RE: [NTSysADM] Strange memory issue on a DC

[Rene de Haas]

I should have put a smiley there. I got what he meant.

Op 4 mei 2017 4:06 p.m. schreef "Charles F Sullivan" <
charles.sulliva...@bc.edu>:

> Exactly!
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife
> *Sent:* Wednesday, May 3, 2017 7:30 PM
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* RE: [NTSysADM] Strange memory issue on a DC
>
>
>
> Nope.  Based on the context, I figured you meant MB, otherwise your
> argument totally would have been weird.  J
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Charles F
> Sullivan
> *Sent:* Wednesday, May 03, 2017 6:55 AM
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* RE: [NTSysADM] Strange memory issue on a DC
>
>
>
> Thanks for pointing that out. I meant to say 150 **MB**. This probably
> made things really confusing.
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com] *On Behalf Of *Rene de Haas
> *Sent:* Wednesday, May 3, 2017 1:35 AM
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* RE: [NTSysADM] Strange memory issue on a DC
>
>
>
> 150 GB, now that's a huge one.
>
>
>
> Op 2 mei 2017 20:46 schreef "Charles F Sullivan" <
> charles.sulliva...@bc.edu>:
>
> That is a huge log file, at least compared to what I’m used to and the
> default size. Might that be the problem? Our Security Log maximum is 150 GB
> on DCs and I think even that is way above the default.
>
>
>
> I totally understand your motivation for setting a large size because ours
> gets overwritten in as little as 1 hour. (We have ArcSight Log Collectors
> that archive them, so we’re set if we really need them.) Not sure, but my
> guess is that the size is the problem.
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife
>
>
> *Sent:* Tuesday, May 2, 2017 2:04 PM
>
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* RE: [NTSysADM] Strange memory issue on a DC
>
>
>
> The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set
> to Overwrite events as needed (oldest events first).
>
>
>
> I am again getting the 521 events, but they are not the only events I’m
> getting yet.  But they are coming in every couple of minutes.
>
>
>
> Memory is sitting at 93% right now.
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Melvin
> Backus
> *Sent:* Friday, April 28, 2017 7:39 AM
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* RE: [NTSysADM] Strange memory issue on a DC
>
>
>
> Is that log set to a max size? You may be filling it and there’s no place
> for it to go.  In that case either make it bigger or circular. Given it’s
> the security log circular probably isn’t a good choice unless you’re
> actively watching the log in real time but it would prevent it from
> stopping if the problem is it getting filled.
>
>
>
> --
> There are 10 kinds of people in the world...
>  those who understand binary and those who don't.
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Heaton,
> Joseph@Wildlife
> *Sent:* Friday, April 28, 2017 10:15 AM
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* RE: [NTSysADM] Strange memory issue on a DC
>
>
>
> I found an issue with my Security log.  For quite a while, it has been
> unable to log security events, and instead, has been putting event id 521
> entries in.  This event id says Unable to log events to security log.  The
> resolution to that was to clear the log and reboot the server.  When I did
> that, the memory usage dropped dramatically.  However, this morning, it is
> back to around 85%, so I’m not sure I resolved the whole issue.
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Eric
> Wittersheim
> *Sent:* Thursday, April 27, 2017 7:46 AM
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* Re: [NTSysADM] Strange memory issue on a DC
>
>
>
> Joseph,
>
>
>
> I had the exact same thing happen last night to a 2012R2 DC running on
> ESXi.  Additionally, we have 2 2012 R2 IIS server that are exhibiting the
> same behavior.
>
>
>
> Eric
>
>
>
> On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife <
> joseph.

RE: [NTSysADM] Strange memory issue on a DC

[Charles F Sullivan]

Exactly!



*From:* listsad...@lists.myitforum.com [mailto:
listsad...@lists.myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife
*Sent:* Wednesday, May 3, 2017 7:30 PM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



Nope.  Based on the context, I figured you meant MB, otherwise your
argument totally would have been weird.  J



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Charles F Sullivan
*Sent:* Wednesday, May 03, 2017 6:55 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



Thanks for pointing that out. I meant to say 150 **MB**. This probably made
things really confusing.



*From:* listsad...@lists.myitforum.com [mailto:
listsad...@lists.myitforum.com] *On Behalf Of *Rene de Haas
*Sent:* Wednesday, May 3, 2017 1:35 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



150 GB, now that's a huge one.



Op 2 mei 2017 20:46 schreef "Charles F Sullivan" <charles.sulliva...@bc.edu
>:

That is a huge log file, at least compared to what I’m used to and the
default size. Might that be the problem? Our Security Log maximum is 150 GB
on DCs and I think even that is way above the default.



I totally understand your motivation for setting a large size because ours
gets overwritten in as little as 1 hour. (We have ArcSight Log Collectors
that archive them, so we’re set if we really need them.) Not sure, but my
guess is that the size is the problem.



*From:* listsad...@lists.myitforum.com [mailto:
listsad...@lists.myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife


*Sent:* Tuesday, May 2, 2017 2:04 PM

*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set to
Overwrite events as needed (oldest events first).



I am again getting the 521 events, but they are not the only events I’m
getting yet.  But they are coming in every couple of minutes.



