Detecting memory leak

Hi,

My Webserver is crashing every 2 days and I can see Connection Refused
message in http error log. After googling around I found few links that
points to memory leak. I ran poolmon and collected and took few snapshots.
But I am still not sure if it is really leaking badly.

It seems Tags File and IoNm are leaking but I might be wrong. Please check
below for two snapshots of top allocation.


I ran poolmon -d ( sort by diff)

Snapshot 1:

Memory: 2358788K Avail: 979824K PageFlts: 797 InRam Krnl: 4228K
P:115908K
Commit:1262876K Limit:6402644K Peak:1669756K Pool N:71544K
P:117776K
System pool information
Tag Type Allocs Frees Diff Bytes Per
Alloc

File Nonp 21437579 ( 320) 21397912 ( 300) 39667 6060584 ( 3040)
152
IoNm Paged 22672560 ( 309) 22640039 ( 288) 32521 2534304 ( 1088)
77
AfdE Nonp 809936 ( 37) 782327 ( 15) 27609 7730520 ( 6160)
280
AfdX Paged 809915 ( 37) 782314 ( 15) 27601 7728280 ( 6160)
280
Even Nonp 3630561 ( 48) 3619775 ( 51) 10786 521664 ( -144)
48
Ntfr Nonp 170869 ( 0) 161089 ( 0) 9780 626888 ( 0)
64
MmSt Paged 360837 ( 0) 353701 ( 2) 7136 8454800 ( -528)
1184
CMVa Paged 4781088 ( 0) 4774661 ( 0) 6427 375384 ( 0)
58
NtFs Nonp 2795763 ( 26) 2789372 ( 9) 6391 257464 ( 680)
40
Ntfn Nonp 509160 ( 17) 502775 ( 0) 6385 257176 ( 680)
40
MmCa Nonp 1253709 ( 8) 1247683 ( 10) 6026 666160 ( -224)
110



Snapshot 2: ( after 15 mins)

Memory: 2358788K Avail: 1017764K PageFlts:78455390 InRam Krnl: 4228K
P:115724K
Commit:1203116K Limit:6402644K Peak:1669756K Pool N:71592K
P:116864K
System pool information
Tag Type Allocs Frees Diff Bytes Per
Alloc Mapped_Driver

File Nonp 21602668 ( 0) 21559085 ( 0) 43583 6657336 ( 0)
152 Unknown Driver
IoNm Paged 22853298 ( 0) 22816981 ( 0) 36317 2786376 ( 0)
76 Unknown Driver
AfdE Nonp 816592 ( 0) 785379 ( 0) 31213 8739640 ( 0)
280 [afd]
AfdX Paged 816571 ( 0) 785366 ( 0) 31205 8737400 ( 0)
280 Unknown Driver
Even Nonp 3657735 ( 0) 3646941 ( 0) 10794 522032 ( 0)
48 Unknown Driver
Ntfr Nonp 171574 ( 0) 161163 ( 0) 10411 667272 ( 0)
64 [ntfs]
MmSt Paged 362927 ( 0) 355454 ( 0) 7473 8633848 ( 0)
1155 Unknown Driver
NtFs Nonp 2803878 ( 0) 2797185 ( 0) 6693 269544 ( 0)
40 [ntfs]
Ntfn Nonp 514600 ( 0) 507913 ( 0) 6687 269256 ( 0)
40 [ntfs]
MmCa Nonp 1263798 ( 0) 1257453 ( 0) 6345 702176 ( 0)
110 Unknown Driver
CMVa Paged 4814530 ( 0) 4808563 ( 0) 5967 355472 ( 0)
59 Unknown Driver
MmSm Paged 289366 ( 0) 283548 ( 0) 5818 325808 ( 0)
56 Unknown Driver
Vad Nonp 1368294 ( 0) 1362614 ( 0) 5680 272640 ( 0)
48 Unknown Driver
FSfm Nonp 395640 ( 0) 390069 ( 0) 5571 222840 ( 0)
40 Unknown Driver
FSim Paged 394473 ( 0) 389226 ( 0) 5247 671616 ( 0)
128 Unknown Driver



