How to remove "Windows-virtual memory minimum too low" popup dialog?

[Slobodan Brcin]

Hello,

My problem:
1. I'm using minlogon build.
2. Page file support disabled. (And it must stay disabled.)
How to remove (disable) "Windows-virtual memory minimum too low" popup
dialog?


I have 512 MB RAM on our device and this dialog is triggered only once when
system reaches ~287 MB memory usage.
I have made app for testing purposes that allows me to commit memory in 1MB
increments, this is how I determined this memory barrier.

On regular XP I got balloon from the tray at ~300 MB with same message, this
means that there is a way to intercept and cancel this message box.

So if there is no way to disable this dialog trough registry, then how to
hook to this event, and to cancel it when it is triggered.

Only thing I could trace was that message origin from ntdll.dll inside of
csrss process.

Thanks,
Slobodan

 

[Doug Hoeffel \(eMVP\)]

Slobodan:

Message Box Interception?

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/htm
l/xesammessageinterception.asp

HTH... Doug

 

[Slobodan Brcin]

Doug,

I have just tried it, and it is working, this is good start. But now I
should check what is happening to our message boxes I should see.

I was hopping for some solution to stop this event from happening, not
result of event.

Thanks,
Slobodan

 

[Doug Hoeffel \(eMVP\)]

Yes I agree. I have also seen this problem but only a few times. Currently
I have no solution. Why do you think we have this problem when our builds
don't include page file support?

.... Doug

 

[Slobodan Brcin]

Doug,

Why do you think we have this problem when our builds don't include page

file support?

Because I have been conducting tests on both Windows XP, and XPe without
page file support from yesterday. And I'm able to reproduce problem always,
more than 30 times till now.
XP and XPE behavior is always the same.
XPe gives me dialog box.
XP balloon from tray.
This all happens when I commit more than 60% of memory.

Interesting part is, that when I close this dialog and my memtest
application, memory is obviously decommited.
Then when I start commiting it and when I cross event point message box is
not shown any more.


I'm wondering how no one else spotted or reported this as main problem till
now.

But my guesses:
1. Your approach conceal the problem.
2. Probably if you use winlogon without support for tray you can't see
neither balloon nor message box.
3. When you use only command prompt you can't see message box.

If you want I can send you my app so you can test your build.

Regards,
Slobodan

 

[Doug Hoeffel \(eMVP\)]

Slobodan:

My image is built with SP1 including Standard PC component with no page file
support, Windows Logon, Explorer Shell, Tray Icon Support etc. Basically it
looks like XP Pro but I also use RAM-based EWF. I have 256 Mb RAM.

I also do the following reg tweaks related to popups, balloons etc.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanc
ed]
"EnableBalloonTips"=dword:00000001
"ShowInfoTip"=dword:00000000

A few times on production boxes I have seen the following message in the
System Event log (found after the fact of course):

Application popup: Windows - Virtual Memory Minimum Too Low : Your system is
low on virtual memory. Windows is increasing the size of your virtual memory
paging file. During this process, memory requests for some applications may
be denied. For more information, see Help.

Based on this message, it does seem that I too get a pop-up dialog. No one
sees this since I have no VGA display.

So, I'm curious about your test application. If your willing to share I
will try to run it on my system ;-)

Thanks... Doug

 

[Doug Hoeffel \(eMVP\)]

Slobodan:

I ran your program. After hitting Q 4 times, I see the low virtual memory
balloon message from the task notification area. This balloon message seems
to go away after a while. I see the same message in the System Event Log
that I reported earlier.

For this to occur in the real use of my product, I must have a memory leak
somewhere that I've never noticed before.

.... Doug

I have posted it on xpefiles successfully but I can't see it.

So I have attached it to this post.

This is console application, and should work on any XPe that can support dos
console mode.
If you press + you will commit 1MB of memory.
If you press Q you will commit 16MB of memory.


Regards,
Slobodan

Slobodan:

My image is built with SP1 including Standard PC component with no page file
support, Windows Logon, Explorer Shell, Tray Icon Support etc.

Basically

it
looks like XP Pro but I also use RAM-based EWF. I have 256 Mb RAM.