Memory is sitting at 93% right now.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Melvin Backus
*Sent:* Friday, April 28, 2017 7:39 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



Is that log set to a max size? You may be filling it and there’s no place
for it to go.  In that case either make it bigger or circular. Given it’s
the security log circular probably isn’t a good choice unless you’re
actively watching the log in real time but it would prevent it from
stopping if the problem is it getting filled.



--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Heaton, Joseph@Wildlife
*Sent:* Friday, April 28, 2017 10:15 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



I found an issue with my Security log.  For quite a while, it has been
unable to log security events, and instead, has been putting event id 521
entries in.  This event id says Unable to log events to security log.  The
resolution to that was to clear the log and reboot the server.  When I did
that, the memory usage dropped dramatically.  However, this morning, it is
back to around 85%, so I’m not sure I resolved the whole issue.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Eric Wittersheim
*Sent:* Thursday, April 27, 2017 7:46 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* Re: [NTSysADM] Strange memory issue on a DC



Joseph,



I had the exact same thing happen last night to a 2012R2 DC running on
ESXi.  Additionally, we have 2 2012 R2 IIS server that are exhibiting the
same behavior.



Eric



On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife <
joseph.hea...@wildlife.ca.gov> wrote:

This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
memory utilization.  I’m not sure for how long, but I happened to see an
alarm for CPU utilization on the guest when I was in vCenter yesterday
afternoon.  When I RDP into the domain controller, it is very slow to
login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
and steady.  I look at the Processes tab, and the memory shown as used
doesn’t add up.  There are lots of processes using memory, but the largest
user is using around 100MB.  The box has 4GB assigned.  Looking at the
Details tab doesn’t shed any more light on the issue.  So, our first
thought is some kind of memory leak, so we schedule and perform a reboot
last night.  As soon as the box comes back up, I log in, and memory is
right back at 98

RE: [NTSysADM] Strange memory issue on a DC

[Heaton, Joseph@Wildlife]

Nope.  Based on the context, I figured you meant MB, otherwise your argument 
totally would have been weird.  ☺

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Charles F Sullivan
Sent: Wednesday, May 03, 2017 6:55 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Strange memory issue on a DC

Thanks for pointing that out. I meant to say 150 *MB*. This probably made 
things really confusing.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com>] 
On Behalf Of Rene de Haas
Sent: Wednesday, May 3, 2017 1:35 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

150 GB, now that's a huge one.

Op 2 mei 2017 20:46 schreef "Charles F Sullivan" 
<charles.sulliva...@bc.edu<mailto:charles.sulliva...@bc.edu>>:
That is a huge log file, at least compared to what I’m used to and the default 
size. Might that be the problem? Our Security Log maximum is 150 GB on DCs and 
I think even that is way above the default.

I totally understand your motivation for setting a large size because ours gets 
overwritten in as little as 1 hour. (We have ArcSight Log Collectors that 
archive them, so we’re set if we really need them.) Not sure, but my guess is 
that the size is the problem.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com>] 
On Behalf Of Heaton, Joseph@Wildlife

Sent: Tuesday, May 2, 2017 2:04 PM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set to 
Overwrite events as needed (oldest events first).

I am again getting the 521 events, but they are not the only events I’m getting 
yet.  But they are coming in every couple of minutes.

Memory is sitting at 93% right now.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Melvin Backus
Sent: Friday, April 28, 2017 7:39 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

Is that log set to a max size? You may be filling it and there’s no place for 
it to go.  In that case either make it bigger or circular. Given it’s the 
security log circular probably isn’t a good choice unless you’re actively 
watching the log in real time but it would prevent it from stopping if the 
problem is it getting filled.

--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Heaton, Joseph@Wildlife
Sent: Friday, April 28, 2017 10:15 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

I found an issue with my Security log.  For quite a while, it has been unable 
to log security events, and instead, has been putting event id 521 entries in.  
This event id says Unable to log events to security log.  The resolution to 
that was to clear the log and reboot the server.  When I did that, the memory 
usage dropped dramatically.  However, this morning, it is back to around 85%, 
so I’m not sure I resolved the whole issue.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Eric Wittersheim
Sent: Thursday, April 27, 2017 7:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Strange memory issue on a DC

Joseph,

I had the exact same thing happen last night to a 2012R2 DC running on ESXi.  
Additionally, we have 2 2012 R2 IIS server that are exhibiting the same 
behavior.

Eric

On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife 
<joseph.hea...@wildlife.ca.gov<mailto:joseph.hea...@wildlife.ca.gov>> wrote:
This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we sc

RE: [NTSysADM] Strange memory issue on a DC

[Charles F Sullivan]

Thanks for pointing that out. I meant to say 150 **MB**. This probably made
things really confusing.



*From:* listsad...@lists.myitforum.com [mailto:
listsad...@lists.myitforum.com] *On Behalf Of *Rene de Haas
*Sent:* Wednesday, May 3, 2017 1:35 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



150 GB, now that's a huge one.



Op 2 mei 2017 20:46 schreef "Charles F Sullivan" <charles.sulliva...@bc.edu
>:

That is a huge log file, at least compared to what I’m used to and the
default size. Might that be the problem? Our Security Log maximum is 150 GB
on DCs and I think even that is way above the default.



I totally understand your motivation for setting a large size because ours
gets overwritten in as little as 1 hour. (We have ArcSight Log Collectors
that archive them, so we’re set if we really need them.) Not sure, but my
guess is that the size is the problem.