thanks

Re: Detecting memory leak

On Dec 3, 3:35 pm, "spitfire" wrote:
> Hi,
>
> My Webserver is crashing every 2 days and I can see Connection Refused
> message in http error log. After googling around I found few links that
> points to memory leak. I ran poolmon and collected and took few snapshots.
> But I am still not sure if it is really leaking badly.
>
> It seems Tags File and IoNm are leaking but I might be wrong. Please check
> below for two snapshots of top allocation.
>
> I ran poolmon -d ( sort by diff)
>
> Snapshot 1:
>
> Memory: 2358788K Avail: 979824K PageFlts: 797 InRam Krnl: 4228K
> P:115908K
> Commit:1262876K Limit:6402644K Peak:1669756K Pool N:71544K
> P:117776K
> System pool information
> Tag Type Allocs Frees Diff Bytes Per
> Alloc
>
> File Nonp 21437579 ( 320) 21397912 ( 300) 39667 6060584 ( 3040)
> 152
> IoNm Paged 22672560 ( 309) 22640039 ( 288) 32521 2534304 ( 1088)
> 77
> AfdE Nonp 809936 ( 37) 782327 ( 15) 27609 7730520 ( 6160)
> 280
> AfdX Paged 809915 ( 37) 782314 ( 15) 27601 7728280 ( 6160)
> 280
> Even Nonp 3630561 ( 48) 3619775 ( 51) 10786 521664 ( -144)
> 48
> Ntfr Nonp 170869 ( 0) 161089 ( 0) 9780 626888 ( 0)
> 64
> MmSt Paged 360837 ( 0) 353701 ( 2) 7136 8454800 ( -528)
> 1184
> CMVa Paged 4781088 ( 0) 4774661 ( 0) 6427 375384 ( 0)
> 58
> NtFs Nonp 2795763 ( 26) 2789372 ( 9) 6391 257464 ( 680)
> 40
> Ntfn Nonp 509160 ( 17) 502775 ( 0) 6385 257176 ( 680)
> 40
> MmCa Nonp 1253709 ( 8) 1247683 ( 10) 6026 666160 ( -224)
> 110
>
> Snapshot 2: ( after 15 mins)
>
> Memory: 2358788K Avail: 1017764K PageFlts:78455390 InRam Krnl: 4228K
> P:115724K
> Commit:1203116K Limit:6402644K Peak:1669756K Pool N:71592K
> P:116864K
> System pool information
> Tag Type Allocs Frees Diff Bytes Per
> Alloc Mapped_Driver
>
> File Nonp 21602668 ( 0) 21559085 ( 0) 43583 6657336 ( 0)
> 152 Unknown Driver
> IoNm Paged 22853298 ( 0) 22816981 ( 0) 36317 2786376 ( 0)
> 76 Unknown Driver
> AfdE Nonp 816592 ( 0) 785379 ( 0) 31213 8739640 ( 0)
> 280 [afd]
> AfdX Paged 816571 ( 0) 785366 ( 0) 31205 8737400 ( 0)
> 280 Unknown Driver
> Even Nonp 3657735 ( 0) 3646941 ( 0) 10794 522032 ( 0)
> 48 Unknown Driver
> Ntfr Nonp 171574 ( 0) 161163 ( 0) 10411 667272 ( 0)
> 64 [ntfs]
> MmSt Paged 362927 ( 0) 355454 ( 0) 7473 8633848 ( 0)
> 1155 Unknown Driver
> NtFs Nonp 2803878 ( 0) 2797185 ( 0) 6693 269544 ( 0)
> 40 [ntfs]
> Ntfn Nonp 514600 ( 0) 507913 ( 0) 6687 269256 ( 0)
> 40 [ntfs]
> MmCa Nonp 1263798 ( 0) 1257453 ( 0) 6345 702176 ( 0)
> 110 Unknown Driver
> CMVa Paged 4814530 ( 0) 4808563 ( 0) 5967 355472 ( 0)
> 59 Unknown Driver
> MmSm Paged 289366 ( 0) 283548 ( 0) 5818 325808 ( 0)
> 56 Unknown Driver
> Vad Nonp 1368294 ( 0) 1362614 ( 0) 5680 272640 ( 0)
> 48 Unknown Driver
> FSfm Nonp 395640 ( 0) 390069 ( 0) 5571 222840 ( 0)
> 40 Unknown Driver
> FSim Paged 394473 ( 0) 389226 ( 0) 5247 671616 ( 0)
> 128 Unknown Driver
>
> thanks


If you search for NonPaged Pool Memory leaks and Connections_Refused,
you should eventually see a discussion that "File" pooltag usually
indicates some usermode process that has a high number of handles
open, hence forcing Windows Kernel to have the corresponding nonpaged
pool memory allocated. Thus, the problem is not that Windows is
leaking "File" but that usermode processes are leaking handles and
thus leaking "File". Look in Task Manager to see what process could be
the culprit and shut the process down to see if it reclaims nonpaged
pool memory. The culprit would be the usermode process, typically some
monitoring service.

