Results 1 to 4 of 4

Thread: Nonpaged pool - low memory

  1. #1
    Schnitro Guest

    Nonpaged pool - low memory

    I'm running a Windows 2003 Standard Server and every week I need to reboot
    the server since I keep getting Nonpaging errors (event 2019 in the event
    log). It appears that over a period of hours (overnight), the server begins
    to lose memory. I have listed all of the major events preceding the low
    memory condition below. Please review. Any idea on how I can fix this
    problem? Has my Server been hacked? Events listed below.

    -----------------------------------
    Event Type: Information
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7035
    Date: 11/15/2004
    Time: 7:00:16 PM
    User: NT AUTHORITY\SYSTEM
    Computer: SERVER
    Description:
    The Volume Shadow Copy service was successfully sent a start control.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    Event Type: Information
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7036
    Date: 11/15/2004
    Time: 7:00:16 PM
    User: N/A
    Computer: SERVER
    Description:
    The Volume Shadow Copy service entered the running state.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    Event Type: Error
    Event Source: MRxSmb
    Event Category: None
    Event ID: 8003
    Date: 11/15/2004
    Time: 7:00:19 PM
    User: N/A
    Computer: SERVER
    Description:
    The master browser has received a server announcement from the computer
    SCOTT that believes that it is the master browser for the domain on transport
    NetBT_Tcpip_{61E66CD5-F2B0-4CDF-A27. The master browser is stopping or an
    election is being forced.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 00 00 00 00 03 00 4e 00 ......N.
    0008: 00 00 00 00 43 1f 00 c0 ....C..À
    0010: 00 00 00 00 00 00 00 00 ........
    0018: e2 00 00 00 00 00 00 00 â.......
    0020: 00 00 00 00 00 00 00 00 ........

    Event Type: Error
    Event Source: VolSnap
    Event Category: None
    Event ID: 21
    Date: 11/15/2004
    Time: 7:00:43 PM
    User: N/A
    Computer: SERVER
    Description:
    The flush and hold operation for volume C: was aborted because of low
    available system memory.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 00 00 00 00 02 00 58 00 ......X.
    0008: 00 00 00 00 15 00 06 c0 .......À
    0010: 02 00 00 00 9a 00 00 c0 ....š..À
    0018: 00 00 00 00 00 00 00 00 ........
    0020: 00 00 00 00 00 00 00 00 ........

    Event Type: Information
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7035
    Date: 11/15/2004
    Time: 7:02:12 PM
    User: USS\Administrator
    Computer: SERVER
    Description:
    The ISLNDIS5 Protocol Driver service was successfully sent a start control.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    Event Type: Information
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7036
    Date: 11/15/2004
    Time: 7:04:01 PM
    User: N/A
    Computer: SERVER
    Description:
    The Volume Shadow Copy service entered the stopped state.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    Event Type: Information
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7036
    Date: 11/15/2004
    Time: 7:07:01 PM
    User: N/A
    Computer: SERVER
    Description:
    The Microsoft Software Shadow Copy Provider service entered the stopped state.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    Event Type: Information
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7036
    Date: 11/15/2004
    Time: 7:07:13 PM
    User: N/A
    Computer: SERVER
    Description:
    The Volume Shadow Copy service entered the stopped state.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    Event Type: Information
    Event Source: Disk
    Event Category: None
    Event ID: 119
    Date: 11/16/2004
    Time: 5:00:07 AM
    User: N/A
    Computer: SERVER
    Description:
    The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests
    for 93 ms to recover from a low memory condition.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 04 00 00 00 02 00 52 00 ......R.
    0008: 00 00 00 00 77 00 04 40 ....w..@
    0010: 00 00 00 00 00 00 00 00 ........
    0018: 00 00 00 00 00 00 00 00 ........
    0020: 00 00 00 00 00 00 00 00 ........

    Event Type: Error
    Event Source: Srv
    Event Category: None
    Event ID: 2019
    Date: 11/16/2004
    Time: 6:24:14 AM
    User: N/A
    Computer: SERVER
    Description:
    The server was unable to allocate from the system nonpaged pool because the
    pool was empty.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 00 00 04 00 01 00 54 00 ......T.
    0008: 00 00 00 00 e3 07 00 c0 ....ã..À
    0010: 00 00 00 00 9a 00 00 c0 ....š..À
    0018: 00 00 00 00 00 00 00 00 ........
    0020: 00 00 00 00 00 00 00 00 ........
    0028: 0d 00 00 00 ....

    Thanks for your help!!


