Windows 2000 memory usage growing...

[Colin]

My Windows 2000 PC has recently started showing the error message 'windows
is low on virtual memory.....' when there are not that many appps/windows
open. This usually happens a few hours after booting up in the morning.

When I look in the Windows Task Manager I see that the 'Mem Usage' is up at

700000k ( it is around 250000k after rebooting). Closing all the

applications and windows doesn't (substantially) reduce the mem usage.

On the Processes tab, I have noticed that some of the processes are using
huge amounts of memory, particularly SERVICES.EXE (>50000k) although this is
around 6000k at bootup. Other huge memory users are LSASS.EXE and CSRSS.EXE.

I have an up to date virus checker installed but this hasn't reported any
new nasties.

Any clues as to what is happening, and how to stop it?

Thanks,
Colin

 

[Dave Patrick]

Check Event Viewer for errors.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| My Windows 2000 PC has recently started showing the error message 'windows
| is low on virtual memory.....' when there are not that many appps/windows
| open. This usually happens a few hours after booting up in the morning.
|
| When I look in the Windows Task Manager I see that the 'Mem Usage' is up
at
| >700000k ( it is around 250000k after rebooting). Closing all the
| applications and windows doesn't (substantially) reduce the mem usage.
|
| On the Processes tab, I have noticed that some of the processes are using
| huge amounts of memory, particularly SERVICES.EXE (>50000k) although this
is
| around 6000k at bootup. Other huge memory users are LSASS.EXE and
CSRSS.EXE.
|
| I have an up to date virus checker installed but this hasn't reported any
| new nasties.
|
| Any clues as to what is happening, and how to stop it?
|
| Thanks,
| Colin
|
|

 

[CWLee]

Check Event Viewer for errors.

How does one do that? Per the help menu, I went start,
settings, control panel, administrative tools - but no Event
Viewer shown. (I too am using W-2000/pro.)

Thanks for any insight.

 

[Ron Hinds]

How does one do that? Per the help menu, I went start,
settings, control panel, administrative tools - but no Event
Viewer shown. (I too am using W-2000/pro.)

Thanks for any insight.

How about Start | Run, type in eventvwr.msc /s and click OK.

 

[Adam Joseph Cook]

How does one do that? Per the help menu, I went start,
settings, control panel, administrative tools - but no Event
Viewer shown. (I too am using W-2000/pro.)

Thanks for any insight.

Hey Dave,

To access the event viewer simply goto Run... in the Start Menu
and type in (without quotes) "eventvwr.msc /s".

I would suggest, if the event viewer doesnt turn up anything, to go
get Process Explorer (its free) by SysInternals (search on Google). It
breaks down the thread processes and loaded DLLs better than the Task
Manager does to really see where your problems might be.

Hope this helps.

--Adam Joseph Cook, Mechanical Engineer

 

[Sid Knee]

How does one do that? Per the help menu, I went start,
settings, control panel, administrative tools - but no Event
Viewer shown. (I too am using W-2000/pro.)

Right Click on <My Computer>, select <manage>, select <event viewer>

 

[Colin]

There is nothing interesting in the system event log -- no errors, just a
few entries at each boot up.

I have installed Process Explorer as suggested, but what would I be looking
for in relation to the increasing memory use by Services.exe??

Many thanks

Colin

 

[Adam Joseph Cook]

There is nothing interesting in the system event log -- no errors, just a
few entries at each boot up.

I have installed Process Explorer as suggested, but what would I be looking
for in relation to the increasing memory use by Services.exe??

Many thanks

Colin

Hey Colin,

In Process Explorer, sort the Process column by clicking on the
header. If it is not done already, SERVICES.EXE tree will now expand
to show all its child processes. Then right click on any of the
column headers (e.g. PID), and goto Select Columns... In the dialog
that appears, I usually goto the Process Memory tab and check the
Working Set boxes (middle devision).

Now you can see which process (and its child and/or parent processes)
are giving you the trouble. Also, if that doesnt help there are more
columns you can add that give a complete history of the process. I
usually use the technique described above to sniff out any unnecessary
processes when new programs are installed becuase I run a CAD station
and need all the memory I can get.

Its just that services.exe is a parent to alot of sub-processes and
Process explorer gives you alot of tools that Task Manager does not.
And its free.

Did I answer your question? If not, reply.

--Adam Joseph Cook, Mechanical Engineer

 

[vasukaan]

I have a server which is generating multiple instances of the above
Events
in Event Viewer each day. We are running Windows 2000 SP4, and SQL
Server 2000.

It is an IBM 255 server, with a IBM ServeRAID 5L controller, 2 x 36GB
Raid 1, 3 * 74.6GB drives configured in a RAID 5 array. I have checked
the hardware
thoroughly ( firmware, BIOS, driver revisions etc) and extracted low
level log files from the RAID controller which would show most
hardware failures, and IBM has viewed these and told me the hardware
is fine.


The first event, ID 51, displays the following info:


Event ID: 51, Source: Disk, Type: Warning, Catagory:None.
"An error was detected on device \Device\Harddisk0\DR0 during a paging
operation"


We are receiving the above error up to 20 times a day.


The second event, ID 50, displays the following info:


Event ID: 50, Source: Ftdisk, Type: Warning, Catagory: None
"{Lost Delayed-Write Data} The system was attempting to transfer file
data
from buffers to \Device\HarddiskVolume1. The write operation failed,
and
only some of the data may have been written to the file"


I'm getting this message about once per day.


The problem appears when working with large files > 1GB in size, such
as a database dump or just copying large files.


I'm in a situation where MS Knowledge Base tells me hardware and the
hardware and hardware vendor tell me software. Has anyone experienced
these
events in this manner before? I would greatly appreciate any
assistance with
this.