All memory leaks are bad, especially if the leak overwhelms the system
*before* you intend to restart it. In other words, suppose you want to
restart the server once a week. If the leak takes 14 days to run out
of memory, then clearly you don't care about it. If the leak takes 2
days to run out of memory, then clearly you care about it.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Re: Detecting memory leak

"David Wang" wrote in message
news:49744d1e-dbf7-45b9-b2e5-09f212362e77@s36g2000prg.google groups.com...
> On Dec 3, 3:35 pm, "spitfire" wrote:
>> Hi,
>>
>> My Webserver is crashing every 2 days and I can see Connection Refused
>> message in http error log. After googling around I found few links that
>> points to memory leak. I ran poolmon and collected and took few
>> snapshots.
>> But I am still not sure if it is really leaking badly.
>>
>> It seems Tags File and IoNm are leaking but I might be wrong. Please
>> check
>> below for two snapshots of top allocation.
>>
>> I ran poolmon -d ( sort by diff)
>>
>> Snapshot 1:
>>
>> Memory: 2358788K Avail: 979824K PageFlts: 797 InRam Krnl: 4228K
>> P:115908K
>> Commit:1262876K Limit:6402644K Peak:1669756K Pool N:71544K
>> P:117776K
>> System pool information
>> Tag Type Allocs Frees Diff Bytes Per
>> Alloc
>>
>> File Nonp 21437579 ( 320) 21397912 ( 300) 39667 6060584 ( 3040)
>> 152
>> IoNm Paged 22672560 ( 309) 22640039 ( 288) 32521 2534304 ( 1088)
>> 77
>> AfdE Nonp 809936 ( 37) 782327 ( 15) 27609 7730520 ( 6160)
>> 280
>> AfdX Paged 809915 ( 37) 782314 ( 15) 27601 7728280 ( 6160)
>> 280
>> Even Nonp 3630561 ( 48) 3619775 ( 51) 10786 521664 ( -144)
>> 48
>> Ntfr Nonp 170869 ( 0) 161089 ( 0) 9780 626888 ( 0)
>> 64
>> MmSt Paged 360837 ( 0) 353701 ( 2) 7136 8454800 ( -528)
>> 1184
>> CMVa Paged 4781088 ( 0) 4774661 ( 0) 6427 375384 ( 0)
>> 58
>> NtFs Nonp 2795763 ( 26) 2789372 ( 9) 6391 257464 ( 680)
>> 40
>> Ntfn Nonp 509160 ( 17) 502775 ( 0) 6385 257176 ( 680)
>> 40
>> MmCa Nonp 1253709 ( 8) 1247683 ( 10) 6026 666160 ( -224)
>> 110
>>
>> Snapshot 2: ( after 15 mins)
>>
>> Memory: 2358788K Avail: 1017764K PageFlts:78455390 InRam Krnl: 4228K
>> P:115724K
>> Commit:1203116K Limit:6402644K Peak:1669756K Pool N:71592K
>> P:116864K
>> System pool information
>> Tag Type Allocs Frees Diff Bytes Per
>> Alloc Mapped_Driver
>>
>> File Nonp 21602668 ( 0) 21559085 ( 0) 43583 6657336 ( 0)
>> 152 Unknown Driver
>> IoNm Paged 22853298 ( 0) 22816981 ( 0) 36317 2786376 ( 0)
>> 76 Unknown Driver
>> AfdE Nonp 816592 ( 0) 785379 ( 0) 31213 8739640 ( 0)
>> 280 [afd]
>> AfdX Paged 816571 ( 0) 785366 ( 0) 31205 8737400 ( 0)
>> 280 Unknown Driver
>> Even Nonp 3657735 ( 0) 3646941 ( 0) 10794 522032 ( 0)
>> 48 Unknown Driver
>> Ntfr Nonp 171574 ( 0) 161163 ( 0) 10411 667272 ( 0)
>> 64 [ntfs]
>> MmSt Paged 362927 ( 0) 355454 ( 0) 7473 8633848 ( 0)
>> 1155 Unknown Driver
>> NtFs Nonp 2803878 ( 0) 2797185 ( 0) 6693 269544 ( 0)
>> 40 [ntfs]
>> Ntfn Nonp 514600 ( 0) 507913 ( 0) 6687 269256 ( 0)
>> 40 [ntfs]
>> MmCa Nonp 1263798 ( 0) 1257453 ( 0) 6345 702176 ( 0)
>> 110 Unknown Driver
>> CMVa Paged 4814530 ( 0) 4808563 ( 0) 5967 355472 ( 0)
>> 59 Unknown Driver
>> MmSm Paged 289366 ( 0) 283548 ( 0) 5818 325808 ( 0)
>> 56 Unknown Driver
>> Vad Nonp 1368294 ( 0) 1362614 ( 0) 5680 272640 ( 0)
>> 48 Unknown Driver
>> FSfm Nonp 395640 ( 0) 390069 ( 0) 5571 222840 ( 0)
>> 40 Unknown Driver
>> FSim Paged 394473 ( 0) 389226 ( 0) 5247 671616 ( 0)
>> 128 Unknown Driver
>>
>> thanks
>
>
> If you search for NonPaged Pool Memory leaks and Connections_Refused,
> you should eventually see a discussion that "File" pooltag usually
> indicates some usermode process that has a high number of handles
> open, hence forcing Windows Kernel to have the corresponding nonpaged
> pool memory allocated. Thus, the problem is not that Windows is
> leaking "File" but that usermode processes are leaking handles and
> thus leaking "File". Look in Task Manager to see what process could be
> the culprit and shut the process down to see if it reclaims nonpaged
> pool memory. The culprit would be the usermode process, typically some
> monitoring service.
>
> All memory leaks are bad, especially if the leak overwhelms the system
> *before* you intend to restart it. In other words, suppose you want to
> restart the server once a week. If the leak takes 14 days to run out
> of memory, then clearly you don't care about it. If the leak takes 2
> days to run out of memory, then clearly you care about it.
>
>
> //David
> http://w3-4u.blogspot.com
> http://blogs.msdn.com/David.Wang
> //