  2. #2
    Gabe Knuth Guest

    Re: Nonpaged pool - low memory

    Check this out:
    http://www.eventid.net/display.asp?e...ce=Srv&phase=1


    "Schnitro" <Schnitro@discussions.microsoft.com> wrote in message
    news:8FC97657-7BB9-4640-855A-BC1763445C8B@microsoft.com...
    > I'm running a Windows 2003 Standard Server and every week I need to reboot
    > the server since I keep getting Nonpaging errors (event 2019 in the event
    > log). It appears that over a period of hours (overnight), the server

    begins
    > to lose memory. I have listed all of the major events preceding the low
    > memory condition below. Please review. Any idea on how I can fix this
    > problem? Has my Server been hacked? Events listed below.
    >
    > -----------------------------------
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7035
    > Date: 11/15/2004
    > Time: 7:00:16 PM
    > User: NT AUTHORITY\SYSTEM
    > Computer: SERVER
    > Description:
    > The Volume Shadow Copy service was successfully sent a start control.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7036
    > Date: 11/15/2004
    > Time: 7:00:16 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The Volume Shadow Copy service entered the running state.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Error
    > Event Source: MRxSmb
    > Event Category: None
    > Event ID: 8003
    > Date: 11/15/2004
    > Time: 7:00:19 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The master browser has received a server announcement from the computer
    > SCOTT that believes that it is the master browser for the domain on

    transport
    > NetBT_Tcpip_{61E66CD5-F2B0-4CDF-A27. The master browser is stopping or an
    > election is being forced.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    > Data:
    > 0000: 00 00 00 00 03 00 4e 00 ......N.
    > 0008: 00 00 00 00 43 1f 00 c0 ....C..
    > 0010: 00 00 00 00 00 00 00 00 ........
    > 0018: e2 00 00 00 00 00 00 00 .......
    > 0020: 00 00 00 00 00 00 00 00 ........
    >
    > Event Type: Error
    > Event Source: VolSnap
    > Event Category: None
    > Event ID: 21
    > Date: 11/15/2004
    > Time: 7:00:43 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The flush and hold operation for volume C: was aborted because of low
    > available system memory.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    > Data:
    > 0000: 00 00 00 00 02 00 58 00 ......X.
    > 0008: 00 00 00 00 15 00 06 c0 .......
    > 0010: 02 00 00 00 9a 00 00 c0 ......
    > 0018: 00 00 00 00 00 00 00 00 ........
    > 0020: 00 00 00 00 00 00 00 00 ........
    >
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7035
    > Date: 11/15/2004
    > Time: 7:02:12 PM
    > User: USS\Administrator
    > Computer: SERVER
    > Description:
    > The ISLNDIS5 Protocol Driver service was successfully sent a start

    control.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7036
    > Date: 11/15/2004
    > Time: 7:04:01 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The Volume Shadow Copy service entered the stopped state.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7036
    > Date: 11/15/2004
    > Time: 7:07:01 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The Microsoft Software Shadow Copy Provider service entered the stopped

    state.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7036
    > Date: 11/15/2004
    > Time: 7:07:13 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The Volume Shadow Copy service entered the stopped state.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Information
    > Event Source: Disk
    > Event Category: None
    > Event ID: 119
    > Date: 11/16/2004
    > Time: 5:00:07 AM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests
    > for 93 ms to recover from a low memory condition.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    > Data:
    > 0000: 04 00 00 00 02 00 52 00 ......R.
    > 0008: 00 00 00 00 77 00 04 40 ....w..@
    > 0010: 00 00 00 00 00 00 00 00 ........
    > 0018: 00 00 00 00 00 00 00 00 ........
    > 0020: 00 00 00 00 00 00 00 00 ........
    >
    > Event Type: Error
    > Event Source: Srv
    > Event Category: None
    > Event ID: 2019
    > Date: 11/16/2004
    > Time: 6:24:14 AM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The server was unable to allocate from the system nonpaged pool because

    the
    > pool was empty.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    > Data:
    > 0000: 00 00 04 00 01 00 54 00 ......T.
    > 0008: 00 00 00 00 e3 07 00 c0 ......
    > 0010: 00 00 00 00 9a 00 00 c0 ......
    > 0018: 00 00 00 00 00 00 00 00 ........
    > 0020: 00 00 00 00 00 00 00 00 ........
    > 0028: 0d 00 00 00 ....
    >
    > Thanks for your help!!
    >




  3. #3
    Vic Abrahamian Guest

    RE: Nonpaged pool - low memory

    Were you able to figure out the problem with 2019? I'm having the same problem.
    Thank you

    "Schnitro" wrote:

    > I'm running a Windows 2003 Standard Server and every week I need to reboot
    > the server since I keep getting Nonpaging errors (event 2019 in the event
    > log). It appears that over a period of hours (overnight), the server begins
    > to lose memory. I have listed all of the major events preceding the low
    > memory condition below. Please review. Any idea on how I can fix this
    > problem? Has my Server been hacked? Events listed below.
    >
    > -----------------------------------
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7035
    > Date: 11/15/2004
    > Time: 7:00:16 PM
    > User: NT AUTHORITY\SYSTEM
    > Computer: SERVER
    > Description:
    > The Volume Shadow Copy service was successfully sent a start control.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7036
    > Date: 11/15/2004
    > Time: 7:00:16 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The Volume Shadow Copy service entered the running state.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Error
    > Event Source: MRxSmb
    > Event Category: None
    > Event ID: 8003
    > Date: 11/15/2004
    > Time: 7:00:19 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The master browser has received a server announcement from the computer
    > SCOTT that believes that it is the master browser for the domain on transport
    > NetBT_Tcpip_{61E66CD5-F2B0-4CDF-A27. The master browser is stopping or an
    > election is being forced.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    > Data:
    > 0000: 00 00 00 00 03 00 4e 00 ......N.
    > 0008: 00 00 00 00 43 1f 00 c0 ....C..À
    > 0010: 00 00 00 00 00 00 00 00 ........
    > 0018: e2 00 00 00 00 00 00 00 â.......
    > 0020: 00 00 00 00 00 00 00 00 ........
    >
    > Event Type: Error
    > Event Source: VolSnap
    > Event Category: None
    > Event ID: 21
    > Date: 11/15/2004
    > Time: 7:00:43 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The flush and hold operation for volume C: was aborted because of low
    > available system memory.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    > Data:
    > 0000: 00 00 00 00 02 00 58 00 ......X.
    > 0008: 00 00 00 00 15 00 06 c0 .......À
    > 0010: 02 00 00 00 9a 00 00 c0 ....š..À
    > 0018: 00 00 00 00 00 00 00 00 ........
    > 0020: 00 00 00 00 00 00 00 00 ........
    >
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7035
    > Date: 11/15/2004
    > Time: 7:02:12 PM
    > User: USS\Administrator
    > Computer: SERVER
    > Description:
    > The ISLNDIS5 Protocol Driver service was successfully sent a start control.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7036
    > Date: 11/15/2004
    > Time: 7:04:01 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The Volume Shadow Copy service entered the stopped state.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7036
    > Date: 11/15/2004
    > Time: 7:07:01 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The Microsoft Software Shadow Copy Provider service entered the stopped state.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Information
    > Event Source: Service Control Manager
    > Event Category: None
    > Event ID: 7036
    > Date: 11/15/2004
    > Time: 7:07:13 PM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The Volume Shadow Copy service entered the stopped state.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Event Type: Information
    > Event Source: Disk
    > Event Category: None
    > Event ID: 119
    > Date: 11/16/2004
    > Time: 5:00:07 AM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests
    > for 93 ms to recover from a low memory condition.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    > Data:
    > 0000: 04 00 00 00 02 00 52 00 ......R.
    > 0008: 00 00 00 00 77 00 04 40 ....w..@
    > 0010: 00 00 00 00 00 00 00 00 ........
    > 0018: 00 00 00 00 00 00 00 00 ........
    > 0020: 00 00 00 00 00 00 00 00 ........
    >
    > Event Type: Error
    > Event Source: Srv
    > Event Category: None
    > Event ID: 2019
    > Date: 11/16/2004
    > Time: 6:24:14 AM
    > User: N/A
    > Computer: SERVER
    > Description:
    > The server was unable to allocate from the system nonpaged pool because the
    > pool was empty.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    > Data:
    > 0000: 00 00 04 00 01 00 54 00 ......T.
    > 0008: 00 00 00 00 e3 07 00 c0 ....ã..À
    > 0010: 00 00 00 00 9a 00 00 c0 ....š..À
    > 0018: 00 00 00 00 00 00 00 00 ........
    > 0020: 00 00 00 00 00 00 00 00 ........
    > 0028: 0d 00 00 00 ....
    >
    > Thanks for your help!!
    >


  4. #4
    Greg H Guest

    Re: Nonpaged pool - low memory

    I was having the same problem and finally identified the issue and
    corrected it. I used perfmon, poolmon.exe as people suggested, but
    nothing helped. I just happened to be at the server when it was about
    to crash. You need to have Task Manager up and be on the processes
    tab. Have the the Non Paged Pool column added. That will show what's
    using up the non paged pool. But it may not show you anything until
    it's about to crash. Most processes use less than 100 K of non paged
    pool. In my case, the crypserve.exe was using 250 + megs of non paged
    pool. As soon as I ended the process, the server returned to normal.
    It's been fine ever since I disabled the crypserve service. In your
    case, the offending software or driver will probably be different.
    Identify the software and\or driver and make sure you have the latest
    version.
    Hope this helps you.
    Greg Halpin

    See full description at:
    http://groups-beta.google.com/group/...ader=1&q=2019&


Similar Threads

  1. KAV FS 6.0.4.1212 Nonpaged Memory Leak
    By Fausty in forum Networking & Security
    Replies: 4
    Last Post: 15-04-2010, 03:43 PM
  2. The server was unable to allocate from the system nonpaged pool
    By Kelvin Ng in forum Windows Server Help
    Replies: 0
    Last Post: 10-11-2008, 08:43 PM
  3. Page fault in nonpaged area
    By EllingSon in forum Windows XP Support
    Replies: 1
    Last Post: 21-05-2008, 06:01 PM
  4. PoolMon: MmCm tag - High nonpaged memory pool usage
    By martin.necas@gmail.com in forum Windows Server Help
    Replies: 0
    Last Post: 14-09-2007, 04:21 PM
  5. Replies: 1
    Last Post: 13-10-2005, 04:48 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •