How to identify runaway process / memory leak

[Brian]

I have an SBS2000 server that pretty much hangs after about 10 days of
running because it runs out of nonpaged pool space. It has been running fine
for about 5 years, and this started perhaps two months back. The first time,
I thought it was just an anomaly, but there has turned out to be a consistent
memory leak. Through PerfMon, I have identified the fact that both the
nonpaged bytes & the handle count steadily rise after a reboot but cannot
easily identify which process is responsible.

All the documentation I have seen seems to require me to have a suspect
process before I can determine whether it is, indeed, the problem. However,
how can I identify the runaway process if I have no idea which one is at
fault?

 

[Pegasus \(MVP\)]

"Brian" <Brian@discussions.microsoft.com> wrote in message
news:FF20F3EE-0D2C-4B6C-B3A2-7C56A073C077@microsoft.com...
>I have an SBS2000 server that pretty much hangs after about 10 days of
> running because it runs out of nonpaged pool space. It has been running
> fine
> for about 5 years, and this started perhaps two months back. The first
> time,
> I thought it was just an anomaly, but there has turned out to be a
> consistent
> memory leak. Through PerfMon, I have identified the fact that both the
> nonpaged bytes & the handle count steadily rise after a reboot but cannot
> easily identify which process is responsible.
>
> All the documentation I have seen seems to require me to have a suspect
> process before I can determine whether it is, indeed, the problem.
> However,
> how can I identify the runaway process if I have no idea which one is at
> fault?

Watch the Task Manager. It will tell you which process consumes
ever increasing amounts of memory.

 

[Brian]

It creeps up so slowly (over days, not minutes) that it is difficult to get a
visual baseline on that. Is there any simple way to capture/export the task
manager data to a flat/delimited file so that I can compare side-by-side
after an 8-hour or 36-hour period?

"Pegasus (MVP)" wrote:

>
> "Brian" <Brian@discussions.microsoft.com> wrote in message
> news:FF20F3EE-0D2C-4B6C-B3A2-7C56A073C077@microsoft.com...
> >I have an SBS2000 server that pretty much hangs after about 10 days of
> > running because it runs out of nonpaged pool space. It has been running
> > fine
> > for about 5 years, and this started perhaps two months back. The first
> > time,
> > I thought it was just an anomaly, but there has turned out to be a
> > consistent
> > memory leak. Through PerfMon, I have identified the fact that both the
> > nonpaged bytes & the handle count steadily rise after a reboot but cannot
> > easily identify which process is responsible.
> >
> > All the documentation I have seen seems to require me to have a suspect
> > process before I can determine whether it is, indeed, the problem.
> > However,
> > how can I identify the runaway process if I have no idea which one is at
> > fault?
>
> Watch the Task Manager. It will tell you which process consumes
> ever increasing amounts of memory.
>
>
>

 

[John John]

In Perfmon you can monitor the Non Paged Pool on the Processes
themselves. Select the processes that you want to monitor and then set
a log on them. Select to to log to a csv file and you will be able to
view the results in a spreadsheet, at a glance you will be able to see
which process is increasingly using the Non Paged Pool. The log
interval is set a 1 second by default, you should change that so that it
creates more manageable log files, the log could be set to log the
values every 5 minutes or so.

John

Brian wrote:
> It creeps up so slowly (over days, not minutes) that it is difficult to get a
> visual baseline on that. Is there any simple way to capture/export the task
> manager data to a flat/delimited file so that I can compare side-by-side
> after an 8-hour or 36-hour period?
>
> "Pegasus (MVP)" wrote:
>
>
>>"Brian" <Brian@discussions.microsoft.com> wrote in message
>>news:FF20F3EE-0D2C-4B6C-B3A2-7C56A073C077@microsoft.com...
>>
>>>I have an SBS2000 server that pretty much hangs after about 10 days of
>>>running because it runs out of nonpaged pool space. It has been running
>>>fine
>>>for about 5 years, and this started perhaps two months back. The first
>>>time,
>>>I thought it was just an anomaly, but there has turned out to be a
>>>consistent
>>>memory leak. Through PerfMon, I have identified the fact that both the
>>>nonpaged bytes & the handle count steadily rise after a reboot but cannot
>>>easily identify which process is responsible.
>>>
>>>All the documentation I have seen seems to require me to have a suspect
>>>process before I can determine whether it is, indeed, the problem.
>>>However,
>>>how can I identify the runaway process if I have no idea which one is at
>>>fault?
>>
>>Watch the Task Manager. It will tell you which process consumes
>>ever increasing amounts of memory.
>>
>>
>>