I also do the following reg tweaks related to popups, balloons etc.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanc

ed]
"EnableBalloonTips"=dword:00000001
"ShowInfoTip"=dword:00000000

A few times on production boxes I have seen the following message in the
System Event log (found after the fact of course):

Application popup: Windows - Virtual Memory Minimum Too Low : Your

system

is
low on virtual memory. Windows is increasing the size of your virtual memory
paging file. During this process, memory requests for some applications may
be denied. For more information, see Help.

Based on this message, it does seem that I too get a pop-up dialog. No one
sees this since I have no VGA display.

So, I'm curious about your test application. If your willing to share I
will try to run it on my system ;-)

Thanks... Doug

box

is

now

I

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/htm

 

[Slobodan Brcin]

Doug,

Well, balloon in not a problem, but message box in minlogon is, since you
must hit ok for it to go away.

I hope that MS will make better support in future for systems without page
file support so this won't happen. This message box is useless since there
is nothing that OS can do to make more memory available.


Regards,
Slobodan

Slobodan:

I ran your program. After hitting Q 4 times, I see the low virtual memory
balloon message from the task notification area. This balloon message seems
to go away after a while. I see the same message in the System Event Log
that I reported earlier.

For this to occur in the real use of my product, I must have a memory leak
somewhere that I've never noticed before.

... Doug

I have posted it on xpefiles successfully but I can't see it.

So I have attached it to this post.

This is console application, and should work on any XPe that can support dos
console mode.
If you press + you will commit 1MB of memory.
If you press Q you will commit 16MB of memory.


Regards,
Slobodan



page
file Basically

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanc

ed]
"EnableBalloonTips"=dword:00000001
"ShowInfoTip"=dword:00000000

A few times on production boxes I have seen the following message in the
System Event log (found after the fact of course):

Application popup: Windows - Virtual Memory Minimum Too Low : Your

system

is
low on virtual memory. Windows is increasing the size of your virtual memory
paging file. During this process, memory requests for some

applications
may

be denied. For more information, see Help.

Based on this message, it does seem that I too get a pop-up dialog.

No
one

sees this since I have no VGA display.

So, I'm curious about your test application. If your willing to share I
will try to run it on my system ;-)

Thanks... Doug
Doug,

Why do you think we have this problem when our builds don't

include
page

file support?

Because I have been conducting tests on both Windows XP, and XPe without
page file support from yesterday. And I'm able to reproduce problem
always,
more than 30 times till now.
XP and XPE behavior is always the same.
XPe gives me dialog box.
XP balloon from tray.
This all happens when I commit more than 60% of memory.

Interesting part is, that when I close this dialog and my memtest
application, memory is obviously decommited.
Then when I start commiting it and when I cross event point message

box

is
not shown any more.


I'm wondering how no one else spotted or reported this as main problem
till
now.

But my guesses:
1. Your approach conceal the problem.
2. Probably if you use winlogon without support for tray you can't see
neither balloon nor message box.
3. When you use only command prompt you can't see message box.

If you want I can send you my app so you can test your build.

Regards,
Slobodan


message
Yes I agree. I have also seen this problem but only a few times.
Currently
I have no solution. Why do you think we have this problem when our
builds
don't include page file support?

... Doug
Doug,

I have just tried it, and it is working, this is good start. But

now

I
should check what is happening to our message boxes I should see.

I was hopping for some solution to stop this event from

happening,
not

result of event.

Thanks,
Slobodan

message
Slobodan:

Message Box Interception?

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/htm

registry,
then

 

[Slobodan Brcin]

Any other idea how to do this?

Thanks,
Slobodan

Doug,

I have just tried it, and it is working, this is good start. But now I
should check what is happening to our message boxes I should see.

I was hopping for some solution to stop this event from happening, not
result of event.

Thanks,
Slobodan


http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/htm

 

[KM]

Slobodan,

I have tried your tool (as well as my own one) to eats up all the memory to
get the "low memory" situation.
You're right, on XP Pro I can get only balloon (or just a systray
notification icon if balloons are turned off). It is hard to monitor the
registry access at the point when the balloon appears. Moreover, it seems
there is a global system flag (most likely, registry flag) that gets read by
OS at boot time and therefore we may not be able to catch it (anything
related) with the Regmon.

I agree with you that ntdll.dll only has the strings that appear on the low
memory dialog. That might be possible that some ntdll functions just have
low/no memory exception handlers that show the dialog. Then there might not
even be the registry flag we are looking for. However, this is the question
to MS (who does have access to the ntdll sources).