*From:* listsad...@lists.myitforum.com [mailto:
listsad...@lists.myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife


*Sent:* Tuesday, May 2, 2017 2:04 PM

*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set to
Overwrite events as needed (oldest events first).



I am again getting the 521 events, but they are not the only events I’m
getting yet.  But they are coming in every couple of minutes.



Memory is sitting at 93% right now.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Melvin Backus
*Sent:* Friday, April 28, 2017 7:39 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



Is that log set to a max size? You may be filling it and there’s no place
for it to go.  In that case either make it bigger or circular. Given it’s
the security log circular probably isn’t a good choice unless you’re
actively watching the log in real time but it would prevent it from
stopping if the problem is it getting filled.



--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Heaton, Joseph@Wildlife
*Sent:* Friday, April 28, 2017 10:15 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



I found an issue with my Security log.  For quite a while, it has been
unable to log security events, and instead, has been putting event id 521
entries in.  This event id says Unable to log events to security log.  The
resolution to that was to clear the log and reboot the server.  When I did
that, the memory usage dropped dramatically.  However, this morning, it is
back to around 85%, so I’m not sure I resolved the whole issue.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Eric Wittersheim
*Sent:* Thursday, April 27, 2017 7:46 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* Re: [NTSysADM] Strange memory issue on a DC



Joseph,



I had the exact same thing happen last night to a 2012R2 DC running on
ESXi.  Additionally, we have 2 2012 R2 IIS server that are exhibiting the
same behavior.



Eric



On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife <
joseph.hea...@wildlife.ca.gov> wrote:

This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
memory utilization.  I’m not sure for how long, but I happened to see an
alarm for CPU utilization on the guest when I was in vCenter yesterday
afternoon.  When I RDP into the domain controller, it is very slow to
login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
and steady.  I look at the Processes tab, and the memory shown as used
doesn’t add up.  There are lots of processes using memory, but the largest
user is using around 100MB.  The box has 4GB assigned.  Looking at the
Details tab doesn’t shed any more light on the issue.  So, our first
thought is some kind of memory leak, so we schedule and perform a reboot
last night.  As soon as the box comes back up, I log in, and memory is
right back at 98%.  I compare with a couple other DCs, and one of those has
around the same number of processes running, but its highest user is right
around 1GB, and its overall usage is around 60%.   What other tools can I
use to help figure out where that memory is going?



Thanks,



Joe Heaton

Information Technology Operations Branch

Data and Technology Division

CA Department of Fish and Wildlife

1700 9th Street, 3rd Floor

Sacramento, CA  95811

Desk:  (916) 323-1284



Every Californian should conserve water.  Find out how at:

SaveOurWater.com <http://saveourwater.com/> · Drought.CA.gov
<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Rene de Haas]

150 GB, now that's a huge one.

Op 2 mei 2017 20:46 schreef "Charles F Sullivan" <charles.sulliva...@bc.edu
>:

That is a huge log file, at least compared to what I’m used to and the
default size. Might that be the problem? Our Security Log maximum is 150 GB
on DCs and I think even that is way above the default.



I totally understand your motivation for setting a large size because ours
gets overwritten in as little as 1 hour. (We have ArcSight Log Collectors
that archive them, so we’re set if we really need them.) Not sure, but my
guess is that the size is the problem.



*From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife

*Sent:* Tuesday, May 2, 2017 2:04 PM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set to
Overwrite events as needed (oldest events first).



I am again getting the 521 events, but they are not the only events I’m
getting yet.  But they are coming in every couple of minutes.



Memory is sitting at 93% right now.



*From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Melvin Backus
*Sent:* Friday, April 28, 2017 7:39 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



Is that log set to a max size? You may be filling it and there’s no place
for it to go.  In that case either make it bigger or circular. Given it’s
the security log circular probably isn’t a good choice unless you’re
actively watching the log in real time but it would prevent it from
stopping if the problem is it getting filled.



--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.



*From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Heaton,
Joseph@Wildlife
*Sent:* Friday, April 28, 2017 10:15 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



I found an issue with my Security log.  For quite a while, it has been
unable to log security events, and instead, has been putting event id 521
entries in.  This event id says Unable to log events to security log.  The
resolution to that was to clear the log and reboot the server.  When I did
that, the memory usage dropped dramatically.  However, this morning, it is
back to around 85%, so I’m not sure I resolved the whole issue.



*From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Eric
Wittersheim
*Sent:* Thursday, April 27, 2017 7:46 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* Re: [NTSysADM] Strange memory issue on a DC



Joseph,



I had the exact same thing happen last night to a 2012R2 DC running on
ESXi.  Additionally, we have 2 2012 R2 IIS server that are exhibiting the
same behavior.



Eric



On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife <
joseph.hea...@wildlife.ca.gov> wrote:

This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
memory utilization.  I’m not sure for how long, but I happened to see an
alarm for CPU utilization on the guest when I was in vCenter yesterday
afternoon.  When I RDP into the domain controller, it is very slow to
login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
and steady.  I look at the Processes tab, and the memory shown as used
doesn’t add up.  There are lots of processes using memory, but the largest
user is using around 100MB.  The box has 4GB assigned.  Looking at the
Details tab doesn’t shed any more light on the issue.  So, our first
thought is some kind of memory leak, so we schedule and perform a reboot
last night.  As soon as the box comes back up, I log in, and memory is
right back at 98%.  I compare with a couple other DCs, and one of those has
around the same number of processes running, but its highest user is right
around 1GB, and its overall usage is around 60%.   What other tools can I
use to help figure out where that memory is going?