Hi David,
Thanks for your input.

I again ran poolmon and I think Tags "File" and AfdE are leaking. I am still
not sure which usermode process is leaking. So far, I restarted all running
services except iis and recycled all application pools.

I found a service (webxserv.exe, Webcrossing service) releases few
allocations when I restart it but stll Diff value remains too high.
In Taskmanager I can see Webxserv.exe is using 27 MB Paged Pool and 28.2 MB
NP Pool memory.
and Under Kernel Memory I have
Paged 156 MB and
Non Paged 87 MB (Am I about to hit some limit ? because I don't know what
the upper limit is )

I noticed that Non Paged usage increased by 10 MB in last 12 hours.

And, where can I see the upperlimit of Non Paged memory?

Here is the current snapsot from poolmon.

Memory: 2358788K Avail: 963452K PageFlts:165253 InRam Krnl: 4244K
P:156244K
Commit:1254400K Limit:6402644K Peak:1783520K Pool N:87172K
P:158324K
System pool information
Tag Type Allocs Frees Diff Bytes Per
Alloc Mapped_Driver

File Nonp 35987030 (11610) 35872911 (11531) 114119 17378696 ( 12136)
152 Unknown Driver
AfdE Nonp 1093413 ( 107) 995138 ( 65) 98275 27517000 ( 11760)
280 [afd]
Ntfr Nonp 357803 ( 107) 340120 ( 0) 17683 1132680 ( 6848)
64 [ntfs]
Even Nonp 4861297 ( 416) 4843637 ( 422) 17660 851520 ( -288)
48 Unknown Driver
Irp Nonp 13098547 ( 3) 13084463 ( 0) 14084 6691736 ( 1560)
475 Unknown Driver


thanks :-)

Re: Detecting memory leak

Even if there is 900 MB available memory, could there still be a memory leak
?