I don't have a minlogon build now but I played with XP Pro (turned off the
paging).
The most interesting regisry key and values related to the problem must be
under [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management]. You may want to try to play with the registry
values from there "NonPagedPoolQuota", "NonPagedPoolSize" (I was thinking to
clear their default "0" value to assign the real memory size estimate
values). However, playing with the registry did not fix the problem on XP
Pro (balloon still appears). So, it was negative result. However, as I
mentioned, I did not try that on a minlogon image.

I believe that MS looking at the ntdll and Explorer sources may shed some
light on the problem.

Sorry, could not be of any help,
KM


SB> Any other idea how to do this?

SB> Thanks,
SB> Slobodan




SB> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/
SB> xpehelp/htm









With best regards, KM. E-mail: (e-mail address removed)

 

[Slobodan Brcin]

Thanks for looking at the problem,

Well MS is probably the only one who can find real solution to this problem,
and hopefully remove it in some future QFE.

Registry keys you mentioned are not related to this problem, but thanks
anyway.
Of course I have tried to use Doug solution, but it went really awkward,
since we lost many our message boxes that should be seen. There are too many
of them to try to replace them in our program.
I guess that I'll have to try to write program code that will monitor
message boxes creation and when this one is detected I'll close it
automatically. This is really ugly.

Regards,
Slobodan

Slobodan,

I have tried your tool (as well as my own one) to eats up all the memory to
get the "low memory" situation.
You're right, on XP Pro I can get only balloon (or just a systray
notification icon if balloons are turned off). It is hard to monitor the
registry access at the point when the balloon appears. Moreover, it seems
there is a global system flag (most likely, registry flag) that gets read by
OS at boot time and therefore we may not be able to catch it (anything
related) with the Regmon.

I agree with you that ntdll.dll only has the strings that appear on the low
memory dialog. That might be possible that some ntdll functions just have
low/no memory exception handlers that show the dialog. Then there might not
even be the registry flag we are looking for. However, this is the question
to MS (who does have access to the ntdll sources).

I don't have a minlogon build now but I played with XP Pro (turned off the
paging).
The most interesting regisry key and values related to the problem must be
under [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management]. You may want to try to play with the registry
values from there "NonPagedPoolQuota", "NonPagedPoolSize" (I was thinking to
clear their default "0" value to assign the real memory size estimate
values). However, playing with the registry did not fix the problem on XP
Pro (balloon still appears). So, it was negative result. However, as I
mentioned, I did not try that on a minlogon image.

I believe that MS looking at the ntdll and Explorer sources may shed some
light on the problem.

Sorry, could not be of any help,
KM


SB> Any other idea how to do this?

SB> Thanks,
SB> Slobodan




SB> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/
SB> xpehelp/htm









With best regards, KM. E-mail: (e-mail address removed)

 

[KM]

Slobodan,

Yup, I've been thinking of the same solution - intercepting all the message
boxes in the system and filter the one you need (low memory) by its title.
Agree - this is really ugly solution :-(

Another ugly solution may be to remove the string from ntdll (e.g. open the
library with resource editor and change the bytes to set the string size to
0). If it is well written it should not pop the dialog up with a 0-sized
title or content. I have not tried this approach, though. Also, it would not
be legal to change MS binaries unless MS gives such permissions.

Seems that MS is only able to legally fix the problem (or, at least, give an
advice or workaround).

KM

SB> Thanks for looking at the problem,

SB> Well MS is probably the only one who can find real solution to this
SB> problem, and hopefully remove it in some future QFE.

SB> Registry keys you mentioned are not related to this problem, but
SB> thanks anyway.
SB> Of course I have tried to use Doug solution, but it went really
SB> awkward, since we lost many our message boxes that should be seen.
SB> There are too many of them to try to replace them in our program.
SB> I guess that I'll have to try to write program code that will
SB> monitor message boxes creation and when this one is detected I'll
SB> close it automatically. This is really ugly.