Thanks,



Joe Heaton

Information Technology Operations Branch

Data and Technology Division

CA Department of Fish and Wildlife

1700 9th Street, 3rd Floor

Sacramento, CA  95811

Desk:  (916) 323-1284



Every Californian should conserve water.  Find out how at:

SaveOurWater.com <http://saveourwater.com/> · Drought.CA.gov
<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Charles F Sullivan]

Are other Event Logs affected? What is the max size of those set to? Melvin
did mention running out of space as a possibility, but I was thinking
performance of such a large log, not running out of space because of it.



*From:* listsad...@lists.myitforum.com [mailto:
listsad...@lists.myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife
*Sent:* Tuesday, May 2, 2017 2:50 PM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



Plenty of free space on the drive.  21.5GB free of 50GB total.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Melvin Backus
*Sent:* Tuesday, May 02, 2017 11:30 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



Probably a reach but is there free space available on the drive?



--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Heaton, Joseph@Wildlife
*Sent:* Tuesday, May 2, 2017 2:04 PM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set to
Overwrite events as needed (oldest events first).



I am again getting the 521 events, but they are not the only events I’m
getting yet.  But they are coming in every couple of minutes.



Memory is sitting at 93% right now.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Melvin Backus
*Sent:* Friday, April 28, 2017 7:39 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



Is that log set to a max size? You may be filling it and there’s no place
for it to go.  In that case either make it bigger or circular. Given it’s
the security log circular probably isn’t a good choice unless you’re
actively watching the log in real time but it would prevent it from
stopping if the problem is it getting filled.



--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Heaton, Joseph@Wildlife
*Sent:* Friday, April 28, 2017 10:15 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



I found an issue with my Security log.  For quite a while, it has been
unable to log security events, and instead, has been putting event id 521
entries in.  This event id says Unable to log events to security log.  The
resolution to that was to clear the log and reboot the server.  When I did
that, the memory usage dropped dramatically.  However, this morning, it is
back to around 85%, so I’m not sure I resolved the whole issue.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Eric Wittersheim
*Sent:* Thursday, April 27, 2017 7:46 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* Re: [NTSysADM] Strange memory issue on a DC



Joseph,



I had the exact same thing happen last night to a 2012R2 DC running on
ESXi.  Additionally, we have 2 2012 R2 IIS server that are exhibiting the
same behavior.



Eric



On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife <
joseph.hea...@wildlife.ca.gov> wrote:

This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
memory utilization.  I’m not sure for how long, but I happened to see an
alarm for CPU utilization on the guest when I was in vCenter yesterday
afternoon.  When I RDP into the domain controller, it is very slow to
login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
and steady.  I look at the Processes tab, and the memory shown as used
doesn’t add up.  There are lots of processes using memory, but the largest
user is using around 100MB.  The box has 4GB assigned.  Looking at the
Details tab doesn’t shed any more light on the issue.  So, our first
thought is some kind of memory leak, so we schedule and perform a reboot
last night.  As soon as the box comes back up, I log in, and memory is
right back at 98%.  I compare with a couple other DCs, and one of those has
around the same number of processes running, but its highest user is right
around 1GB, and its overall usage is around 60%.   What other tools can I
use to help figure out where that memory is going?



Thanks,



Joe Heaton

Information Technology Operations Branch

Data and Technology Division

CA Department of Fish and Wildlife

1700 9th Street, 3rd Floor

Sacramento, CA  95811

Desk:  (916) 323-1284



Every Californian should conserve water.  Find out how at:

SaveOurWater.com <http://saveourwater.com/> · Drought.CA.gov
<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Heaton, Joseph@Wildlife]

We use Netwrix, and the 4GB is needed to ensure 24 hours of capture.  I’ve got 
26 DCs, and this is the only one that’s having an issue.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Charles F Sullivan
Sent: Tuesday, May 02, 2017 11:38 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Strange memory issue on a DC

That is a huge log file, at least compared to what I’m used to and the default 
size. Might that be the problem? Our Security Log maximum is 150 GB on DCs and 
I think even that is way above the default.

I totally understand your motivation for setting a large size because ours gets 
overwritten in as little as 1 hour. (We have ArcSight Log Collectors that 
archive them, so we’re set if we really need them.) Not sure, but my guess is 
that the size is the problem.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com>] 
On Behalf Of Heaton, Joseph@Wildlife
Sent: Tuesday, May 2, 2017 2:04 PM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set to 
Overwrite events as needed (oldest events first).

I am again getting the 521 events, but they are not the only events I’m getting 
yet.  But they are coming in every couple of minutes.

Memory is sitting at 93% right now.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Melvin Backus
Sent: Friday, April 28, 2017 7:39 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

Is that log set to a max size? You may be filling it and there’s no place for 
it to go.  In that case either make it bigger or circular. Given it’s the 
security log circular probably isn’t a good choice unless you’re actively 
watching the log in real time but it would prevent it from stopping if the 
problem is it getting filled.

