Non Paged pool memory leak on Windows server 2003 (Memory Tag "File")

All,

I am seeing a non-paged pool memory leak on my Windows server 2003 server.
After running PoolMon, culprit memory tag is “File” (File Objects).

I am not sure which driver is leaking the memory. Any idea to track down the
memory leak will be highly appreciated. Is there any tool which i can run
on the system to figure out which driver is leaking memory?


Thanks
Rajesh Gupta
408 744 0482 (Home)
408 480 2454 (Cell)

How do you know it is a true leak vs an application which has many file handles open?

d


From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Rajesh Gupta
Sent: Thursday, January 05, 2006 3:49 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Non Paged pool memory leak on Windows server 2003 (Memory Tag “File”)

All,
?
I am seeing a non-paged pool memory leak on my Windows server 2003 server. After running PoolMon, culprit memory tag is “File” (File Objects).
?
I am not sure which driver is leaking the memory. Any idea to track down the memory leak will be highly appreciated. ?Is there any tool which i can run on the system to figure out which driver is leaking memory?
?


Thanks
Rajesh Gupta
408 744 0482 (Home)
408 480 2454 (Cell)
— Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com

I ran ProcessExplorer, handles, perf-mon counters and other tools to find
out its not a file handles open by any application. Eventually after 2-3
weeks, system runs out of Non-Paged pool memory and applications starts
spitting errors.
thanks

Rajesh

On 1/5/06, Doron Holan wrote:
>
> How do you know it is a true leak vs an application which has many file
> handles open?
>
> d
>
> ________________________________________
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] On Behalf Of Rajesh Gupta
> Sent: Thursday, January 05, 2006 3:49 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Non Paged pool memory leak on Windows server 2003 (Memory
> Tag “File”)
>
> All,
>
> I am seeing a non-paged pool memory leak on my Windows server 2003 server.
> After running PoolMon, culprit memory tag is “File” (File Objects).
>
> I am not sure which driver is leaking the memory. Any idea to track down
> the memory leak will be highly appreciated. Is there any tool which i can
> run on the system to figure out which driver is leaking memory?
>
>
>
> –
> Thanks
> Rajesh Gupta
> 408 744 0482 (Home)
> 408 480 2454 (Cell)
> — Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256 You are currently subscribed
> to ntdev as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
> email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>


Thanks
Rajesh Gupta
408 744 0482 (Home)
408 480 2454 (Cell)

This sort of thing can be very difficult to track down. Doron had the right
first instinct…things like backup products that open all the files on a
volume can cause hundreds of thousands of file objects to be in existence,
even after the handles are closed, but it is not a leak. However, if pool
is actually getting exhausted, there is a leak. One possibiliity is that a
driver is referencing file objects and not dereferencing them. Another is
that a driver has deadlocked the system thread nt!MiDereferenceThread (name
is from memory and approximate). If that is the case, it is relatively easy
to track down (once you know what your’re looking for…otherwise it’s a
bitch…I speak from experience)

Good luck,

  • Dan.
    .

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Rajesh Gupta
Sent: Thursday, January 05, 2006 5:34 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Non Paged pool memory leak on Windows server 2003
(Memory Tag “File”)

I ran ProcessExplorer, handles, perf-mon counters and other tools to find
out its not a file handles open by any application. Eventually after 2-3
weeks, system runs out of Non-Paged pool memory and applications starts
spitting errors.
thanks

Rajesh

On 1/5/06, Doron Holan wrote:

How do you know it is a true leak vs an application which has many file
handles open?

d

________________________________________
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Rajesh Gupta
Sent: Thursday, January 05, 2006 3:49 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Non Paged pool memory leak on Windows server 2003 (Memory
Tag “File”)

All,

I am seeing a non-paged pool memory leak on my Windows server 2003 server.
After running PoolMon, culprit memory tag is “File” (File Objects).

I am not sure which driver is leaking the memory. Any idea to track down the
memory leak will be highly appreciated. Is there any tool which i can run on
the system to figure out which driver is leaking memory?


Thanks
Rajesh Gupta
408 744 0482 (Home)
408 480 2454 (Cell)
— Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
http: You are currently subscribed
to ntdev as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Thanks
Rajesh Gupta
408 744 0482 (Home)
408 480 2454 (Cell) — Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256 You are currently subscribed to
ntdev as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email
to xxxxx@lists.osr.com</http:>