Announcement

Collapse
No announcement yet.

High memory usage inetinfo.exe, store.exe, sqlservr.exe

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • High memory usage inetinfo.exe, store.exe, sqlservr.exe

    Hi all,

    have a look at the following:


    Hardware & OS:
    Server running Windows Server 2003 SBS, fully patched.
    OS Version: 5.2.3790 Service Pack 2 Build 3790
    Original Install Date: 11-Dec-07, 20:25:43
    System Up Time: 31 Days, 13 Hours, 48 Minutes, 52 Seconds
    Processor(s): 2 Processor(s) Installed.
    [01]: x86 Family 15 Model 67 Stepping 3 AuthenticAMD ~3214 Mhz
    [02]: x86 Family 15 Model 67 Stepping 3 AuthenticAMD ~3214 Mhz
    Total Physical Memory: 4,094 MB
    Available Physical Memory: 3,114 MB
    Page File: Max Size: 8,265 MB
    Page File: Available: 6,956 MB
    Page File: In Use: 1,309 MB
    Page File Location(s): c:\pagefile.sys
    p:\pagefile.sys
    Disk is a RAID5 array (hardware controller), almost 1TB, +90% available.

    Background:
    Small transportation company, 2 users, 2 laptops and 2 desktops. User's off-site most of the time, connected thruough VPN.
    Server roles: IIS, RRAS, DHCP, DNS, PDC, File & Print, Fax service, Exchange
    Exchange is fully patched (SP2); using SBS POP connector to deliver mail from 2 ISP-hosted mailboxes. POP3 connector check interval is set to 15 minutes. Mailbox sizes: 2 mailboxes, 1 is @ 100Mb, the second is almost 1.2Gb.
    Sharepoint is installed, up to date but unused.
    Load on the server is usually VERY low. Only two users, they travel a lot, and mostly together. Time that more than one user is logged on to the server is rather low, and the server never has more than 2 users logged on.

    Extra software: GFI Mail-essentials 12.0

    Problem:
    Re-occuring high memory usage on inetinfo.exe, store.exe and sqlservr.exe. Today sql-instance had a memory usage above 1Gb (!).


    I cannot find any consistent behaviour, I mean last time this occurred was few weeks ago for about ten days every day. I cannot tell you which process is responsible, becouse usually it's one of the three that has a very high memory usage - it's either store, inetinfo or the sql instance, but it could be either one of them. I mean it's not ALWAYS exchange, and not always IIS...Work-around was to logon to the server remotely and restart the following services including dependencies:

    IIS Admin service
    Microsoft Exchange Information Store
    MSSQL$SBSMONITORING and/or MSSQL$SHAREPOINT

    Then, out-of nowhere, it stopped. Yesterday it returned again and today I had the same massage in my mailbox

    Alert on SBSSRV1 at 19-May-08 09:51:50

    A large amount of memory is committed to applications and processes. Consistently high memory usage can cause performance problems.



    When looking at event logs I see the following errors (FYI: the server usually runs perfectly. Last error in de logs dates from 14 Feb 2008 except those listed below)

    All errors logged on 12/5

    Apllication log:

    Time: 3:19 AM
    Source: MSExchangeSA
    Event ID: 1031
    One of the System Attendant's task is blocked.
    Function: CMonitoringTask::Work

    Date: 12 May 2008
    Time: 03:20 AM
    Source: MSExchangeDSAccess
    Event ID: 2114
    Process MAD.EXE (PID=3704). Topology Discovery failed, error 0xffffffff.

    Date: 12 May 2008
    Time: 03:21 AM
    Source: MSExchangeAL
    Event ID: 8026
    LDAP Bind was unsuccessful on directory sbssrv1.<domainname>.local for distinguished name ''. Directory returned error:[0x51] Server Down.

    Date: 12 May 2008
    Time: 03:26 AM
    Source: MSExchangeDSAccess
    Event ID: 2102
    Process MAD.EXE (PID=3704). All Domain Controller Servers in use are not responding:
    sbssrv1.magshipping.local


    System log

    Date: 12 May 2008
    Time: 03:12 AM
    Source: Service Control Manager
    Event ID: 7011
    Timeout (30000 milliseconds) waiting for a transaction response from the NtFrs service.


    No corresponding errors or warnings in other event logs.

    I'm stumped because the server can run sweetly for weeks, and then start having issues for a week, ten days... and stop without any interaction aside of restarting the services mentioned above. There are no tasks scheduled on that interval (only scheduled tasks are a shadow copy, SBS backup and uusage and performance report data collection and sending).


    Any suggestions to resolve this issue would be greatly appreciated...




    Grtz


    Lukas
    Last edited by Lukas; 19th May 2008, 10:30. Reason: typos

  • #2
    Re: High memory usage inetinfo.exe, store.exe, sqlservr.exe

    First of all, well done for a clear and explicit explanation.
    Second, open a commacnd window and type "tasklist /svc" without the quotes. This will give you a full llist of alll the processes, their PID and what it "in them" (eg svchost has a number of processes hosted by itself). In task manager view add the column for PID. Now you can correlate eg which sqlserver corresponds to SQL$Monitoring, SQL$Sharepoint etc.