--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Heaton, Joseph@Wildlife
Sent: Friday, April 28, 2017 10:15 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

I found an issue with my Security log.  For quite a while, it has been unable 
to log security events, and instead, has been putting event id 521 entries in.  
This event id says Unable to log events to security log.  The resolution to 
that was to clear the log and reboot the server.  When I did that, the memory 
usage dropped dramatically.  However, this morning, it is back to around 85%, 
so I’m not sure I resolved the whole issue.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Eric Wittersheim
Sent: Thursday, April 27, 2017 7:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Strange memory issue on a DC

Joseph,

I had the exact same thing happen last night to a 2012R2 DC running on ESXi.  
Additionally, we have 2 2012 R2 IIS server that are exhibiting the same 
behavior.

Eric

On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife 
<joseph.hea...@wildlife.ca.gov<mailto:joseph.hea...@wildlife.ca.gov>> wrote:
This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284<tel:(916)%20323-1284>

Eve

RE: [NTSysADM] Strange memory issue on a DC

[Heaton, Joseph@Wildlife]

Plenty of free space on the drive.  21.5GB free of 50GB total.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Melvin Backus
Sent: Tuesday, May 02, 2017 11:30 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Strange memory issue on a DC

Probably a reach but is there free space available on the drive?

--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Heaton, Joseph@Wildlife
Sent: Tuesday, May 2, 2017 2:04 PM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set to 
Overwrite events as needed (oldest events first).

I am again getting the 521 events, but they are not the only events I’m getting 
yet.  But they are coming in every couple of minutes.

Memory is sitting at 93% right now.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Melvin Backus
Sent: Friday, April 28, 2017 7:39 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

Is that log set to a max size? You may be filling it and there’s no place for 
it to go.  In that case either make it bigger or circular. Given it’s the 
security log circular probably isn’t a good choice unless you’re actively 
watching the log in real time but it would prevent it from stopping if the 
problem is it getting filled.

--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Heaton, Joseph@Wildlife
Sent: Friday, April 28, 2017 10:15 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

I found an issue with my Security log.  For quite a while, it has been unable 
to log security events, and instead, has been putting event id 521 entries in.  
This event id says Unable to log events to security log.  The resolution to 
that was to clear the log and reboot the server.  When I did that, the memory 
usage dropped dramatically.  However, this morning, it is back to around 85%, 
so I’m not sure I resolved the whole issue.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Eric Wittersheim
Sent: Thursday, April 27, 2017 7:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Strange memory issue on a DC

Joseph,

I had the exact same thing happen last night to a 2012R2 DC running on ESXi.  
Additionally, we have 2 2012 R2 IIS server that are exhibiting the same 
behavior.

Eric

On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife 
<joseph.hea...@wildlife.ca.gov<mailto:joseph.hea...@wildlife.ca.gov>> wrote:
This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284<tel:(916)%20323-1284>

Every Californian should conserve water.  Find out how at:
SaveOurWater.com<http://saveourwater.com/> · 
Drought.CA.gov<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Charles F Sullivan]

That is a huge log file, at least compared to what I’m used to and the
default size. Might that be the problem? Our Security Log maximum is 150 GB
on DCs and I think even that is way above the default.



I totally understand your motivation for setting a large size because ours
gets overwritten in as little as 1 hour. (We have ArcSight Log Collectors
that archive them, so we’re set if we really need them.) Not sure, but my
guess is that the size is the problem.



*From:* listsad...@lists.myitforum.com [mailto:
listsad...@lists.myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife
*Sent:* Tuesday, May 2, 2017 2:04 PM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set to
Overwrite events as needed (oldest events first).



I am again getting the 521 events, but they are not the only events I’m
getting yet.  But they are coming in every couple of minutes.



Memory is sitting at 93% right now.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Melvin Backus
*Sent:* Friday, April 28, 2017 7:39 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



Is that log set to a max size? You may be filling it and there’s no place
for it to go.  In that case either make it bigger or circular. Given it’s
the security log circular probably isn’t a good choice unless you’re
actively watching the log in real time but it would prevent it from
stopping if the problem is it getting filled.



--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Heaton, Joseph@Wildlife
*Sent:* Friday, April 28, 2017 10:15 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



I found an issue with my Security log.  For quite a while, it has been
unable to log security events, and instead, has been putting event id 521
entries in.  This event id says Unable to log events to security log.  The
resolution to that was to clear the log and reboot the server.  When I did
that, the memory usage dropped dramatically.  However, this morning, it is
back to around 85%, so I’m not sure I resolved the whole issue.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Eric Wittersheim
*Sent:* Thursday, April 27, 2017 7:46 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* Re: [NTSysADM] Strange memory issue on a DC



Joseph,



I had the exact same thing happen last night to a 2012R2 DC running on
ESXi.  Additionally, we have 2 2012 R2 IIS server that are exhibiting the
same behavior.



Eric



On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife <
joseph.hea...@wildlife.ca.gov> wrote:

This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
memory utilization.  I’m not sure for how long, but I happened to see an
alarm for CPU utilization on the guest when I was in vCenter yesterday
afternoon.  When I RDP into the domain controller, it is very slow to
login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
and steady.  I look at the Processes tab, and the memory shown as used
doesn’t add up.  There are lots of processes using memory, but the largest
user is using around 100MB.  The box has 4GB assigned.  Looking at the
Details tab doesn’t shed any more light on the issue.  So, our first
thought is some kind of memory leak, so we schedule and perform a reboot
last night.  As soon as the box comes back up, I log in, and memory is
right back at 98%.  I compare with a couple other DCs, and one of those has
around the same number of processes running, but its highest user is right
around 1GB, and its overall usage is around 60%.   What other tools can I
use to help figure out where that memory is going?