"David Wang" wrote in message
news:49744d1e-dbf7-45b9-b2e5-09f212362e77@s36g2000prg.google groups.com...
> On Dec 3, 3:35 pm, "spitfire" wrote:
>> Hi,
>>
>> My Webserver is crashing every 2 days and I can see Connection Refused
>> message in http error log. After googling around I found few links that
>> points to memory leak. I ran poolmon and collected and took few
>> snapshots.
>> But I am still not sure if it is really leaking badly.
>>
>> It seems Tags File and IoNm are leaking but I might be wrong. Please
>> check
>> below for two snapshots of top allocation.
>>
>> I ran poolmon -d ( sort by diff)
>>
>> Snapshot 1:
>>
>> Memory: 2358788K Avail: 979824K PageFlts: 797 InRam Krnl: 4228K
>> P:115908K
>> Commit:1262876K Limit:6402644K Peak:1669756K Pool N:71544K
>> P:117776K
>> System pool information
>> Tag Type Allocs Frees Diff Bytes Per
>> Alloc
>>
>> File Nonp 21437579 ( 320) 21397912 ( 300) 39667 6060584 ( 3040)
>> 152
>> IoNm Paged 22672560 ( 309) 22640039 ( 288) 32521 2534304 ( 1088)
>> 77
>> AfdE Nonp 809936 ( 37) 782327 ( 15) 27609 7730520 ( 6160)
>> 280
>> AfdX Paged 809915 ( 37) 782314 ( 15) 27601 7728280 ( 6160)
>> 280
>> Even Nonp 3630561 ( 48) 3619775 ( 51) 10786 521664 ( -144)
>> 48
>> Ntfr Nonp 170869 ( 0) 161089 ( 0) 9780 626888 ( 0)
>> 64
>> MmSt Paged 360837 ( 0) 353701 ( 2) 7136 8454800 ( -528)
>> 1184
>> CMVa Paged 4781088 ( 0) 4774661 ( 0) 6427 375384 ( 0)
>> 58
>> NtFs Nonp 2795763 ( 26) 2789372 ( 9) 6391 257464 ( 680)
>> 40
>> Ntfn Nonp 509160 ( 17) 502775 ( 0) 6385 257176 ( 680)
>> 40
>> MmCa Nonp 1253709 ( 8) 1247683 ( 10) 6026 666160 ( -224)
>> 110
>>
>> Snapshot 2: ( after 15 mins)
>>
>> Memory: 2358788K Avail: 1017764K PageFlts:78455390 InRam Krnl: 4228K
>> P:115724K
>> Commit:1203116K Limit:6402644K Peak:1669756K Pool N:71592K
>> P:116864K
>> System pool information
>> Tag Type Allocs Frees Diff Bytes Per
>> Alloc Mapped_Driver
>>
>> File Nonp 21602668 ( 0) 21559085 ( 0) 43583 6657336 ( 0)
>> 152 Unknown Driver
>> IoNm Paged 22853298 ( 0) 22816981 ( 0) 36317 2786376 ( 0)
>> 76 Unknown Driver
>> AfdE Nonp 816592 ( 0) 785379 ( 0) 31213 8739640 ( 0)
>> 280 [afd]
>> AfdX Paged 816571 ( 0) 785366 ( 0) 31205 8737400 ( 0)
>> 280 Unknown Driver
>> Even Nonp 3657735 ( 0) 3646941 ( 0) 10794 522032 ( 0)
>> 48 Unknown Driver
>> Ntfr Nonp 171574 ( 0) 161163 ( 0) 10411 667272 ( 0)
>> 64 [ntfs]
>> MmSt Paged 362927 ( 0) 355454 ( 0) 7473 8633848 ( 0)
>> 1155 Unknown Driver
>> NtFs Nonp 2803878 ( 0) 2797185 ( 0) 6693 269544 ( 0)
>> 40 [ntfs]
>> Ntfn Nonp 514600 ( 0) 507913 ( 0) 6687 269256 ( 0)
>> 40 [ntfs]
>> MmCa Nonp 1263798 ( 0) 1257453 ( 0) 6345 702176 ( 0)
>> 110 Unknown Driver
>> CMVa Paged 4814530 ( 0) 4808563 ( 0) 5967 355472 ( 0)
>> 59 Unknown Driver
>> MmSm Paged 289366 ( 0) 283548 ( 0) 5818 325808 ( 0)
>> 56 Unknown Driver
>> Vad Nonp 1368294 ( 0) 1362614 ( 0) 5680 272640 ( 0)
>> 48 Unknown Driver
>> FSfm Nonp 395640 ( 0) 390069 ( 0) 5571 222840 ( 0)
>> 40 Unknown Driver
>> FSim Paged 394473 ( 0) 389226 ( 0) 5247 671616 ( 0)
>> 128 Unknown Driver
>>
>> thanks
>
>
> If you search for NonPaged Pool Memory leaks and Connections_Refused,
> you should eventually see a discussion that "File" pooltag usually
> indicates some usermode process that has a high number of handles
> open, hence forcing Windows Kernel to have the corresponding nonpaged
> pool memory allocated. Thus, the problem is not that Windows is
> leaking "File" but that usermode processes are leaking handles and
> thus leaking "File". Look in Task Manager to see what process could be
> the culprit and shut the process down to see if it reclaims nonpaged
> pool memory. The culprit would be the usermode process, typically some
> monitoring service.
>
> All memory leaks are bad, especially if the leak overwhelms the system
> *before* you intend to restart it. In other words, suppose you want to
> restart the server once a week. If the leak takes 14 days to run out
> of memory, then clearly you don't care about it. If the leak takes 2
> days to run out of memory, then clearly you care about it.
>
>
> //David
> http://w3-4u.blogspot.com
> http://blogs.msdn.com/David.Wang
> //

Re: Detecting memory leak

Ehm...yes.

An application that leaks memory is not dependent on how much memory it is
left. It will leak memory no matter what.

