SBS Server 2008 Using a lot of RA<

[gaiamatrixsystems]

Hi all,

Newbie here,

Just wondering if someone could help me with diagnosing a SBS Server with 8gig of RAM that is using a lot of memory please note that there are only 4 users?????

Can you please let me know what you need or would like me to upload so we can better look at this?

[CoffeeFiend]

Just wondering if someone could help me with diagnosing a SBS Server with 8gig of RAM that is using a lot of memory please note that there are only 4 users?????

First of all, I would see what process uses the RAM (task manager works, but process explorer is better)

Some programs are actually meant to basically use all the available memory to speed things up such as Exchange, and that is part of SBS (not sure how it's tuned by default on SBS 2008 though)

If you post a screenshot of process explorer (or task manager), then we'll be able to tell what's going on instead of just guessing.

[gaiamatrixsystems]

Just wondering if someone could help me with diagnosing a SBS Server with 8gig of RAM that is using a lot of memory please note that there are only 4 users?????

First of all, I would see what process uses the RAM (task manager works, but process explorer is better)

Some programs are actually meant to basically use all the available memory to speed things up such as Exchange, and that is part of SBS (not sure how it's tuned by default on SBS 2008 though)

If you post a screenshot of process explorer (or task manager), then we'll be able to tell what's going on instead of just guessing.

Hey thanks for the prompt response

I noticed that W3Wp.exe IIS worker one instance is using almost 800meg and there are another 5 or so as well.

Hope that helps )

Procexp.txt

[CoffeeFiend]

Microsoft.Exchange.ContentFilter.Wrapper.exe 7964 52,884 K 57,884 K CoreXT base ATL7 service exe test Microsoft Corporation

MSExchangeADTopologyService.exe 2288 12,400 K 16,580 K ACTIVE DIRECTORY TOPOLOGY SERVICE Microsoft Corporation

store.exe 2328 590,932 K 113,884 K Microsoft Exchange MDB Store Microsoft Corporation

mad.exe 2448 21,596 K 29,812 K Microsoft Exchange Server - System Attendant Microsoft Corporation

Microsoft.Exchange.AntispamUpdateSvc.exe 5996 32,356 K 26,432 K Microsoft Corporation

MsExchangeFDS.exe 6108 52,108 K 50,008 K Microsoft Corporation

MSExchangeMailboxAssistants.exe 5784 53,404 K 60,668 K Microsoft Corporation

MSExchangeMailSubmission.exe 6224 52,792 K 48,636 K Microsoft Corporation

Microsoft.Exchange.Cluster.ReplayService.exe 6352 1.14 54,988 K 48,712 K Microsoft Corporation

Microsoft.Exchange.Search.ExSearch.exe 6492 54,460 K 47,352 K Microsoft Corporation

Microsoft.Exchange.ServiceHost.exe 6612 126,860 K 98,536 K Microsoft Corporation

MSExchangeTransport.exe 6848 47,540 K 39,248 K Microsoft Corporation

EdgeTransport.exe 6312 300,568 K 230,344 K Microsoft Corporation

MSExchangeTransportLogSearch.exe 6940 96,224 K 65,812 K Microsoft Corporation

That's Exchange Server (for email)

sqlservr.exe 2564 124,200 K 117,936 K SQL Server Windows NT Microsoft Corporation

sqlservr.exe 2588 363,592 K 287,976 K SQL Server Windows NT - 64 Bit Microsoft Corporation

sqlservr.exe 2724 58,664 K 47,920 K SQL Server Windows NT Microsoft Corporation

sqlservr.exe 2912 514,924 K 433,532 K SQL Server Windows NT - 64 Bit Microsoft Corporation

That would be instances of SQL Server, serving various databases. One likely for sharepoint, another for backup exec, likely SAP, ... (a few other processes are related)

SAPB1iEventSender.exe 2596 172,736 K 89,748 K A command line tool to wrap a Java program into a Windows service SAP AG