Thanks,



Joe Heaton

Information Technology Operations Branch

Data and Technology Division

CA Department of Fish and Wildlife

1700 9th Street, 3rd Floor

Sacramento, CA  95811

Desk:  (916) 323-1284



Every Californian should conserve water.  Find out how at:

SaveOurWater.com <http://saveourwater.com/> · Drought.CA.gov
<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Melvin Backus]

Probably a reach but is there free space available on the drive?

--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Heaton, Joseph@Wildlife
Sent: Tuesday, May 2, 2017 2:04 PM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Strange memory issue on a DC

The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set to 
Overwrite events as needed (oldest events first).

I am again getting the 521 events, but they are not the only events I’m getting 
yet.  But they are coming in every couple of minutes.

Memory is sitting at 93% right now.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Melvin Backus
Sent: Friday, April 28, 2017 7:39 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

Is that log set to a max size? You may be filling it and there’s no place for 
it to go.  In that case either make it bigger or circular. Given it’s the 
security log circular probably isn’t a good choice unless you’re actively 
watching the log in real time but it would prevent it from stopping if the 
problem is it getting filled.

--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Heaton, Joseph@Wildlife
Sent: Friday, April 28, 2017 10:15 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

I found an issue with my Security log.  For quite a while, it has been unable 
to log security events, and instead, has been putting event id 521 entries in.  
This event id says Unable to log events to security log.  The resolution to 
that was to clear the log and reboot the server.  When I did that, the memory 
usage dropped dramatically.  However, this morning, it is back to around 85%, 
so I’m not sure I resolved the whole issue.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Eric Wittersheim
Sent: Thursday, April 27, 2017 7:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Strange memory issue on a DC

Joseph,

I had the exact same thing happen last night to a 2012R2 DC running on ESXi.  
Additionally, we have 2 2012 R2 IIS server that are exhibiting the same 
behavior.

Eric

On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife 
<joseph.hea...@wildlife.ca.gov<mailto:joseph.hea...@wildlife.ca.gov>> wrote:
This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284<tel:(916)%20323-1284>

Every Californian should conserve water.  Find out how at:
SaveOurWater.com<http://saveourwater.com/> · 
Drought.CA.gov<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Heaton, Joseph@Wildlife]

The log is set to a max of 4GB.  It is currently 3.88GB.  It is also set to 
Overwrite events as needed (oldest events first).

I am again getting the 521 events, but they are not the only events I’m getting 
yet.  But they are coming in every couple of minutes.

Memory is sitting at 93% right now.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Melvin Backus
Sent: Friday, April 28, 2017 7:39 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Strange memory issue on a DC

Is that log set to a max size? You may be filling it and there’s no place for 
it to go.  In that case either make it bigger or circular. Given it’s the 
security log circular probably isn’t a good choice unless you’re actively 
watching the log in real time but it would prevent it from stopping if the 
problem is it getting filled.

--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Heaton, Joseph@Wildlife
Sent: Friday, April 28, 2017 10:15 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

I found an issue with my Security log.  For quite a while, it has been unable 
to log security events, and instead, has been putting event id 521 entries in.  
This event id says Unable to log events to security log.  The resolution to 
that was to clear the log and reboot the server.  When I did that, the memory 
usage dropped dramatically.  However, this morning, it is back to around 85%, 
so I’m not sure I resolved the whole issue.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Eric Wittersheim
Sent: Thursday, April 27, 2017 7:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Strange memory issue on a DC

Joseph,

I had the exact same thing happen last night to a 2012R2 DC running on ESXi.  
Additionally, we have 2 2012 R2 IIS server that are exhibiting the same 
behavior.

Eric

On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife 
<joseph.hea...@wildlife.ca.gov<mailto:joseph.hea...@wildlife.ca.gov>> wrote:
This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284<tel:(916)%20323-1284>

Every Californian should conserve water.  Find out how at:
SaveOurWater.com<http://saveourwater.com/> · 
Drought.CA.gov<http://drought.ca.gov/>

Re: [NTSysADM] Strange memory issue on a DC

[Jonathan Link]

Just recalled another issue where a Dell I ran into had a marginal hard
drive on a Perc controlled RAID system.  The drive hadn't been failed by
the controller, but the system resources were sufficiently throttled that
it caused extraordinary system lag across the entire host that guests
lagged as well, and the symptoms presented on the guests was that they were
using a lot of memory.  I don't recall all of the details, and sadly my
notes on the issue are with my former employer.  I do recall that a reboot
on the host caused the Perc controller to actually fail the drive, and the
memory issues persisted until the drive was replaced and the RAID was
rebuilt.

