Go Back   TechArena Community > Technical Support > Computer Help > Windows Server > Windows Server Help
Become a Member!
Forgot your username/password?
Register Tags Active Topics RSS Search Mark Forums Read

Sponsored Links



Nonpaged pool - low memory

Windows Server Help


Reply
 
Thread Tools Search this Thread
  #1  
Old 16-11-2004
Schnitro
 
Posts: n/a
Nonpaged pool - low memory

I'm running a Windows 2003 Standard Server and every week I need to reboot
the server since I keep getting Nonpaging errors (event 2019 in the event
log). It appears that over a period of hours (overnight), the server begins
to lose memory. I have listed all of the major events preceding the low
memory condition below. Please review. Any idea on how I can fix this
problem? Has my Server been hacked? Events listed below.

-----------------------------------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 11/15/2004
Time: 7:00:16 PM
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
The Volume Shadow Copy service was successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:00:16 PM
User: N/A
Computer: SERVER
Description:
The Volume Shadow Copy service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: MRxSmb
Event Category: None
Event ID: 8003
Date: 11/15/2004
Time: 7:00:19 PM
User: N/A
Computer: SERVER
Description:
The master browser has received a server announcement from the computer
SCOTT that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{61E66CD5-F2B0-4CDF-A27. The master browser is stopping or an
election is being forced.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: e2 00 00 00 00 00 00 00 â.......
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: VolSnap
Event Category: None
Event ID: 21
Date: 11/15/2004
Time: 7:00:43 PM
User: N/A
Computer: SERVER
Description:
The flush and hold operation for volume C: was aborted because of low
available system memory.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 58 00 ......X.
0008: 00 00 00 00 15 00 06 c0 .......À
0010: 02 00 00 00 9a 00 00 c0 ....š..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 11/15/2004
Time: 7:02:12 PM
User: USS\Administrator
Computer: SERVER
Description:
The ISLNDIS5 Protocol Driver service was successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:04:01 PM
User: N/A
Computer: SERVER
Description:
The Volume Shadow Copy service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:07:01 PM
User: N/A
Computer: SERVER
Description:
The Microsoft Software Shadow Copy Provider service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 11/15/2004
Time: 7:07:13 PM
User: N/A
Computer: SERVER
Description:
The Volume Shadow Copy service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Disk
Event Category: None
Event ID: 119
Date: 11/16/2004
Time: 5:00:07 AM
User: N/A
Computer: SERVER
Description:
The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests
for 93 ms to recover from a low memory condition.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 04 00 00 00 02 00 52 00 ......R.
0008: 00 00 00 00 77 00 04 40 ....w..@
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Srv
Event Category: None
Event ID: 2019
Date: 11/16/2004
Time: 6:24:14 AM
User: N/A
Computer: SERVER
Description:
The server was unable to allocate from the system nonpaged pool because the
pool was empty.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 e3 07 00 c0 ....ã..À
0010: 00 00 00 00 9a 00 00 c0 ....š..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 0d 00 00 00 ....

Thanks for your help!!


Reply With Quote
  #2  
Old 16-11-2004
Gabe Knuth
 
Posts: n/a
Re: Nonpaged pool - low memory

Check this out:
http://www.eventid.net/display.asp?e...ce=Srv&phase=1


"Schnitro" <Schnitro@discussions.microsoft.com> wrote in message
news:8FC97657-7BB9-4640-855A-BC1763445C8B@microsoft.com...
> I'm running a Windows 2003 Standard Server and every week I need to reboot
> the server since I keep getting Nonpaging errors (event 2019 in the event
> log). It appears that over a period of hours (overnight), the server