Say that you have a machine with 2GB memory. After you have started up the
machine and the application that is leaking memory, you are using 1.1 GB.
Wouldn't you say that the application is leaking memory at this point (you
already know it is leaking memory)? Would you wait 'til you have 100MB left
of available memory until you said it was leaking memory?

Remember that leakage of memory does not necessarily need to be fixed. It
depends whether you are affected by it or not. If you have enough memory in
the machine that you will reboot before you run out of memory, you can just
leave it (or work on a fix that is not critical to implement).

--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


"Hassan" skrev i meddelandet
news:uy1WLsvNIHA.5264@TK2MSFTNGP02.phx.gbl...
> Even if there is 900 MB available memory, could there still be a memory
> leak ?
>
> "David Wang" wrote in message
> news:49744d1e-dbf7-45b9-b2e5-09f212362e77@s36g2000prg.google groups.com...
>> On Dec 3, 3:35 pm, "spitfire" wrote:
>>> Hi,
>>>
>>> My Webserver is crashing every 2 days and I can see Connection Refused
>>> message in http error log. After googling around I found few links that
>>> points to memory leak. I ran poolmon and collected and took few
>>> snapshots.
>>> But I am still not sure if it is really leaking badly.
>>>
>>> It seems Tags File and IoNm are leaking but I might be wrong. Please
>>> check
>>> below for two snapshots of top allocation.
>>>
>>> I ran poolmon -d ( sort by diff)
>>>
>>> Snapshot 1:
>>>
>>> Memory: 2358788K Avail: 979824K PageFlts: 797 InRam Krnl: 4228K
>>> P:115908K
>>> Commit:1262876K Limit:6402644K Peak:1669756K Pool N:71544K
>>> P:117776K
>>> System pool information
>>> Tag Type Allocs Frees Diff Bytes Per
>>> Alloc
>>>
>>> File Nonp 21437579 ( 320) 21397912 ( 300) 39667 6060584 ( 3040)
>>> 152
>>> IoNm Paged 22672560 ( 309) 22640039 ( 288) 32521 2534304 ( 1088)
>>> 77
>>> AfdE Nonp 809936 ( 37) 782327 ( 15) 27609 7730520 ( 6160)
>>> 280
>>> AfdX Paged 809915 ( 37) 782314 ( 15) 27601 7728280 ( 6160)
>>> 280
>>> Even Nonp 3630561 ( 48) 3619775 ( 51) 10786 521664 ( -144)
>>> 48
>>> Ntfr Nonp 170869 ( 0) 161089 ( 0) 9780 626888 ( 0)
>>> 64
>>> MmSt Paged 360837 ( 0) 353701 ( 2) 7136 8454800 ( -528)
>>> 1184
>>> CMVa Paged 4781088 ( 0) 4774661 ( 0) 6427 375384 ( 0)
>>> 58
>>> NtFs Nonp 2795763 ( 26) 2789372 ( 9) 6391 257464 ( 680)
>>> 40
>>> Ntfn Nonp 509160 ( 17) 502775 ( 0) 6385 257176 ( 680)
>>> 40
>>> MmCa Nonp 1253709 ( 8) 1247683 ( 10) 6026 666160 ( -224)
>>> 110
>>>
>>> Snapshot 2: ( after 15 mins)
>>>
>>> Memory: 2358788K Avail: 1017764K PageFlts:78455390 InRam Krnl: 4228K
>>> P:115724K
>>> Commit:1203116K Limit:6402644K Peak:1669756K Pool N:71592K
>>> P:116864K
>>> System pool information
>>> Tag Type Allocs Frees Diff Bytes Per
>>> Alloc Mapped_Driver
>>>
>>> File Nonp 21602668 ( 0) 21559085 ( 0) 43583 6657336 ( 0)
>>> 152 Unknown Driver
>>> IoNm Paged 22853298 ( 0) 22816981 ( 0) 36317 2786376 ( 0)
>>> 76 Unknown Driver
>>> AfdE Nonp 816592 ( 0) 785379 ( 0) 31213 8739640 ( 0)
>>> 280 [afd]
>>> AfdX Paged 816571 ( 0) 785366 ( 0) 31205 8737400 ( 0)
>>> 280 Unknown Driver
>>> Even Nonp 3657735 ( 0) 3646941 ( 0) 10794 522032 ( 0)
>>> 48 Unknown Driver
>>> Ntfr Nonp 171574 ( 0) 161163 ( 0) 10411 667272 ( 0)
>>> 64 [ntfs]
>>> MmSt Paged 362927 ( 0) 355454 ( 0) 7473 8633848 ( 0)
>>> 1155 Unknown Driver
>>> NtFs Nonp 2803878 ( 0) 2797185 ( 0) 6693 269544 ( 0)
>>> 40 [ntfs]
>>> Ntfn Nonp 514600 ( 0) 507913 ( 0) 6687 269256 ( 0)
>>> 40 [ntfs]
>>> MmCa Nonp 1263798 ( 0) 1257453 ( 0) 6345 702176 ( 0)
>>> 110 Unknown Driver
>>> CMVa Paged 4814530 ( 0) 4808563 ( 0) 5967 355472 ( 0)
>>> 59 Unknown Driver
>>> MmSm Paged 289366 ( 0) 283548 ( 0) 5818 325808 ( 0)
>>> 56 Unknown Driver
>>> Vad Nonp 1368294 ( 0) 1362614 ( 0) 5680 272640 ( 0)
>>> 48 Unknown Driver
>>> FSfm Nonp 395640 ( 0) 390069 ( 0) 5571 222840 ( 0)
>>> 40 Unknown Driver
>>> FSim Paged 394473 ( 0) 389226 ( 0) 5247 671616 ( 0)
>>> 128 Unknown Driver
>>>
>>> thanks
>>
>>
>> If you search for NonPaged Pool Memory leaks and Connections_Refused,
>> you should eventually see a discussion that "File" pooltag usually
>> indicates some usermode process that has a high number of handles
>> open, hence forcing Windows Kernel to have the corresponding nonpaged
>> pool memory allocated. Thus, the problem is not that Windows is
>> leaking "File" but that usermode processes are leaking handles and
>> thus leaking "File". Look in Task Manager to see what process could be
>> the culprit and shut the process down to see if it reclaims nonpaged
>> pool memory. The culprit would be the usermode process, typically some
>> monitoring service.
>>
>> All memory leaks are bad, especially if the leak overwhelms the system
>> *before* you intend to restart it. In other words, suppose you want to
>> restart the server once a week. If the leak takes 14 days to run out
>> of memory, then clearly you don't care about it. If the leak takes 2
>> days to run out of memory, then clearly you care about it.
>>
>>
>> //David
>> http://w3-4u.blogspot.com
>> http://blogs.msdn.com/David.Wang
>> //
>
>