On Thu, Apr 27, 2017 at 12:08 PM, Heaton, Joseph@Wildlife <
joseph.hea...@wildlife.ca.gov> wrote:

> No.  there are only 44GB assigned to guests, out of 64GB total.
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com] *On Behalf Of *Jonathan Link
> *Sent:* Thursday, April 27, 2017 8:46 AM
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* Re: [NTSysADM] Strange memory issue on a DC
>
>
>
> Is the host's memory over-subscribed by all of the guests?
>
>
>
> On Thu, Apr 27, 2017 at 10:11 AM, Heaton, Joseph@Wildlife <
> joseph.hea...@wildlife.ca.gov> wrote:
>
> This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
> memory utilization.  I’m not sure for how long, but I happened to see an
> alarm for CPU utilization on the guest when I was in vCenter yesterday
> afternoon.  When I RDP into the domain controller, it is very slow to
> login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
> and steady.  I look at the Processes tab, and the memory shown as used
> doesn’t add up.  There are lots of processes using memory, but the largest
> user is using around 100MB.  The box has 4GB assigned.  Looking at the
> Details tab doesn’t shed any more light on the issue.  So, our first
> thought is some kind of memory leak, so we schedule and perform a reboot
> last night.  As soon as the box comes back up, I log in, and memory is
> right back at 98%.  I compare with a couple other DCs, and one of those has
> around the same number of processes running, but its highest user is right
> around 1GB, and its overall usage is around 60%.   What other tools can I
> use to help figure out where that memory is going?
>
>
>
> Thanks,
>
>
>
> Joe Heaton
>
> Information Technology Operations Branch
>
> Data and Technology Division
>
> CA Department of Fish and Wildlife
>
> 1700 9th Street, 3rd Floor
>
> Sacramento, CA  95811
>
> Desk:  (916) 323-1284
>
>
>
> Every Californian should conserve water.  Find out how at:
>
> SaveOurWater.com <http://saveourwater.com/> · Drought.CA.gov
> <http://drought.ca.gov/>
>
>
>
>
>

Re: [NTSysADM] Strange memory issue on a DC

[Tom Miller]

Unrelated to the log, I've seen memory and slowness issues on DCs when
there is an issue with DNS.  Make sure that's correct and no issues.

On Fri, Apr 28, 2017 at 10:38 AM, Melvin Backus <melvin.bac...@byers.com>
wrote:

> Is that log set to a max size? You may be filling it and there’s no place
> for it to go.  In that case either make it bigger or circular. Given it’s
> the security log circular probably isn’t a good choice unless you’re
> actively watching the log in real time but it would prevent it from
> stopping if the problem is it getting filled.
>
>
>
> --
> There are 10 kinds of people in the world...
>  those who understand binary and those who don't.
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife
> *Sent:* Friday, April 28, 2017 10:15 AM
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* RE: [NTSysADM] Strange memory issue on a DC
>
>
>
> I found an issue with my Security log.  For quite a while, it has been
> unable to log security events, and instead, has been putting event id 521
> entries in.  This event id says Unable to log events to security log.  The
> resolution to that was to clear the log and reboot the server.  When I did
> that, the memory usage dropped dramatically.  However, this morning, it is
> back to around 85%, so I’m not sure I resolved the whole issue.
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Eric
> Wittersheim
> *Sent:* Thursday, April 27, 2017 7:46 AM
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* Re: [NTSysADM] Strange memory issue on a DC
>
>
>
> Joseph,
>
>
>
> I had the exact same thing happen last night to a 2012R2 DC running on
> ESXi.  Additionally, we have 2 2012 R2 IIS server that are exhibiting the
> same behavior.
>
>
>
> Eric
>
>
>
> On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife <
> joseph.hea...@wildlife.ca.gov> wrote:
>
> This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
> memory utilization.  I’m not sure for how long, but I happened to see an
> alarm for CPU utilization on the guest when I was in vCenter yesterday
> afternoon.  When I RDP into the domain controller, it is very slow to
> login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
> and steady.  I look at the Processes tab, and the memory shown as used
> doesn’t add up.  There are lots of processes using memory, but the largest
> user is using around 100MB.  The box has 4GB assigned.  Looking at the
> Details tab doesn’t shed any more light on the issue.  So, our first
> thought is some kind of memory leak, so we schedule and perform a reboot
> last night.  As soon as the box comes back up, I log in, and memory is
> right back at 98%.  I compare with a couple other DCs, and one of those has
> around the same number of processes running, but its highest user is right
> around 1GB, and its overall usage is around 60%.   What other tools can I
> use to help figure out where that memory is going?
>
>
>
> Thanks,
>
>
>
> Joe Heaton
>
> Information Technology Operations Branch
>
> Data and Technology Division
>
> CA Department of Fish and Wildlife
>
> 1700 9th Street, 3rd Floor
>
> Sacramento, CA  95811
>
> Desk:  (916) 323-1284
>
>
>
> Every Californian should conserve water.  Find out how at:
>
> SaveOurWater.com <http://saveourwater.com/> · Drought.CA.gov
> <http://drought.ca.gov/>
>
>
>
>
>

RE: [NTSysADM] Strange memory issue on a DC

[Charles F Sullivan]

Did someone change the default setting on the log, which should be to
“overwrite events as needed”? See if it was changed to “Do not overwrite
events”.



*From:* listsad...@lists.myitforum.com [mailto:
listsad...@lists.myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife
*Sent:* Friday, April 28, 2017 10:15 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* RE: [NTSysADM] Strange memory issue on a DC



I found an issue with my Security log.  For quite a while, it has been
unable to log security events, and instead, has been putting event id 521
entries in.  This event id says Unable to log events to security log.  The
resolution to that was to clear the log and reboot the server.  When I did
that, the memory usage dropped dramatically.  However, this morning, it is
back to around 85%, so I’m not sure I resolved the whole issue.



