2

I have a Windows 2012 R2 std. server with a memory leak. Something tells me that the leak started after we installed Symantic Endpoint protection 12.1.5 - but I am not sure. I tried to disable Symantic without any change to the memory leak.

Using RamMap I can see that The Nonpaged Pool grows ~1GB per day. Using Poolmon, I can see that the “file” tag is the cause of the memory leak in the nonpaged pool.

How do I debug this further? I seems like “file” is a generic tag used for unknown files? Or I cant really search for that?

Any suggestion would be greatly appreciated..

Update:

Update: Memory Leak

Memory Leak 2

Improve this question
1
  • Ouch... that really is the least helpful pool tag ever.
    – Ryan Ries
    Apr 8, 2015 at 18:55

2 Answers 2

Reset to default
1

Use XPerf/Windows Performance Analyzer to record pool allocations.

http://blogs.msdn.com/b/ntdebugging/archive/2012/11/30/troubleshooting-pool-leaks-part-7-windows-performance-toolkit.aspx

Improve this answer
8
  • Thanks, I am downloading XPerf/Windows Performance Analyzer right now. I hope that it can help me locate the sinner.
    – user2536967
    Apr 8, 2015 at 21:30
  • Ok, I got a little further now. I captured a dump of the file tag, and I can see that the process csrss.exe is causing the leak. For some reason I can’t load symbols in Windows Performance Analyzer, so I can’t get more information about what is causing this . (I can see that other people have the same problem, but unfortunately it don’t help to copy the .dlls manually like suggested here randomascii.wordpress.com/2012/10/04/…).
    – user2536967
    Apr 9, 2015 at 16:38
  • @user2536967 if you use Windows Server 2012 R2, you have to use the Windows 8.1 SDK/WPT, not an older version: msdn.microsoft.com/en-US/windows/desktop/bg162891
    – magicandre1981
    Apr 9, 2015 at 17:14
  • @user2536967 does the new WPT work? Do you see stacks in the new captured ETL file?
    – magicandre1981
    Apr 12, 2015 at 17:19
  • no, I already used the newest version. I tried to install on my Windows 7 as well with same result.
    – user2536967
    Apr 13, 2015 at 18:49
0

Use perfmon to track which process has run-away pool allocations. I don't have a server to hand, but the counters are something like "process\memory\pool nonpaged" and "process\memory\paged".

Also, what is the role of the server? Do you have volume shadow copies enabled?

Improve this answer
3
  • It’s a combined SQL 2014 and SCADA server (Proficy iFIX) We don’t have any disk configured for Volume Shadow Copies.
    – user2536967
    Apr 8, 2015 at 21:30
  • Cool - thanks. Be interested to hear which process has growing NPP allocations... should be easy to spot if your pool is growing this fast. I am surprised you're not seeing kernel lock-ups.
    – Simon Catlin
    Apr 8, 2015 at 21:38
  • I have actually already tried to run “Process\Memory\Pool Nonpages(*)” overnight, and none of the services looked suspicious (increased in size) even though the total size increased (I can upload csv if you are interested).
    – user2536967
    Apr 8, 2015 at 22:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .