Announcement

Collapse
No announcement yet.

pf utilization through the roof!

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • pf utilization through the roof!

    Hello All,

    It seems that every post I have read researching this says something like adjust the pf configuration, yet doesn't tell where to go to do this. I have migrated a domain to a new hardware platform using the "swing migration" method. After two months of running on the new system, I have found that the pf utilization is at 7.8 gigs while the system has 4 gigs of system memory and 3.5 gigs available.

    This seems very very odd.

    I opened the system monitor and found these items logged:


    Critical 6/3/2009 10:29:43 AM World Wide Web Publishing SERVER W3SVC service is Stopped.This service provides Web connectivity and administration through the Internet Information Services snap-in.For more information about this event, see the event logs on the server computer. You can restart this service by using the View Services task in the Server Management Monitoring and Reporting taskpad.You can disable this alert by using the Change Alert Notifications task.

    Critical 6/3/2009 10:29:23 AM Process (inetinfo.exe) SERVER The inetinfo.exe process is allocating more memory than usual. The following services are hosted by this process: IISAdmin, POP3SVC, RESVC, and SMTPSVC.For more detail, review the event logs for events related to these services. It may help to stop and then restart these services.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

    Critical 6/3/2009 10:29:16 AM Microsoft Exchange Routing Engine SERVER RESvc service is Stopped.This service provides Exchange routing services using link state information. If this service is stopped, messages are not routed by the Small Business Server computer.For more information about this event, see the event logs on the server computer. You can restart this service by using the View Services task in the Server Management Monitoring and Reporting taskpad.You can disable this alert by using the Change Alert Notifications task.

    Critical 6/3/2009 10:29:14 AM Process (lsass.exe) SERVER The lsass.exe process is allocating more memory than usual.Use Task Manager to view the top processes by CPU or memory usage. If a service or process appears to be using an unusual amount of resources, try stopping and then restarting it.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

    Critical 6/3/2009 10:29:11 AM Simple Mail Transfer Protocol (SMTP) SERVER SMTPSVC service is Stop Pending.This service transports electronic mail across the network. If this service is stopped, messages are not delivered to the recipients.For more information about this event, see the event logs on the server computer. You can restart this service by using the View Services task in the Server Management Monitoring and Reporting taskpad.You can disable this alert by using the Change Alert Notifications task.

    Critical 6/3/2009 10:28:57 AM Process (store.exe) SERVER The store.exe process is allocating more memory than usual.Check to see if you are having problems with e-mail. If so, stop and then restart the Microsoft Exchange Information Store service.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

    Critical 6/3/2009 10:28:39 AM Allocated Memory SERVER A large amount of memory is committed to applications and processes. Consistently high memory usage can cause performance problems.To determine which processes and applications are using the most memory, use Task Manager. Monitor the activity of these resources over a few days. If they continue to use a high level of memory and are less critical processes or services, try stopping and then restarting them.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

    Critical 6/3/2009 10:12:21 AM Process (store.exe) SERVER The store.exe process is allocating more memory than usual.Check to see if you are having problems with e-mail. If so, stop and then restart the Microsoft Exchange Information Store service.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

    Critical 6/3/2009 10:12:42 AM Allocated Memory SERVER A large amount of memory is committed to applications and processes. Consistently high memory usage can cause performance problems.To determine which processes and applications are using the most memory, use Task Manager. Monitor the activity of these resources over a few days. If they continue to use a high level of memory and are less critical processes or services, try stopping and then restarting them.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

    Critical 6/3/2009 10:12:13 AM Process (inetinfo.exe) SERVER The inetinfo.exe process is allocating more memory than usual. The following services are hosted by this process: IISAdmin, POP3SVC, RESVC, and SMTPSVC.For more detail, review the event logs for events related to these services. It may help to stop and then restart these services.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

    Critical 6/3/2009 10:12:18 AM Process (lsass.exe) SERVER The lsass.exe process is allocating more memory than usual.Use Task Manager to view the top processes by CPU or memory usage. If a service or process appears to be using an unusual amount of resources, try stopping and then restarting it.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

    Again, the only advise with each listed item is try restarting the server. There must be a cause for this that I want to identify and correct. I am not sure where to begin.

    Please advise.

    Thank you,

    Jon

  • #2
    Re: pf utilization through the roof!

    Is the machine fully up to date?
    What AV is installed? (latest version?)
    May be an SBS thing but what do you specifically mean by utilisation for PF?

    If you read the errors did you check the services etc and what they were using / if they were running/stopping?
    cheers
    Andy

    Please read this before you post:


    Quis custodiet ipsos custodes?

    Comment


    • #3
      Re: pf utilization through the roof!

      Hello Andy,

      Thank you for your quick reply. What I meant by pf utilization is looking at the task manager PF graph, it shows 7.81 Gigs in use.

      Meanwhile, physical 4188112, used 345876, available 33753400.


      Because so many services are mentioned in the monitor, I don't know where to start looking. It does appear that they are running in the system manager.

      Thanks again,

      Jon[IMG]file:///C:/DOCUME%7E1/ADMINI%7E1.TEL/LOCALS%7E1/Temp/moz-screenshot-3.jpg[/IMG][IMG]file:///C:/DOCUME%7E1/ADMINI%7E1.TEL/LOCALS%7E1/Temp/moz-screenshot-2.jpg[/IMG][IMG]file:///C:/DOCUME%7E1/ADMINI%7E1.TEL/LOCALS%7E1/Temp/moz-screenshot-1.jpg[/IMG]

      Comment


      • #4
        Re: pf utilization through the roof!

        ok.. i know yo uwant to findthe siolution.. but what happens if you do restart.. does it clear up for a while ?
        Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

        Comment


        • #5
          Re: pf utilization through the roof!

          doh... I read PF and thought Public Folder....

          Back to the drawing board apologies!

          Have you made sure the server is fully patched especially Exchange? You didn't answer that question.
          Can you use the sysinternals processxp to to see what is running as well as everything else?
          Does the Exchange BPA show anything?
          cheers
          Andy

          Please read this before you post:


          Quis custodiet ipsos custodes?

          Comment


          • #6
            Re: pf utilization through the roof!

            Yes, the system is fully patched. Although the best practices analyzer did state that the server sp1 had not been applied. As I remember exchange sp2 required that all other patches be applied first. I followed all of the instructions from MS.

            However, I also went through the instructions for sp1 again just to see what it would say. Most said that they were already there, yet not all. Those that didn't say they were there I applied. I prefer to apply patches in order. And usually each subsequent patch should include those from before. This is kind of ugly.

            Also there is no anti-virus software on this system. I was attempting to install when I noticed this issue. All mail is being pumped through postini. The system is behind a simple linksys wireless AP which is providing simple firewall protection. This SBS 2003 system has a private and a public Ip configured on a single int. My preference is to have one inside int and another outside, however I copied the configuration from the previous system and didn't change anything other than hardware. My suspicions is that this may be partially due to something that was on the previous config. Since the swing method was used, I wonder whether something in the AD could cause bizarre behavior?

            Currently, the system is using .5 gig of ram and 10.5 gig of pf. I changed the setting to let windows manage page file usage. I will change the regedit setting for fragmentation to 0, the one that can be either 0 or 0x0004000 hexadecimal (262144 decimal).

            This has taken far too much of my time and I don't like to bill customers for being inept. meanwhile the system requires being rebooted.

            That answers the other question, yes rebooting helps for a few hours. Then it climbs.

            I have never seen a system use next to no available ram and stomp on the virtual memory (Page File) as this one is doing.

            Thank you for any advice I can get. This must be resolved as quickly as possible.

            Jon

            P.S. these messages are in the health monitor from a one hour period from 11:18AM to 12:19PM.
            The inetinfo.exe process is allocating more memory than usual. The following services are hosted by this process: IISAdmin, POP3SVC, RESVC, and SMTPSVC.For more detail, review the event logs for events related to these services. It may help to stop and then restart these services.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

            The store.exe process is allocating more memory than usual.Check to see if you are having problems with e-mail. If so, stop and then restart the Microsoft Exchange Information Store service.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

            The lsass.exe process is allocating more memory than usual.Use Task Manager to view the top processes by CPU or memory usage. If a service or process appears to be using an unusual amount of resources, try stopping and then restarting it.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

            RemoteAccess service is Stopped.This service enables virtual private network (VPN) and network address translation (NAT) routing services for the Small Business Server computer and other computers connected to the network. If this service is stopped, these services will be unavailable.For more information about this event, see the event logs on the server computer. You can restart this service by using the View Services task in the Server Management Monitoring and Reporting taskpad.You can disable this alert by using the Change Alert Notifications task.

            A large number of messages are pending in the e-mail server send queue.Verify that you have Internet connectivity. If you can view Web sites normally, contact your Internet service provider (ISP) to determine if there is a problem with their e-mail server.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

            A large amount of memory is committed to applications and processes. Consistently high memory usage can cause performance problems.To determine which processes and applications are using the most memory, use Task Manager. Monitor the activity of these resources over a few days. If they continue to use a high level of memory and are less critical processes or services, try stopping and then restarting them.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

            The store.exe process is allocating more memory than usual.Check to see if you are having problems with e-mail. If so, stop and then restart the Microsoft Exchange Information Store service.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

            The inetinfo.exe process is allocating more memory than usual. The following services are hosted by this process: IISAdmin, POP3SVC, RESVC, and SMTPSVC.For more detail, review the event logs for events related to these services. It may help to stop and then restart these services.You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

            Current memory and page file:

            Physical memory
            total ram: 4188112
            avail ram: 3598568
            Used ram: 1073016

            Kernel memory
            total 93160
            paged 61316
            non-paged 31848

            commit changes
            total 10867648
            limit 11950000
            peak 10889096
            Last edited by jpiezo; 5th June 2009, 04:24. Reason: adding more information

            Comment


            • #7
              Re: pf utilization through the roof!

              i'd suggest trying anti-malware suites, just to be sure.
              Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

              Comment


              • #8
                Re: pf utilization through the roof!

                Hello Everyone,

                This is an update, and a little pre-mature. However, so far things are looking much better. I made the change to the registry to the key located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Session Manager\ HeapDecommitFreeBlockThreshold changing the setting to zero. I do not know why it would be anything else other than zero. However, there was a post here that mentioned this being done when one doesn't know what to do. I figured that descibes me at this moment:

                http://blogs.technet.com/sbs/archive...ile-usage.aspx

                I will let you know what transpires in the next hour or so.

                Jon

                Comment

                Working...
                X