No announcement yet.

ISA event ID 2019 - nonpaged error

  • Filter
  • Time
  • Show
Clear All
new posts

  • ISA event ID 2019 - nonpaged error

    Windows Server 2000 sp4 & ISA sp2

    We've been getting the following error repeatedly in our logs:

    Event ID 2019: The server was unable to allocate from the system nonpaged pool because the pool was empty.

    After about 11 hours or so, like clockwork the nonpaged pool is full (limit 285,188k) and the server will basically stop functioning. If we shutdown the firewall service, the pool drops by about 100mb within seconds. Through the day it will slowly climb back up again.

    Using process explorer & poolmon.exe we've narrowed the suspects down to:

    IP Network Address Translator & ISA Server Network Address Translation Driver
    NatM ipnat.sys
    PNTM mspnat.sys

    Here's the output shortly after recycling the firewall service:
    Memory: 3931532K Avail: 2947628K PageFlts: 15244 InRam Krnl: 2988K P:130184K
    Commit: 931920K Limit:7958524K Peak:1343712K Pool N:86028K P:130372K
    Tag Type Allocs Frees Diff Bytes Per Alloc
    NatM Nonp 420959 ( 118 ) 408887 ( 0) 12072 3476736 ( 33984) 288
    PNTM Nonp 420044 ( 140) 419556 ( 0) 488 46848 ( 13440) 96

    A few hours later:
    Memory: 3931532K Avail: 2929520K PageFlts: 30009 InRam Krnl: 2984K P:127912K
    Commit:1011148K Limit:7958524K Peak:1343712K Pool N:87024K P:128100K
    Tag Type Allocs Frees Diff Bytes Per Alloc
    NatM Nonp 420341 ( 73) 357330 ( 0) 63011 18147168( 21024) 288
    PNTM Nonp 419361 ( 73) 366100 ( 0) 53261 5113056 ( 7008 ) 96

    After about 7 hours:
    Memory: 3931532K Avail: 3001816K PageFlts: 1262 InRam Krnl: 2720K P:98472K
    Commit:1121988K Limit:7958524K Peak:1343712K Pool N:164568K P:98660K
    Tag Type Allocs Frees Diff Bytes Per Alloc
    NatM Nonp 282385 ( 72) 7498 ( 0) 274887 79167456 ( 20736) 288
    PNTM Nonp 281676 ( 72) 6836 ( 0) 274840 26384640 ( 6912) 96

    The few articles I could find that seemed remotely related to this cite updating to the latest service pack, but don't really offer any other solultions. We've already done this. Any other ideas?

  • #2
    Re: ISA event ID 2019 - nonpaged error


    Which ISA Server ? 2000 or 2004 ?

    if 2000, then check this : ISA Server may cause non-paged pool memory peaks

    Are you using the /3gb switch ?

    if yes then check this : Why /3GB can negatively affect your ISA Server
    Last edited by elmajdal; 24th February 2009, 03:08.
    Tarek Majdalani
    MS Forefront Edge Security MVP


    • #3
      Re: ISA event ID 2019 - nonpaged error

      Thanks for the reply. Sorry, forgot to specify... it's ISA 2000. We've already applied the key in the past without any success. We're not running /3gb either.

      I've gone through just about every microsoft article I could find on nonpaged issues with ISA as well as many other online recommendations. Decided to go with poolmon for a bit to find the actual root cause of the leak, but was kind of hoping it'd be a third party software that we could just disable.

      I've reinstalled the drivers through the latest service pack to make sure it wasn't a corrupted driver issue, but I really don't know how to proceed from here.