LSASS Memory Usage

[Guest]

Some of our DCs are using up memory real fast, notably the LSASS process. The memory usage by this LSASS can gow rapidly from about 60 MB to 230 MB in a few hours, even when during after hours where very few users are logged in

Here are our environement: All DCs running Win 2000 in native mode, with all the latest SP and security patches installed. 1 Gig CPU, 512 MB RAM. The DCs in questions are also GCs and DNS servers. They are not holding any FSMO roles

I have browsed to Microsoft KB and could not specifically find the problem/solution that apply to our DCs
Any help will be appreciated. In the meantime, we have to reboot our DCs when the memory usage hits and stays over 90%, every few days

Thanks

 

[Joe Richards [MVP]]

Why do you have to reboot? Are you seeing issues or just don't like seeing high
memory use?

LSASS caches Active Directory, there is a KB article talking a little about that
in the MSKB but basically every query you make causes the cache to grow until
it can't build the cache anymore and starts rolling the cache over. It would
cache your entire DIT if it could.

 

[Joe Richards [MVP]]

I don't know if your machine is slowing down or not, you would need to determine
that via metrics. However having a machine using its memory consistently is just
fine, it is like a machine using its processor consistently. It is what it is
there for.

The KB article is

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q308356


I am nto saying you don't have an LSASS leak, however most leaks people think
they have with LSASS is actually just proper functioning of LSASS. If nothing
else needs the memory on the machine, it keeps it. Once it feels memory pressure
it will trim the cache.

joe

 

[Guest]

Thanks for the MSKB reference, very informative in understanding more about how LSASS on DCs behaves

I don't believe we have an LSASS memory leak as we have the latest SP and patches applied and we have verified with the tools to detect sasser worm

We will keep monitoring the memory usage. That leads to a final question, what is considered acceptable/normal behavior of available memory on DCs? I have seen the memory usage on these DCs hit and stay at 97% (so, only about 3% available), hence rebooting them as a pre-caution

Regards
Stev


----- Joe Richards [MVP] wrote: ----

I don't know if your machine is slowing down or not, you would need to determine
that via metrics. However having a machine using its memory consistently is just
fine, it is like a machine using its processor consistently. It is what it is
there for

The KB article i

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q30835


I am nto saying you don't have an LSASS leak, however most leaks people think
they have with LSASS is actually just proper functioning of LSASS. If nothing
else needs the memory on the machine, it keeps it. Once it feels memory pressure
it will trim the cache

jo



-
Joe Richards Microsoft MVP Windows Server Directory Service
www.joeware.ne



Steve wrote

 

[Joe Richards [MVP]]

There should be no need to reboot unless you start seeing actual errors or
getting slowdowns. There are people running AD on 64bit machines caching entire
16GB+ Databases into RAM.

How much memory in use should be high as it means you have good effective use of
the hardware. But if you have high memory and apps failing due to not being able
to allocate memory or tremendous amounts of paging going on means you have issues.