER
Description:
The flush and hold operation for volume C: was aborted because of low
available system memory.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 58 00 ......X.
0008: 00 00 00 00 15 00 06 c0 .......Ã€
0010: 02 00 00 00 9a 00 00 c0 ....Âš..Ã€
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 11/15/2004
Time: 7:02:12 PM
User: USS\Administrator
Computer: SERVER
Description:
The ISLNDIS5 Protocol Driver service was successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:04:01 PM
User: N/A
Computer: SERVER
Description:
The Volume Shadow Copy service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:07:01 PM
User: N/A
Computer: SERVER
Description:
The Microsoft Software Shadow Copy Provider service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:07:13 PM
User: N/A
Computer: SERVER
Description:
The Volume Shadow Copy service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Disk
Event Category: None
Event ID: 119
Date: 11/16/2004
Time: 5:00:07 AM
User: N/A
Computer: SERVER
Description:
The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests
for 93 ms to recover from a low memory condition.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 04 00 00 00 02 00 52 00 ......R.
0008: 00 00 00 00 77 00 04 40 ....w..@
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Srv
Event Category: None
Event ID: 2019
Date: 11/16/2004
Time: 6:24:14 AM
User: N/A
Computer: SERVER
Description:
The server was unable to allocate from the system nonpaged pool because the
pool was empty.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 e3 07 00 c0 ....Ã£..Ã€
0010: 00 00 00 00 9a 00 00 c0 ....Âš..Ã€
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 0d 00 00 00 ....

Thanks for your help!!
16-11-2004
Gabe Knuth

Re: Nonpaged pool - low memory

Check this out:
http://www.eventid.net/display.asp?e...ce=Srv&phase=1

"Schnitro" <Schnitro@discussions.microsoft.com> wrote in message
news:8FC97657-7BB9-4640-855A-BC1763445C8B@microsoft.com...
> I'm running a Windows 2003 Standard Server and every week I need to reboot
> the server since I keep getting Nonpaging errors (event 2019 in the event
> log). It appears that over a period of hours (overnight), the server
begins
> to lose memory. I have listed all of the major events preceding the low
> memory condition below. Please review. Any idea on how I can fix this
> problem? Has my Server been hacked? Events listed below.
>
> -----------------------------------
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7035
> Date: 11/15/2004
> Time: 7:00:16 PM
> User: NT AUTHORITY\SYSTEM
> Computer: SERVER
> Description:
> The Volume Shadow Copy service was successfully sent a start control.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:00:16 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the running state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Error
> Event Source: MRxSmb
> Event Category: None
> Event ID: 8003
> Date: 11/15/2004
> Time: 7:00:19 PM
> User: N/A
> Computer: SERVER
> Description:
> The master browser has received a server announcement from the computer
> SCOTT that believes that it is the master browser for the domain on
transport
> NetBT_Tcpip_{61E66CD5-F2B0-4CDF-A27. The master browser is stopping or an
> election is being forced.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 03 00 4e 00 ......N.
> 0008: 00 00 00 00 43 1f 00 c0 ....C..À
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: e2 00 00 00 00 00 00 00 â.......
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Error
> Event Source: VolSnap
> Event Category: None
> Event ID: 21
> Date: 11/15/2004
> Time: 7:00:43 PM
> User: N/A
> Computer: SERVER
> Description:
> The flush and hold operation for volume C: was aborted because of low
> available system memory.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 02 00 58 00 ......X.
> 0008: 00 00 00 00 15 00 06 c0 .......À
> 0010: 02 00 00 00 9a 00 00 c0 ....š..À
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7035
> Date: 11/15/2004
> Time: 7:02:12 PM
> User: USS\Administrator
> Computer: SERVER
> Description:
> The ISLNDIS5 Protocol Driver service was successfully sent a start
control.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:04:01 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:07:01 PM
> User: N/A
> Computer: SERVER
> Description:
> The Microsoft Software Shadow Copy Provider service entered the stopped
state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:07:13 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Disk
> Event Category: None
> Event ID: 119
> Date: 11/16/2004
> Time: 5:00:07 AM
> User: N/A
> Computer: SERVER
> Description:
> The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests
> for 93 ms to recover from a low memory condition.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 04 00 00 00 02 00 52 00 ......R.
> 0008: 00 00 00 00 77 00 04 40 ....w..@
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Error
> Event Source: Srv
> Event Category: None
> Event ID: 2019
> Date: 11/16/2004
> Time: 6:24:14 AM
> User: N/A
> Computer: SERVER
> Description:
> The server was unable to allocate from the system nonpaged pool because
the
> pool was empty.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 04 00 01 00 54 00 ......T.
> 0008: 00 00 00 00 e3 07 00 c0 ....ã..À
> 0010: 00 00 00 00 9a 00 00 c0 ....š..À
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
> 0028: 0d 00 00 00 ....
>
> Thanks for your help!!
>
23-11-2004
Vic Abrahamian

RE: Nonpaged pool - low memory

Were you able to figure out the problem with 2019? I'm having the same problem.
Thank you

"Schnitro" wrote:

> I'm running a Windows 2003 Standard Server and every week I need to reboot
> the server since I keep getting Nonpaging errors (event 2019 in the event
> log). It appears that over a period of hours (overnight), the server begins
> to lose memory. I have listed all of the major events preceding the low
> memory condition below. Please review. Any idea on how I can fix this
> problem? Has my Server been hacked? Events listed below.
>
> -----------------------------------
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7035
> Date: 11/15/2004
> Time: 7:00:16 PM
> User: NT AUTHORITY\SYSTEM
> Computer: SERVER
> Description:
> The Volume Shadow Copy service was successfully sent a start control.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:00:16 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the running state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Error
> Event Source: MRxSmb
> Event Category: None
> Event ID: 8003
> Date: 11/15/2004
> Time: 7:00:19 PM
> User: N/A
> Computer: SERVER
> Description:
> The master browser has received a server announcement from the computer
> SCOTT that believes that it is the master browser for the domain on transport
> NetBT_Tcpip_{61E66CD5-F2B0-4CDF-A27. The master browser is stopping or an
> election is being forced.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 03 00 4e 00 ......N.
> 0008: 00 00 00 00 43 1f 00 c0 ....C..Ã€
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: e2 00 00 00 00 00 00 00 Ã¢.......
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Error
> Event Source: VolSnap
> Event Category: None
> Event ID: 21
> Date: 11/15/2004
> Time: 7:00:43 PM
> User: N/A
> Computer: SERVER
> Description:
> The flush and hold operation for volume C: was aborted because of low
> available system memory.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 02 00 58 00 ......X.
> 0008: 00 00 00 00 15 00 06 c0 .......Ã€
> 0010: 02 00 00 00 9a 00 00 c0 ....Âš..Ã€
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7035
> Date: 11/15/2004
> Time: 7:02:12 PM
> User: USS\Administrator
> Computer: SERVER
> Description:
> The ISLNDIS5 Protocol Driver service was successfully sent a start control.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:04:01 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:07:01 PM
> User: N/A
> Computer: SERVER
> Description:
> The Microsoft Software Shadow Copy Provider service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:07:13 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Disk
> Event Category: None
> Event ID: 119
> Date: 11/16/2004
> Time: 5:00:07 AM
> User: N/A
> Computer: SERVER
> Description:
> The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests
> for 93 ms to recover from a low memory condition.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 04 00 00 00 02 00 52 00 ......R.
> 0008: 00 00 00 00 77 00 04 40 ....w..@
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Error
> Event Source: Srv
> Event Category: None
> Event ID: 2019
> Date: 11/16/2004
> Time: 6:24:14 AM
> User: N/A
> Computer: SERVER
> Description:
> The server was unable to allocate from the system nonpaged pool because the
> pool was empty.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 04 00 01 00 54 00 ......T.
> 0008: 00 00 00 00 e3 07 00 c0 ....Ã£..Ã€
> 0010: 00 00 00 00 9a 00 00 c0 ....Âš..Ã€
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
> 0028: 0d 00 00 00 ....
>
> Thanks for your help!!
>
19-01-2005
Greg H

Re: Nonpaged pool - low memory

I was having the same problem and finally identified the issue and
corrected it. I used perfmon, poolmon.exe as people suggested, but
nothing helped. I just happened to be at the server when it was about
to crash. You need to have Task Manager up and be on the processes
tab. Have the the Non Paged Pool column added. That will show what's
using up the non paged pool. But it may not show you anything until
it's about to crash. Most processes use less than 100 K of non paged
pool. In my case, the crypserve.exe was using 250 + megs of non paged
pool. As soon as I ended the process, the server returned to normal.
It's been fine ever since I disabled the crypserve service. In your
case, the offending software or driver will probably be different.
Identify the software and\or driver and make sure you have the latest
version.
Hope this helps you.
Greg Halpin

See full description at:
http://groups-beta.google.com/group/...ader=1&q=2019&