realized Posted January 2, 2006 Share Posted January 2, 2006 I have a box with 3 users logged in, no users accessing shared devices (printers, folders, etc), and these users have been gone since friday anyways.. Anyways...My winlogin.exe according to taskmanager is using 400mb of ram which seems like a LOT.Is this normal? I have 2GB ram, and running win2003 Standard, with MSDE, no iis or anything.. Link to comment Share on other sites More sharing options...
jroc Posted January 2, 2006 Share Posted January 2, 2006 I'd say do some investigating....I use Server 2003 and 1.5g of ram..and winlogon.exe is only using 504K of Memory. Link to comment Share on other sites More sharing options...
cluberti Posted January 3, 2006 Share Posted January 3, 2006 (edited) Running perfmon and poolmon should tell you what is using all of that memory - sounds like a leak in something running in the winlogon.exe process. Do you perchance have Citrix or Symantec PC Anywhere installed?The only reason I ask, is we only see winlogon leaks when a program has replaced the default gina with it's own (which both of the above do). There are others, but those are the ones I see the most. Edited January 4, 2006 by cluberti Link to comment Share on other sites More sharing options...
Bleeder Posted January 4, 2006 Share Posted January 4, 2006 Probably a stupid question, but does this problem server have SP1 for Windows 2003 installed? Link to comment Share on other sites More sharing options...
realized Posted January 5, 2006 Author Share Posted January 5, 2006 Windows 2003 SBS (Service Pack NONE).what is "poolmon" ? I will do some research and report back asap. Link to comment Share on other sites More sharing options...
cluberti Posted January 5, 2006 Share Posted January 5, 2006 First, download Perfwiz:http://www.microsoft.com/downloads/details...&displaylang=enUse the wizard to start performance monitoring on your server, but make sure you select the "High CPU" option to capture thread information. Don't select the "Terminal Server" or "Exchange Server" options when prompted either, as these will skew the results.Stop the logs after awhile and take a good look at the performance log file(s) that were created - you should get some indication as to what is using memory in the winlogon.exe process. If you need to dig deeper, let me know and I can give some more assistance. Link to comment Share on other sites More sharing options...
Bleeder Posted January 7, 2006 Share Posted January 7, 2006 (edited) Windows 2003 SBS (Service Pack NONE).what is "poolmon" ? I will do some research and report back asap.Any reason you're not running SBS 2003 SP1? It's been available for at least 6 months now, and would probably be Microsoft's 1st recommendation if you called them. Edited January 7, 2006 by Bleeder Link to comment Share on other sites More sharing options...
cluberti Posted January 7, 2006 Share Posted January 7, 2006 No, it wouldn't. We would suggest what I just suggested. Link to comment Share on other sites More sharing options...
fizban2 Posted January 8, 2006 Share Posted January 8, 2006 (edited) How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel Mode Memory Leakshttp://support.microsoft.com/kb/q177415/Poolmon will monitor memory tags and allocation of memory from the system paged and non page memory pools. this will help you find where the memory leak is taking place or point you in a better direction to look, check the article, very detailedOverView of pool mon and what it does. http://www.microsoft.com/technet/prodtechn...9ae75acfb5.mspx Edited January 8, 2006 by fizban2 Link to comment Share on other sites More sharing options...
cluberti Posted January 8, 2006 Share Posted January 8, 2006 Thanks - I didn't want to explain poolmon until the perfmon data was analyzed (you can usually see leaks in perfmon, which is easier for most people to read than raw pooltag data), but thanks for pointing out the links anyway .It's always good to have too much data than not enough . Link to comment Share on other sites More sharing options...
fizban2 Posted January 9, 2006 Share Posted January 9, 2006 i would agree with you, perfmon is much easier to read, having used poolmon only once though i know what you mean by the overwhelming of data. realized - have run perfmon yet and gotten data back from that? no need to worry about poolmon until you have gotten the data back from perfmon. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now