begins
> to lose memory. I have listed all of the major events preceding the low
> memory condition below. Please review. Any idea on how I can fix this
> problem? Has my Server been hacked? Events listed below.
>
> -----------------------------------
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7035
> Date: 11/15/2004
> Time: 7:00:16 PM
> User: NT AUTHORITY\SYSTEM
> Computer: SERVER
> Description:
> The Volume Shadow Copy service was successfully sent a start control.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:00:16 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the running state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Error
> Event Source: MRxSmb
> Event Category: None
> Event ID: 8003
> Date: 11/15/2004
> Time: 7:00:19 PM
> User: N/A
> Computer: SERVER
> Description:
> The master browser has received a server announcement from the computer
> SCOTT that believes that it is the master browser for the domain on

transport
> NetBT_Tcpip_{61E66CD5-F2B0-4CDF-A27. The master browser is stopping or an
> election is being forced.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 03 00 4e 00 ......N.
> 0008: 00 00 00 00 43 1f 00 c0 ....C..
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: e2 00 00 00 00 00 00 00 .......
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Error
> Event Source: VolSnap
> Event Category: None
> Event ID: 21
> Date: 11/15/2004
> Time: 7:00:43 PM
> User: N/A
> Computer: SERVER
> Description:
> The flush and hold operation for volume C: was aborted because of low
> available system memory.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 02 00 58 00 ......X.
> 0008: 00 00 00 00 15 00 06 c0 .......
> 0010: 02 00 00 00 9a 00 00 c0 ......
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7035
> Date: 11/15/2004
> Time: 7:02:12 PM
> User: USS\Administrator
> Computer: SERVER
> Description:
> The ISLNDIS5 Protocol Driver service was successfully sent a start

control.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:04:01 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:07:01 PM
> User: N/A
> Computer: SERVER
> Description:
> The Microsoft Software Shadow Copy Provider service entered the stopped

state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:07:13 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Disk
> Event Category: None
> Event ID: 119
> Date: 11/16/2004
> Time: 5:00:07 AM
> User: N/A
> Computer: SERVER
> Description:
> The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests
> for 93 ms to recover from a low memory condition.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 04 00 00 00 02 00 52 00 ......R.
> 0008: 00 00 00 00 77 00 04 40 ....w..@
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Error
> Event Source: Srv
> Event Category: None
> Event ID: 2019
> Date: 11/16/2004
> Time: 6:24:14 AM
> User: N/A
> Computer: SERVER
> Description:
> The server was unable to allocate from the system nonpaged pool because

the
> pool was empty.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 04 00 01 00 54 00 ......T.
> 0008: 00 00 00 00 e3 07 00 c0 ......
> 0010: 00 00 00 00 9a 00 00 c0 ......
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
> 0028: 0d 00 00 00 ....
>
> Thanks for your help!!
>



Reply With Quote
  #3  
Old 23-11-2004
Vic Abrahamian
 
Posts: n/a
RE: Nonpaged pool - low memory

Were you able to figure out the problem with 2019? I'm having the same problem.
Thank you

"Schnitro" wrote:

> I'm running a Windows 2003 Standard Server and every week I need to reboot
> the server since I keep getting Nonpaging errors (event 2019 in the event
> log). It appears that over a period of hours (overnight), the server begins
> to lose memory. I have listed all of the major events preceding the low
> memory condition below. Please review. Any idea on how I can fix this
> problem? Has my Server been hacked? Events listed below.
>
> -----------------------------------
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7035
> Date: 11/15/2004
> Time: 7:00:16 PM
> User: NT AUTHORITY\SYSTEM
> Computer: SERVER
> Description:
> The Volume Shadow Copy service was successfully sent a start control.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:00:16 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the running state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Error
> Event Source: MRxSmb
> Event Category: None
> Event ID: 8003
> Date: 11/15/2004
> Time: 7:00:19 PM
> User: N/A
> Computer: SERVER
> Description:
> The master browser has received a server announcement from the computer
> SCOTT that believes that it is the master browser for the domain on transport
> NetBT_Tcpip_{61E66CD5-F2B0-4CDF-A27. The master browser is stopping or an
> election is being forced.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 03 00 4e 00 ......N.
> 0008: 00 00 00 00 43 1f 00 c0 ....C..À
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: e2 00 00 00 00 00 00 00 â.......
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Error
> Event Source: VolSnap
> Event Category: None
> Event ID: 21
> Date: 11/15/2004
> Time: 7:00:43 PM
> User: N/A
> Computer: SERVER
> Description:
> The flush and hold operation for volume C: was aborted because of low
> available system memory.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 02 00 58 00 ......X.
> 0008: 00 00 00 00 15 00 06 c0 .......À
> 0010: 02 00 00 00 9a 00 00 c0 ....š..À
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7035
> Date: 11/15/2004
> Time: 7:02:12 PM
> User: USS\Administrator
> Computer: SERVER
> Description:
> The ISLNDIS5 Protocol Driver service was successfully sent a start control.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:04:01 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:07:01 PM
> User: N/A
> Computer: SERVER
> Description:
> The Microsoft Software Shadow Copy Provider service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 11/15/2004
> Time: 7:07:13 PM
> User: N/A
> Computer: SERVER
> Description:
> The Volume Shadow Copy service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Information
> Event Source: Disk
> Event Category: None
> Event ID: 119
> Date: 11/16/2004
> Time: 5:00:07 AM
> User: N/A
> Computer: SERVER
> Description:
> The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests
> for 93 ms to recover from a low memory condition.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 04 00 00 00 02 00 52 00 ......R.
> 0008: 00 00 00 00 77 00 04 40 ....w..@
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> Event Type: Error
> Event Source: Srv
> Event Category: None
> Event ID: 2019
> Date: 11/16/2004
> Time: 6:24:14 AM
> User: N/A
> Computer: SERVER
> Description:
> The server was unable to allocate from the system nonpaged pool because the
> pool was empty.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 04 00 01 00 54 00 ......T.
> 0008: 00 00 00 00 e3 07 00 c0 ....ã..À
> 0010: 00 00 00 00 9a 00 00 c0 ....š..À
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
> 0028: 0d 00 00 00 ....
>
> Thanks for your help!!
>

Reply With Quote
  #4  
Old 19-01-2005
Greg H
 
Posts: n/a
Re: Nonpaged pool - low memory

I was having the same problem and finally identified the issue and
corrected it. I used perfmon, poolmon.exe as people suggested, but
nothing helped. I just happened to be at the server when it was about
to crash. You need to have Task Manager up and be on the processes
tab. Have the the Non Paged Pool column added. That will show what's
using up the non paged pool. But it may not show you anything until
it's about to crash. Most processes use less than 100 K of non paged
pool. In my case, the crypserve.exe was using 250 + megs of non paged
pool. As soon as I ended the process, the server returned to normal.
It's been fine ever since I disabled the crypserve service. In your
case, the offending software or driver will probably be different.
Identify the software and\or driver and make sure you have the latest
version.
Hope this helps you.
Greg Halpin

See full description at:
http://groups-beta.google.com/group/...er=1 &q=2019&

Reply With Quote
Reply

  TechArena Community > Technical Support > Computer Help > Windows Server > Windows Server Help
Tags: , , ,



Thread Tools Search this Thread
Search this Thread:

Advanced Search


Similar Threads for: "Nonpaged pool - low memory"
Thread Thread Starter Forum Replies Last Post
KAV FS 6.0.4.1212 Nonpaged Memory Leak Fausty Networking & Security 4 15-04-2010 03:43 PM
The server was unable to allocate from the system nonpaged pool Kelvin Ng Windows Server Help 0 10-11-2008 08:43 PM
Page fault in nonpaged area EllingSon Windows XP Support 1 21-05-2008 06:01 PM
PoolMon: MmCm tag - High nonpaged memory pool usage martin.necas@gmail.com Windows Server Help 0 14-09-2007 04:21 PM
Event 2019 - "The server was unable to allocate from the system nonpaged pool because the pool was empy" - Can you help me ? Javier Windows Server Help 1 13-10-2005 04:48 AM


All times are GMT +5.5. The time now is 09:16 PM.