SAP Business One Server -- several more processes, likely including:

tomcat5.exe 5248 304,064 K 143,112 K Service Runner Apache Software Foundation

w3wp.exe 7908 11,272 K 18,060 K IIS Worker Process Microsoft Corporation

w3wp.exe 8468 10,836 K 17,584 K IIS Worker Process Microsoft Corporation

w3wp.exe 8576 230,196 K 210,124 K IIS Worker Process Microsoft Corporation

w3wp.exe 9180 786,596 K 788,552 K IIS Worker Process Microsoft Corporation

w3wp.exe 9776 113,420 K 96,196 K IIS Worker Process Microsoft Corporation

w3wp.exe 10028 130,860 K 122,604 K IIS Worker Process Microsoft Corporation

w3wp.exe 8896 113,744 K 105,116 K IIS Worker Process Microsoft Corporation

w3wp.exe 6248 8,224 K 14,912 K IIS Worker Process Microsoft Corporation

A lot of IIS worker processes. Almost 1.5GB total, which is incredibly high for a small box with 4 users. There must be something wrong with the configuration or the apps it's serving (more SAP/java stuff perhaps)... I'd find out which site is using that much resources and look into it for sure

Trend Micro is also using quite a bit of resources seemingly:

Ntrtscan.exe 3332 43,612 K 8,848 K Trend Micro Common Client Real-time Scan Service (64-bit) Trend Micro Inc.

OfcAoSMgr.exe 3656 5,600 K 8,796 K Plug-in Manager Server Windows Service Trend Micro Inc.

OfcService.exe 3732 140,428 K 163,844 K ofcservice.exe Trend Micro Inc.

DbServer.exe 4116 91,104 K 94,300 K DbServer Trend Micro Inc.

svcGenericHost.exe 4468 1,712 K 4,016 K svcGenericHost.exe Trend Micro Inc.

SMEX_Master.exe 4560 363,088 K 389,488 K SMEX_Master.exe/SMEX_RemoteConfig.exe Trend Micro Inc.

svcGenericHost.exe 4544 1,712 K 4,020 K svcGenericHost.exe Trend Micro Inc.

SMEX_SystemWatcher.exe 4568 75,868 K 91,352 K SMEX_SystemWatcher.exe Trend Micro Inc.

TmListen.exe 6184 17,672 K 7,240 K Trend Micro Common Client Communication Service Trend Micro Inc.

CNTAoSMgr.exe 10332 2,180 K 4,836 K Trend Micro OfficeScan Client Plug-in Service Manager Trend Micro Inc.

svcGenericHost.exe 10528 1,712 K 4,028 K svcGenericHost.exe Trend Micro Inc.

SMEX_RemoteConfig.exe 10544 3,400 K 7,944 K SMEX_Master.exe/SMEX_RemoteConfig.exe Trend Micro Inc.

iCRCService.exe 10744 185,880 K 187,468 K iCRCService Trend Micro Inc.

TmProxy.exe 10964 15,620 K 23,148 K Trend Micro Proxy Service Trend Micro Inc.

PccNtMon.exe 3196 8,052 K 3,020 K Trend Micro Client/Server Security Agent Monitor Trend Micro Inc.

tmicAgentSetting.exe 9096 3,216 K 8,420 K Trend Micro Inc.

16 processes total (!) and almost 1GB of RAM... Norton clearly has nothing on this bloated pig

[gaiamatrixsystems]

so what are you thinking where do we go from here?

[CoffeeFiend]

so what are you thinking where do we go from here?

I'd find out which IIS application pool is using that much memory. appcmd is your friend. "appcmd list wps" will let you see what app pool each worker process belongs to. Here you see the worker process with Process ID 9180 uses 786,596 KB of RAM, so see which app pool matches it, and from there which site/application is causing the trouble (IIS mgr is also very helpful; powershell is pretty powerful too -- just "Import-Module webadministration" first). I would also look for virus protection that doesn't use anywhere near that much resources too (seriously, this is amazing)

[gaiamatrixsystems]

so what are you thinking where do we go from here?

I'd find out which IIS application pool is using that much memory. appcmd is your friend. "appcmd list wps" will let you see what app pool each worker process belongs to. Here you see the worker process with Process ID 9180 uses 786,596 KB of RAM, so see which app pool matches it, and from there which site/application is causing the trouble (IIS mgr is also very helpful; powershell is pretty powerful too -- just "Import-Module webadministration" first). I would also look for virus protection that doesn't use anywhere near that much resources too (seriously, this is amazing)

Thanks - How do i do the first part i tried CMD and also run but didn't work??????

I can log into IIS Manager and can see the Worker Processes and the application pools etc, but cant extract the data Im using Team Viewer and cant print screen

What AV solution would you use in a server environment?

Edited November 22, 2010 by gaiamatrixsystems