Hi, Problem with one server... is going to be out of memory during weekends.. Windows 2003 Standard SP2 + patches, File server with a storage where is about 1.1 TB of data (almost 10.7 million files). After some time (several hours of backup) it is going to be out of memory, that means physical RAM, so at the beginning everything is moving to the virtual memory, but later when there is nothing more to move the server is going to be not accessible and must be physically restarted to get it back. This time I crashed it and in the dump file I found.... 0: kd> !vm *** Virtual Memory Usage *** Physical Memory: 524109 ( 2096436 Kb) Page File: \??\C:\pagefile.sys Current: 524288 Kb Free Space: 363700 Kb Minimum: 524288 Kb Maximum: 524288 Kb Page File: \??\D:\pagefile.sys Current: 4193280 Kb Free Space: 4031760 Kb Minimum: 4193280 Kb Maximum: 4193280 Kb Available Pages: 32268 ( 129072 Kb) ResAvail Pages: 444698 ( 1778792 Kb) Locked IO Pages: 2103 ( 8412 Kb) Free System PTEs: 188920 ( 755680 Kb) Free NP PTEs: 32766 ( 131064 Kb) Free Special NP: 0 ( 0 Kb) Modified Pages: 741 ( 2964 Kb) Modified PF Pages: 498 ( 1992 Kb) ********** High Number Of Modified No Write Pages ******** Modified No Write Pages: 410959 ( 1643836 Kb) NonPagedPool Usage: 15582 ( 62328 Kb) NonPagedPool Max: 65536 ( 262144 Kb) PagedPool 0 Usage: 14441 ( 57764 Kb) PagedPool 1 Usage: 1868 ( 7472 Kb) PagedPool 2 Usage: 1871 ( 7484 Kb) PagedPool 3 Usage: 1842 ( 7368 Kb) PagedPool 4 Usage: 1859 ( 7436 Kb) PagedPool Usage: 21881 ( 87524 Kb) PagedPool Maximum: 90112 ( 360448 Kb) Shared Commit: 2051 ( 8204 Kb) Special Pool: 0 ( 0 Kb) Shared Process: 3743 ( 14972 Kb) PagedPool Commit: 21895 ( 87580 Kb) Driver Commit: 1928 ( 7712 Kb) Committed pages: 138942 ( 555768 Kb) Commit limit: 1666148 ( 6664592 Kb) and.... Usage Summary (in Kb): Control Valid Standby Dirty Shared Locked PageTables name 87981ad0 628 41344 1640540 0 0 0 mapped_file( $Mft ) ...so NTFS transaction log for sure and "Dirty" pages... as that 1643836 Kb (1,57 GB) of memory is what "disappeared" from my OS... (was allocated as "System cache", but real system cache as I checked was about 200-300 MB) "Dirty"... do you know what exacly does it mean? On the Veritas kb I found ("Modified No Write Pages") that it could be "Time Last Accessed" timestamp case (Veritas + MS investigation) and the slow access to the storage (especially during backup + volume shadow + AV + something unknown + big storage(maybe number of files in my case)) so everything this is causing it, but I haven't found any big number of files with modified "Last Accessed" timestamp on the storage.. (Dirty status?). Anyway I'm going to uninstall AV + disable stamping (last access) before the next weekend, but maybe I'm wrong somewhere and someone has better idea what is up/could be... Best regards and thanks for any feedback! Arek

Hi, Based on the symptom, this issue may be caused by memory leak. Besides uninstalling AV, please also disable other third party software for troubleshooting. It would be helpful if you let us know which third party software were installed on this server. Also, we may need to analyze the memory dump file to find the root cause, its suggested to contact Microsoft Customer Support Services (CSS) so that a dedicated Support Professional can assist with this request. Thank you for your understanding. To obtain the phone numbers for specific technology request please take a look at the web site listed below. http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS If you are outside the US please see http://support.microsoft.com for regional support phone numbers. Thanks. This posting is provided "AS IS" with no warranties, and confers no rights.

hi arekl,Did you had a chance to work on the issue ? and follow mervyn''s suggestion ? please let us know if you have any further issues so that we will resume troubleshooting.sainath !analyze

Hello, I'm sorry for the delay.. I forgot to update it. I found where was the problem... BackupExec, precisely Veritas Open File Agent (I don't remember what was its precise name) during backup of one folder with a large number of small files caused it... Hard to say if exactly that folder triggered the problem or not as I wasn't able to test it... but from the time when the backup team finally gave me a favor and disabled it, everything is all right. During weekends it is not needed at all... and the backup is much faster... I don't know if they opened later any case in Symantec... should. From outside it looks that during the backup when the agent was used, ntfs transaction log (Modified No Write Pages) was growing and growing (OS wasn't able to put that data down) till server was out of memory and frozen. BTW. In this case it wasn't Last accessed stamp. Before I identified the problem as far as I know a customer (?) opened also a case in MS... but they didn't find anything... I don't know what they were checkning... quite possible that only logs... (something like... please configure performance logging, download this tool and later execute it... and the result send to us...) So this is all... Thank you for the feedback... Arek