Re: Detecting memory leak

Amount of available memory has no causal relationship to existence of
memory leak.

Connections_Refused happen because of depletion of NonPagedPool
Memory, which is *far* smaller than physical memory. In fact, it's
something like 12.5% of system RAM, capped at 256MB

In other words, you can have a machine with 4GB RAM that has 3.7GB RAM
free, run out of NonpagedPool memory, and the system will stop working
with "out of memory".

Also, it is possible to fragment memory such that you have 2GB
available, yet be unable to allocate a 1MB buffer.

You will want to read "Inside Windows" published by Microsoft Press
for the details and proper explanation. That's beyond the scope of the
newsgroup.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//





On Dec 4, 8:54 pm, "Hassan" wrote:
> Even if there is 900 MB available memory, could there still be a memory leak
> ?
>
> "David Wang" wrote in message
>
> news:49744d1e-dbf7-45b9-b2e5-09f212362e77@s36g2000prg.google groups.com...
>
>
>
> > On Dec 3, 3:35 pm, "spitfire" wrote:
> >> Hi,
>
> >> My Webserver is crashing every 2 days and I can see Connection Refused
> >> message in http error log. After googling around I found few links that
> >> points to memory leak. I ran poolmon and collected and took few
> >> snapshots.
> >> But I am still not sure if it is really leaking badly.
>
> >> It seems Tags File and IoNm are leaking but I might be wrong. Please
> >> check
> >> below for two snapshots of top allocation.
>
> >> I ran poolmon -d ( sort by diff)
>
> >> Snapshot 1:
>
> >> Memory: 2358788K Avail: 979824K PageFlts: 797 InRam Krnl: 4228K
> >> P:115908K
> >> Commit:1262876K Limit:6402644K Peak:1669756K Pool N:71544K
> >> P:117776K
> >> System pool information
> >> Tag Type Allocs Frees Diff Bytes Per
> >> Alloc
>
> >> File Nonp 21437579 ( 320) 21397912 ( 300) 39667 6060584 ( 3040)
> >> 152
> >> IoNm Paged 22672560 ( 309) 22640039 ( 288) 32521 2534304 ( 1088)
> >> 77
> >> AfdE Nonp 809936 ( 37) 782327 ( 15) 27609 7730520 ( 6160)
> >> 280
> >> AfdX Paged 809915 ( 37) 782314 ( 15) 27601 7728280 ( 6160)
> >> 280
> >> Even Nonp 3630561 ( 48) 3619775 ( 51) 10786 521664 ( -144)
> >> 48
> >> Ntfr Nonp 170869 ( 0) 161089 ( 0) 9780 626888 ( 0)
> >> 64
> >> MmSt Paged 360837 ( 0) 353701 ( 2) 7136 8454800 ( -528)
> >> 1184
> >> CMVa Paged 4781088 ( 0) 4774661 ( 0) 6427 375384 ( 0)
> >> 58
> >> NtFs Nonp 2795763 ( 26) 2789372 ( 9) 6391 257464 ( 680)
> >> 40
> >> Ntfn Nonp 509160 ( 17) 502775 ( 0) 6385 257176 ( 680)
> >> 40
> >> MmCa Nonp 1253709 ( 8) 1247683 ( 10) 6026 666160 ( -224)
> >> 110
>
> >> Snapshot 2: ( after 15 mins)
>
