Event 2020 Paged Pool empty (suspect is Spooler)

[Guest]

Hello,

I have this problem that my Windows 2000 Servers with SP4 after about 30+
days have problems. They generate events 2020 and people are not able to
logon anymore.
The problem is that the paged pool has been used up, but no idea what is
causing it.

When I look in Taskmanager I cannot see any large consumers of the paged pool.
So configured GFLAGS and used poolmon to make snapshots.

Today I noticed again that Paged Pool was very high, no events 2020 yet but
that would not have taken very long.

Because I suspected the printer spooler I stopped it and immediately noticed
a large dropdown in paged pool usage (approx from 192 MB to 74 MB). I took a
snapshot of poolmon before and after this change, to see what Tags have lost
most paged pool bytes.

Surprisingly I had the following results after comparing the before and
after snapshot of Poolmon:

1. ToKe -> Minus 89,552,160 Bytes
2. SeTD -> Minus 17,196,544 Bytes
3. OBtB -> Minus 253,952 Bytes

The rest is just small change.

I can't understand why ToKe releases so much paged pool bytes after just
stopping the spooler.

I read on Microsoft web that ToKe is used to cache the user's security
credentials, so each user session would use up some paged pool bytes. But I
never have seen any articles relating the printer spooler with the ToKe tag
in Poolmon.

Anyone know what could be causing this, maybe I am looking in the wrong
direction here?

The server is a Domain Controller, with Exchange 2000 SP3 and also
configured as Global Catalog and File-and-Print server.

Thanks in advance,

Jos Rossiau

 

[Dave Patrick]

One of these articles may help you.

http://support.microsoft.com/default.aspx?scid=kb;en-us;286060
http://support.microsoft.com/default.aspx?scid=kb;en-us;832791
http://support.microsoft.com/default.aspx?scid=kb;en-us;272568
http://support.microsoft.com/default.aspx?scid=kb;en-us;312362
http://support.microsoft.com/default.aspx?scid=kb;en-us;842716
http://support.microsoft.com/default.aspx?scid=kb;en-us;268343
http://support.microsoft.com/default.aspx?scid=kb;en-us;912376


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Hello,
|
| I have this problem that my Windows 2000 Servers with SP4 after about 30+
| days have problems. They generate events 2020 and people are not able to
| logon anymore.
| The problem is that the paged pool has been used up, but no idea what is
| causing it.
|
| When I look in Taskmanager I cannot see any large consumers of the paged
pool.
| So configured GFLAGS and used poolmon to make snapshots.
|
| Today I noticed again that Paged Pool was very high, no events 2020 yet
but
| that would not have taken very long.
|
| Because I suspected the printer spooler I stopped it and immediately
noticed
| a large dropdown in paged pool usage (approx from 192 MB to 74 MB). I took
a
| snapshot of poolmon before and after this change, to see what Tags have
lost
| most paged pool bytes.
|
| Surprisingly I had the following results after comparing the before and
| after snapshot of Poolmon:
|
| 1. ToKe -> Minus 89,552,160 Bytes
| 2. SeTD -> Minus 17,196,544 Bytes
| 3. OBtB -> Minus 253,952 Bytes
|
| The rest is just small change.
|
| I can't understand why ToKe releases so much paged pool bytes after just
| stopping the spooler.
|
| I read on Microsoft web that ToKe is used to cache the user's security
| credentials, so each user session would use up some paged pool bytes. But
I
| never have seen any articles relating the printer spooler with the ToKe
tag
| in Poolmon.
|
| Anyone know what could be causing this, maybe I am looking in the wrong
| direction here?
|
| The server is a Domain Controller, with Exchange 2000 SP3 and also
| configured as Global Catalog and File-and-Print server.
|
| Thanks in advance,
|
| Jos Rossiau
|

 

[Guest]

Hello Dave,

Most of the articles I already have been looking into. The most part are
about Exchange and Access Tokens. The one about the local printers is not
what I am experiencing.

I have thought about setting the PoolUsageMaximum in the registry but I am
not sure whether it is just hiding the problem. I do not sea the connection
between ToKe and the print spooler.

At this moment I am not sure whether it is actually caused by a memory leak
or that it is by "design". In the latter case I will have to apply the fix to
the registry.

Thanks for your help anyway.

Jos Rossiau

One of these articles may help you.

http://support.microsoft.com/default.aspx?scid=kb;en-us;286060
http://support.microsoft.com/default.aspx?scid=kb;en-us;832791
http://support.microsoft.com/default.aspx?scid=kb;en-us;272568
http://support.microsoft.com/default.aspx?scid=kb;en-us;312362
http://support.microsoft.com/default.aspx?scid=kb;en-us;842716
http://support.microsoft.com/default.aspx?scid=kb;en-us;268343
http://support.microsoft.com/default.aspx?scid=kb;en-us;912376


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Hello,
|
| I have this problem that my Windows 2000 Servers with SP4 after about 30+
| days have problems. They generate events 2020 and people are not able to
| logon anymore.
| The problem is that the paged pool has been used up, but no idea what is
| causing it.
|
| When I look in Taskmanager I cannot see any large consumers of the paged
pool.
| So configured GFLAGS and used poolmon to make snapshots.
|
| Today I noticed again that Paged Pool was very high, no events 2020 yet
but
| that would not have taken very long.
|
| Because I suspected the printer spooler I stopped it and immediately
noticed
| a large dropdown in paged pool usage (approx from 192 MB to 74 MB). I took
a
| snapshot of poolmon before and after this change, to see what Tags have
lost
| most paged pool bytes.
|
| Surprisingly I had the following results after comparing the before and
| after snapshot of Poolmon:
|
| 1. ToKe -> Minus 89,552,160 Bytes
| 2. SeTD -> Minus 17,196,544 Bytes
| 3. OBtB -> Minus 253,952 Bytes
|
| The rest is just small change.
|
| I can't understand why ToKe releases so much paged pool bytes after just
| stopping the spooler.
|
| I read on Microsoft web that ToKe is used to cache the user's security
| credentials, so each user session would use up some paged pool bytes. But
I
| never have seen any articles relating the printer spooler with the ToKe
tag
| in Poolmon.
|
| Anyone know what could be causing this, maybe I am looking in the wrong
| direction here?
|
| The server is a Domain Controller, with Exchange 2000 SP3 and also
| configured as Global Catalog and File-and-Print server.
|
| Thanks in advance,
|
| Jos Rossiau
|