I'm running a Windows 2003 Standard Server and every week I need to reboot
the server since I keep getting Nonpaging errors (event 2019 in the event
log). It appears that over a period of hours (overnight), the server begins
to lose memory. I have listed all of the major events preceding the low
memory condition below. Please review. Any idea on how I can fix this
problem? Has my Server been hacked? Events listed below.
-----------------------------------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 11/15/2004
Time: 7:00:16 PM
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
The Volume Shadow Copy service was successfully sent a start control.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:00:16 PM
User: N/A
Computer: SERVER
Description:
The Volume Shadow Copy service entered the running state.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: MRxSmb
Event Category: None
Event ID: 8003
Date: 11/15/2004
Time: 7:00:19 PM
User: N/A
Computer: SERVER
Description:
The master browser has received a server announcement from the computer
SCOTT that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{61E66CD5-F2B0-4CDF-A27. The master browser is stopping or an
election is being forced.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: e2 00 00 00 00 00 00 00 â.......
0020: 00 00 00 00 00 00 00 00 ........
Event Type: Error
Event Source: VolSnap
Event Category: None
Event ID: 21
Date: 11/15/2004
Time: 7:00:43 PM
User: N/A
Computer: SERVER
Description:
The flush and hold operation for volume C: was aborted because of low
available system memory.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 58 00 ......X.
0008: 00 00 00 00 15 00 06 c0 .......À
0010: 02 00 00 00 9a 00 00 c0 ....š..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 11/15/2004
Time: 7:02:12 PM
User: USS\Administrator
Computer: SERVER
Description:
The ISLNDIS5 Protocol Driver service was successfully sent a start control.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:04:01 PM
User: N/A
Computer: SERVER
Description:
The Volume Shadow Copy service entered the stopped state.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:07:01 PM
User: N/A
Computer: SERVER
Description:
The Microsoft Software Shadow Copy Provider service entered the stopped state.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:07:13 PM
User: N/A
Computer: SERVER
Description:
The Volume Shadow Copy service entered the stopped state.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: Disk
Event Category: None
Event ID: 119
Date: 11/16/2004
Time: 5:00:07 AM
User: N/A
Computer: SERVER
Description:
The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests
for 93 ms to recover from a low memory condition.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 04 00 00 00 02 00 52 00 ......R.
0008: 00 00 00 00 77 00 04 40 ....w..@
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
Event Type: Error
Event Source: Srv
Event Category: None
Event ID: 2019
Date: 11/16/2004
Time: 6:24:14 AM
User: N/A
Computer: SERVER
Description:
The server was unable to allocate from the system nonpaged pool because the
pool was empty.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 e3 07 00 c0 ....ã..À
0010: 00 00 00 00 9a 00 00 c0 ....š..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 0d 00 00 00 ....
Thanks for your help!!
Reply With Quote
Bookmarks