SB> Regards,
SB> Slobodan

Slobodan,
I have tried your tool (as well as my own one) to eats up all the
memory SB> to
get the "low memory" situation.
You're right, on XP Pro I can get only balloon (or just a systray
notification icon if balloons are turned off). It is hard to monitor
the registry access at the point when the balloon appears. Moreover,
it seems there is a global system flag (most likely, registry flag)
that gets read SB> by
OS at boot time and therefore we may not be able to catch it
(anything related) with the Regmon.
I agree with you that ntdll.dll only has the strings that appear on
the SB> low
memory dialog. That might be possible that some ntdll functions just
have low/no memory exception handlers that show the dialog. Then
there might SB> not
even be the registry flag we are looking for. However, this is the SB> question
to MS (who does have access to the ntdll sources).
I don't have a minlogon build now but I played with XP Pro (turned
off the paging).
The most interesting regisry key and values related to the problem
must be under
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management]. You may want to try to play with the
registry values from there "NonPagedPoolQuota", "NonPagedPoolSize" (I
was thinking SB> to
clear their default "0" value to assign the real memory size estimate
values). However, playing with the registry did not fix the problem
on XP
Pro (balloon still appears). So, it was negative result. However, as
I mentioned, I did not try that on a minlogon image.
I believe that MS looking at the ntdll and Explorer sources may shed
some light on the problem.
Sorry, could not be of any help,
KM

SB>>> Any other idea how to do this?

SB>>> Thanks,
SB>>> Slobodan




SB>>> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/
SB>>> xpehelp/htm



With best regards, KM. E-mail: (e-mail address removed)

 

[Slobodan Brcin]

Is there anyone else who is using minlogon with GUI (not command prompt or
headless support)?

Anyone from MS have you been able to reproduce the problem?



Regards,
Slobodan

 

[Slobodan Brcin]

http://support.microsoft.com/default.aspx?scid=kb;en-us;128642
Someone said that MS does not have(provide) enough info. Well info is there,
but there is so much that it is impossible to find if you don't know what
exactly to look for.

NOTE: Component: Event Log MUST BE PRESENT (it is error or intended feature
I don't know but I have lost two nights until I have figure this out).

Component: "Windows subsystem" contains
SYSTEM\ControlSet001\Control\Windows

This works perfectly (minlogon and winlogon), and it can distinguish and
filter out Error Popups from system and applications before message box
function is called.

Also:
NoInteractiveServices not related to this but it is useful to know:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/bas
e/interactive_services.asp



Little info on what is happening under the hood:

winsrv.dll is responsible for handling all Error events (logging them,
filtering and showing them if needed).

winsrv!UserHardErrorEx:
1. GetHardErrorText
2. RegisterEventSource
3. If step 2 ok then GetErrorMode - Read ErrorMode value every time from
registry.
4. LogErrorPopup
5. if needed to show info ProcessHardErrorRequest

winsrv!UserHardErrorEx->winsrv!ProcessHardErrorRequest ->winsrv!HardErrorHan
dler->USER32!MessageBoxTimeoutW


Sorry for this jumble,
But it is deep night and I have been exposed too long to windows debugger,
asm and hex numbers.


I'll try to organize this info.

Slobodan

 

[KM]

Slobodan,

This is very useful info for any XP embedded device especially for healess
systems!
In some of my applications I was using SetErrorMode(SEM_FAILCRITICALERRORS)
API call
(http://msdn.microsoft.com/library/en-us/debug/base/seterrormode.asp) but
the registry value would be a system global solution and it is good to know
it.

Thank you for your inverstigation,
KM

PS. I think the Error log must be present since system-originated hard
errors are logged to the system log in all modes (ErrorMode).

http://support.microsoft.com/default.aspx?scid=kb;en-us;128642
Someone said that MS does not have(provide) enough info. Well info is there,
but there is so much that it is impossible to find if you don't know what
exactly to look for.

NOTE: Component: Event Log MUST BE PRESENT (it is error or intended feature
I don't know but I have lost two nights until I have figure this out).

Component: "Windows subsystem" contains
SYSTEM\ControlSet001\Control\Windows

This works perfectly (minlogon and winlogon), and it can distinguish and
filter out Error Popups from system and applications before message box
function is called.

Also:
NoInteractiveServices not related to this but it is useful to know:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/bas
e/interactive_services.asp



Little info on what is happening under the hood:

winsrv.dll is responsible for handling all Error events (logging them,
filtering and showing them if needed).

winsrv!UserHardErrorEx:
1. GetHardErrorText
2. RegisterEventSource
3. If step 2 ok then GetErrorMode - Read ErrorMode value every time from
registry.
4. LogErrorPopup
5. if needed to show info ProcessHardErrorRequest

winsrv!UserHardErrorEx->winsrv!ProcessHardErrorRequest ->winsrv!HardErrorHan