> >> Memory: 2358788K Avail: 1017764K PageFlts:78455390 InRam Krnl: 4228K
> >> P:115724K
> >> Commit:1203116K Limit:6402644K Peak:1669756K Pool N:71592K
> >> P:116864K
> >> System pool information
> >> Tag Type Allocs Frees Diff Bytes Per
> >> Alloc Mapped_Driver
>
> >> File Nonp 21602668 ( 0) 21559085 ( 0) 43583 6657336 ( 0)
> >> 152 Unknown Driver
> >> IoNm Paged 22853298 ( 0) 22816981 ( 0) 36317 2786376 ( 0)
> >> 76 Unknown Driver
> >> AfdE Nonp 816592 ( 0) 785379 ( 0) 31213 8739640 ( 0)
> >> 280 [afd]
> >> AfdX Paged 816571 ( 0) 785366 ( 0) 31205 8737400 ( 0)
> >> 280 Unknown Driver
> >> Even Nonp 3657735 ( 0) 3646941 ( 0) 10794 522032 ( 0)
> >> 48 Unknown Driver
> >> Ntfr Nonp 171574 ( 0) 161163 ( 0) 10411 667272 ( 0)
> >> 64 [ntfs]
> >> MmSt Paged 362927 ( 0) 355454 ( 0) 7473 8633848 ( 0)
> >> 1155 Unknown Driver
> >> NtFs Nonp 2803878 ( 0) 2797185 ( 0) 6693 269544 ( 0)
> >> 40 [ntfs]
> >> Ntfn Nonp 514600 ( 0) 507913 ( 0) 6687 269256 ( 0)
> >> 40 [ntfs]
> >> MmCa Nonp 1263798 ( 0) 1257453 ( 0) 6345 702176 ( 0)
> >> 110 Unknown Driver
> >> CMVa Paged 4814530 ( 0) 4808563 ( 0) 5967 355472 ( 0)
> >> 59 Unknown Driver
> >> MmSm Paged 289366 ( 0) 283548 ( 0) 5818 325808 ( 0)
> >> 56 Unknown Driver
> >> Vad Nonp 1368294 ( 0) 1362614 ( 0) 5680 272640 ( 0)
> >> 48 Unknown Driver
> >> FSfm Nonp 395640 ( 0) 390069 ( 0) 5571 222840 ( 0)
> >> 40 Unknown Driver
> >> FSim Paged 394473 ( 0) 389226 ( 0) 5247 671616 ( 0)
> >> 128 Unknown Driver
>
> >> thanks
>
> > If you search for NonPaged Pool Memory leaks and Connections_Refused,
> > you should eventually see a discussion that "File" pooltag usually
> > indicates some usermode process that has a high number of handles
> > open, hence forcing Windows Kernel to have the corresponding nonpaged
> > pool memory allocated. Thus, the problem is not that Windows is
> > leaking "File" but that usermode processes are leaking handles and
> > thus leaking "File". Look in Task Manager to see what process could be
> > the culprit and shut the process down to see if it reclaims nonpaged
> > pool memory. The culprit would be the usermode process, typically some
> > monitoring service.
>
> > All memory leaks are bad, especially if the leak overwhelms the system
> > *before* you intend to restart it. In other words, suppose you want to
> > restart the server once a week. If the leak takes 14 days to run out
> > of memory, then clearly you don't care about it. If the leak takes 2
> > days to run out of memory, then clearly you care about it.
>
> > //David
> >http://w3-4u.blogspot.com
> >http://blogs.msdn.com/David.Wang
> > //- Hide quoted text -
>
> - Show quoted text -