Exactly!
*From:* listsad...@lists.myitforum.com [mailto: listsad...@lists.myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife *Sent:* Wednesday, May 3, 2017 7:30 PM *To:* ntsysadm@lists.myitforum.com *Subject:* RE: [NTSysADM] Strange memory issue on a DC Nope. Based on the context, I figured you meant MB, otherwise your argument totally would have been weird. J *From:* listsad...@lists.myitforum.com [ mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Charles F Sullivan *Sent:* Wednesday, May 03, 2017 6:55 AM *To:* ntsysadm@lists.myitforum.com *Subject:* RE: [NTSysADM] Strange memory issue on a DC Thanks for pointing that out. I meant to say 150 **MB**. This probably made things really confusing. *From:* listsad...@lists.myitforum.com [mailto: listsad...@lists.myitforum.com] *On Behalf Of *Rene de Haas *Sent:* Wednesday, May 3, 2017 1:35 AM *To:* ntsysadm@lists.myitforum.com *Subject:* RE: [NTSysADM] Strange memory issue on a DC 150 GB, now that's a huge one. Op 2 mei 2017 20:46 schreef "Charles F Sullivan" <charles.sulliva...@bc.edu >: That is a huge log file, at least compared to what I’m used to and the default size. Might that be the problem? Our Security Log maximum is 150 GB on DCs and I think even that is way above the default. I totally understand your motivation for setting a large size because ours gets overwritten in as little as 1 hour. (We have ArcSight Log Collectors that archive them, so we’re set if we really need them.) Not sure, but my guess is that the size is the problem. *From:* listsad...@lists.myitforum.com [mailto: listsad...@lists.myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife *Sent:* Tuesday, May 2, 2017 2:04 PM *To:* ntsysadm@lists.myitforum.com *Subject:* RE: [NTSysADM] Strange memory issue on a DC The log is set to a max of 4GB. It is currently 3.88GB. It is also set to Overwrite events as needed (oldest events first). I am again getting the 521 events, but they are not the only events I’m getting yet. But they are coming in every couple of minutes. Memory is sitting at 93% right now. *From:* listsad...@lists.myitforum.com [ mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Melvin Backus *Sent:* Friday, April 28, 2017 7:39 AM *To:* ntsysadm@lists.myitforum.com *Subject:* RE: [NTSysADM] Strange memory issue on a DC Is that log set to a max size? You may be filling it and there’s no place for it to go. In that case either make it bigger or circular. Given it’s the security log circular probably isn’t a good choice unless you’re actively watching the log in real time but it would prevent it from stopping if the problem is it getting filled. -- There are 10 kinds of people in the world... those who understand binary and those who don't. *From:* listsad...@lists.myitforum.com [ mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Heaton, Joseph@Wildlife *Sent:* Friday, April 28, 2017 10:15 AM *To:* ntsysadm@lists.myitforum.com *Subject:* RE: [NTSysADM] Strange memory issue on a DC I found an issue with my Security log. For quite a while, it has been unable to log security events, and instead, has been putting event id 521 entries in. This event id says Unable to log events to security log. The resolution to that was to clear the log and reboot the server. When I did that, the memory usage dropped dramatically. However, this morning, it is back to around 85%, so I’m not sure I resolved the whole issue. *From:* listsad...@lists.myitforum.com [ mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Eric Wittersheim *Sent:* Thursday, April 27, 2017 7:46 AM *To:* ntsysadm@lists.myitforum.com *Subject:* Re: [NTSysADM] Strange memory issue on a DC Joseph, I had the exact same thing happen last night to a 2012R2 DC running on ESXi. Additionally, we have 2 2012 R2 IIS server that are exhibiting the same behavior. Eric On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife < joseph.hea...@wildlife.ca.gov> wrote: This DC is 2012R2. It is a VMWare guest. It has been running at 95%+ memory utilization. I’m not sure for how long, but I happened to see an alarm for CPU utilization on the guest when I was in vCenter yesterday afternoon. When I RDP into the domain controller, it is very slow to login. I open Task Manager, and on the Performance tab, Memory is at 98%, and steady. I look at the Processes tab, and the memory shown as used doesn’t add up. There are lots of processes using memory, but the largest user is using around 100MB. The box has 4GB assigned. Looking at the Details tab doesn’t shed any more light on the issue. So, our first thought is some kind of memory leak, so we schedule and perform a reboot last night. As soon as the box comes back up, I log in, and memory is right back at 98%. I compare with a couple other DCs, and one of those has around the same number of processes running, but its highest user is right around 1GB, and its overall usage is around 60%. What other tools can I use to help figure out where that memory is going? Thanks, Joe Heaton Information Technology Operations Branch Data and Technology Division CA Department of Fish and Wildlife 1700 9th Street, 3rd Floor Sacramento, CA 95811 Desk: (916) 323-1284 Every Californian should conserve water. Find out how at: SaveOurWater.com <http://saveourwater.com/> · Drought.CA.gov <http://drought.ca.gov/>
