Memory Leak-Poolmon/Process Explorer Question

We are using SBS2000 with all latest service packs for years--too
many! In the last 3 weeks we began to have a memory leak in the non-
paged pool in which the server would have to be rebooted after exactly
1 week to the day & within a 3-hour timeframe. We ran poolmon.exe to
help pinpoint the culprit and have collected data over a 4 day period.
In poolmon three are (2) suspect tags:

THre
File

We now want to run Process Explorer v11.04 to narrow down the
offending process(s), etc. Based on the above tags, what do we look
for in Process Explorer?

Thanks!

ricmar
Mon Dec 10 02:57:19 PST 2007

On Dec 7, 7:33 pm, compsos...@gmail.com wrote:
> We are using SBS2000 with all latest service packs for years--too
> many! In the last 3 weeks we began to have a memory leak in the non-
> paged pool in which the server would have to be rebooted after exactly
> 1 week to the day & within a 3-hour timeframe. We ranpoolmon.exe to
> help pinpoint the culprit and have collected data over a 4 day period.
> Inpoolmonthree are (2) suspect tags:
>
> THre
> File
>
> We now want to run Process Explorer v11.04 to narrow down the
> offending process(s), etc. Based on the above tags, what do we look
> for in Process Explorer?
>
> Thanks!

Hi,

the THre tag is related to threads. You have too look in the poolmon
and see which one is grabing your memory.
With the process explorer opened you could try, with the poolmon also
open, to associate the process with the the tag, by looking to the cpu
% time. See which process increments when the tag increments. It is
not a easy job!

Checkout the automatic updates of windows and other applications. This
problem could be also related with a conflit between two applications.

cheers,
Ricardo Marques

compsosinc
Mon Dec 10 04:19:59 PST 2007

On Dec 10, 5:57 am, ric...@gmail.com wrote:
> On Dec 7, 7:33 pm, compsos...@gmail.com wrote:
>
> > We are using SBS2000 with all latest service packs for years--too
> > many! In the last 3 weeks we began to have a memory leak in the non-
> > paged pool in which the server would have to be rebooted after exactly
> > 1 week to the day & within a 3-hour timeframe. We ranpoolmon.exe to
> > help pinpoint the culprit and have collected data over a 4 day period.
> > Inpoolmonthree are (2) suspect tags:
>
> > THre
> > File
>
> > We now want to run Process Explorer v11.04 to narrow down the
> > offending process(s), etc. Based on the above tags, what do we look
> > for in Process Explorer?
>
> > Thanks!
>
> Hi,
>
> the THre tag is related to threads. You have too look in the poolmon
> and see which one is grabing your memory.
> With the process explorer opened you could try, with the poolmon also
> open, to associate the process with the the tag, by looking to the cpu
> % time. See which process increments when the tag increments. It is
> not a easy job!
>
> Checkout the automatic updates of windows and other applications. This
> problem could be also related with a conflit between two applications.
>
> cheers,
> Ricardo Marques

Thank you for replying. It appears from the Pool Monitor, that the tag
"Thre" is the thread that is grabing memory. Also, there is a tag
labeled as "File" using memory as well. However, I was hoping to use
Process Explorer alone to associate the offending threads with a
process. Do you know if it is possible to do that with Process
Explorer, or another utility?

I am just trying to see how best to setup Process Explorer and to
understand how to interpet what is in the columns/layout. It sounds
like I need to focus on the CPU % time, but is there any other
attribute to consider here? For example, is there any place in Process
Explorer to find the tags "Thre" or "File".

Thanks again...