    Maybe that can give you a clue as to which process is causing the problem.
    TIA

    Steven Teiger [SBS-MVP(2003-2009)]
    http://www.wintra.co.il/
    sigpic
    Iím honoured to have been selected for the SMB 150 list for 2013. This is the third time in succession (no logo available for 2011) that I have been honoured with this award.

    We donít stop playing because we grow old, we grow old because we stop playing.

    Comment


    • #3
      Re: High memory usage inetinfo.exe, store.exe, sqlservr.exe

      Hii

      My first suggestion to u is to disable GFI first and monitor the server as its the main culprit in most of the cases....

      The next thing we may do is to disable all third party services using msconfig to eliminate if it is some third party appliacation causing the isssue.

      If still nothing comes up,,then I would suggest an adplus dump of the processes mentioned specially inetinfo
      Follow the kb 286350 and use the-pn process name switch if somehow we can have the dump on here(not sure if its possible)..we can surely tell which unwanted process is trying to hook to itself to spike the CPU usage

      Regards

      Fazal
      Fazal Zaidi
      MCITP-Windows 2008,Exchange 2010,MCTS-Exchange 2007,2010,Lync 2010,MCSE-2000,2003,MCSA-2003,2008,2012,MCP,MCSE -Messaging 2013,ITIL

      Comment


      • #4
        Re: High memory usage inetinfo.exe, store.exe, sqlservr.exe

        @ teiger: thnx for the hint, never knew how to 'break-up' svchost into seperate processes... will try that next time the alert arrives in my e-mail.

        @fazal: thank you for the suggestion, but disabling antispam protection is not an option, because the company struggles with the ammount of spam being received. I'd have to replace GFI with something else to troubleshoot and test the behaviour of the server, however I hope it's not GFI as it was me who recommended it to the customer. Can you recommend another good (trial for time being) antispam solution that I could replace GFI with?

        Originally posted by fazal View Post
        Hii
        The next thing we may do is to disable all third party services using msconfig to eliminate if it is some third party appliacation causing the isssue.

        If still nothing comes up,,then I would suggest an adplus dump of the processes mentioned specially inetinfo
        Follow the kb 286350 and use the-pn process name switch if somehow we can have the dump on here(not sure if its possible)..we can surely tell which unwanted process is trying to hook to itself to spike the CPU usage

        Regards

        Fazal
        CPU usage seems OK, I've never received an alert regarding the CPU usage and the alert's treshold is SBS-standard. GFI is the only third-party app installed on the server... I'll check out that KB - thank you.



        Thnks guys,


        Lukas
        Last edited by Lukas; 19th May 2008, 13:39. Reason: typos, qwerty on laptop and azerty on desktop is killing me

        Comment


        • #5
          Re: High memory usage inetinfo.exe, store.exe, sqlservr.exe

          Hi Lukas

          I understand that its difficult to disable antispams in a production environment but its just that around 99% times I have found GFI as the main culprit..May be thats my luckbut surely there are few other work arounds


          Since u r using Exchange SP2...I would suggest we can enable Intelligent Message Filtering..Check this link for IMF guide
          http://www.microsoft.com/downloads/d...displaylang=en

          We can also enable reverse lookup for ur domain as most of the spam mails come in from bogus domains and if the reverse query fails then the mails would automatically be rejected..


          Regards

          Fazal
          Fazal Zaidi
          MCITP-Windows 2008,Exchange 2010,MCTS-Exchange 2007,2010,Lync 2010,MCSE-2000,2003,MCSA-2003,2008,2012,MCP,MCSE -Messaging 2013,ITIL

          Comment


          • #6
            Re: High memory usage inetinfo.exe, store.exe, sqlservr.exe

            Hi Fazal, thnx for the follow-up. I'll try using IMF and disable GFI to test. I'll let you know how it goes.


            Thnx


            Lukas

            Comment


            • #7
              Re: High memory usage inetinfo.exe, store.exe, sqlservr.exe

              A propos spam, I prefer to use a software service solution such as www.exchangedefender.com. It make so much more sense these days: they get and clean the spam/viruses/malware etc; they manage and keep the engines up to date; they provide the CPU/RAM/Storage for spam, freeing up your resources for real work; they save your Internet bandwidth as only "clean" mail comes down your pipe.

              In the interests of fairness, I will reveal that I am an ExchangeDefender reseller, but the points I make are still relevant and apply to any similar service.
              TIA

              Steven Teiger [SBS-MVP(2003-2009)]
              http://www.wintra.co.il/
              sigpic
              Iím honoured to have been selected for the SMB 150 list for 2013. This is the third time in succession (no logo available for 2011) that I have been honoured with this award.

              We donít stop playing because we grow old, we grow old because we stop playing.

              Comment


              • #8
                Re: High memory usage inetinfo.exe, store.exe, sqlservr.exe

                I looked into solutions like that but they require the MX record to point to the company providing the service...

                However in belgium the cheapest business subscription with a fixed IP (which offers less bandwidth and allows less traffic) is STILL more expensive than the fastest private subscription (which in this example has double the upstream and triple the downstream and allowed traffic volume)...

                In this particular setup a dynamic IP with a free service for dynamic dns gets the job done (VPN & in rare cases OWA) so I didnt recommend a fixed IP to keep the TCO low. They used to have only two laptops, and the mail accounts and collaboration 'features' were a nightmare...

                Thnx for the suggestion Teiger...


                Grtz


                Lukas

                Comment

                Working...
                X