*From:* listsad...@lists.myitforum.com [
mailto:listsad...@lists.myitforum.com <listsad...@lists.myitforum.com>] *On
Behalf Of *Eric Wittersheim
*Sent:* Thursday, April 27, 2017 7:46 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* Re: [NTSysADM] Strange memory issue on a DC



Joseph,



I had the exact same thing happen last night to a 2012R2 DC running on
ESXi.  Additionally, we have 2 2012 R2 IIS server that are exhibiting the
same behavior.



Eric



On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife <
joseph.hea...@wildlife.ca.gov> wrote:

This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
memory utilization.  I’m not sure for how long, but I happened to see an
alarm for CPU utilization on the guest when I was in vCenter yesterday
afternoon.  When I RDP into the domain controller, it is very slow to
login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
and steady.  I look at the Processes tab, and the memory shown as used
doesn’t add up.  There are lots of processes using memory, but the largest
user is using around 100MB.  The box has 4GB assigned.  Looking at the
Details tab doesn’t shed any more light on the issue.  So, our first
thought is some kind of memory leak, so we schedule and perform a reboot
last night.  As soon as the box comes back up, I log in, and memory is
right back at 98%.  I compare with a couple other DCs, and one of those has
around the same number of processes running, but its highest user is right
around 1GB, and its overall usage is around 60%.   What other tools can I
use to help figure out where that memory is going?



Thanks,



Joe Heaton

Information Technology Operations Branch

Data and Technology Division

CA Department of Fish and Wildlife

1700 9th Street, 3rd Floor

Sacramento, CA  95811

Desk:  (916) 323-1284



Every Californian should conserve water.  Find out how at:

SaveOurWater.com <http://saveourwater.com/> · Drought.CA.gov
<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Melvin Backus]

Is that log set to a max size? You may be filling it and there’s no place for 
it to go.  In that case either make it bigger or circular. Given it’s the 
security log circular probably isn’t a good choice unless you’re actively 
watching the log in real time but it would prevent it from stopping if the 
problem is it getting filled.

--
There are 10 kinds of people in the world...
 those who understand binary and those who don't.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Heaton, Joseph@Wildlife
Sent: Friday, April 28, 2017 10:15 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Strange memory issue on a DC

I found an issue with my Security log.  For quite a while, it has been unable 
to log security events, and instead, has been putting event id 521 entries in.  
This event id says Unable to log events to security log.  The resolution to 
that was to clear the log and reboot the server.  When I did that, the memory 
usage dropped dramatically.  However, this morning, it is back to around 85%, 
so I’m not sure I resolved the whole issue.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Eric Wittersheim
Sent: Thursday, April 27, 2017 7:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Strange memory issue on a DC

Joseph,

I had the exact same thing happen last night to a 2012R2 DC running on ESXi.  
Additionally, we have 2 2012 R2 IIS server that are exhibiting the same 
behavior.

Eric

On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife 
<joseph.hea...@wildlife.ca.gov<mailto:joseph.hea...@wildlife.ca.gov>> wrote:
This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284<tel:(916)%20323-1284>

Every Californian should conserve water.  Find out how at:
SaveOurWater.com<http://saveourwater.com/> · 
Drought.CA.gov<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Heaton, Joseph@Wildlife]

I found an issue with my Security log.  For quite a while, it has been unable 
to log security events, and instead, has been putting event id 521 entries in.  
This event id says Unable to log events to security log.  The resolution to 
that was to clear the log and reboot the server.  When I did that, the memory 
usage dropped dramatically.  However, this morning, it is back to around 85%, 
so I’m not sure I resolved the whole issue.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Eric Wittersheim
Sent: Thursday, April 27, 2017 7:46 AM
To: ntsysadm@lists.myitforum.com
Subject: Re: [NTSysADM] Strange memory issue on a DC

Joseph,

I had the exact same thing happen last night to a 2012R2 DC running on ESXi.  
Additionally, we have 2 2012 R2 IIS server that are exhibiting the same 
behavior.

Eric

On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife 
<joseph.hea...@wildlife.ca.gov<mailto:joseph.hea...@wildlife.ca.gov>> wrote:
This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284<tel:(916)%20323-1284>

Every Californian should conserve water.  Find out how at:
SaveOurWater.com<http://saveourwater.com/> · 
Drought.CA.gov<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Heaton, Joseph@Wildlife]

No.  there are only 44GB assigned to guests, out of 64GB total.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Jonathan Link
Sent: Thursday, April 27, 2017 8:46 AM
To: ntsysadm@lists.myitforum.com
Subject: Re: [NTSysADM] Strange memory issue on a DC

Is the host's memory over-subscribed by all of the guests?

On Thu, Apr 27, 2017 at 10:11 AM, Heaton, Joseph@Wildlife 
<joseph.hea...@wildlife.ca.gov<mailto:joseph.hea...@wildlife.ca.gov>> wrote:
This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284<tel:(916)%20323-1284>

Every Californian should conserve water.  Find out how at:
SaveOurWater.com<http://saveourwater.com/> · 
Drought.CA.gov<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Heaton, Joseph@Wildlife]

I know that the VMTools are out of date on this guest, was thinking that would 
be an easy first step.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Eric Wittersheim
Sent: Thursday, April 27, 2017 7:46 AM
To: ntsysadm@lists.myitforum.com
Subject: Re: [NTSysADM] Strange memory issue on a DC

Joseph,

I had the exact same thing happen last night to a 2012R2 DC running on ESXi.  
Additionally, we have 2 2012 R2 IIS server that are exhibiting the same 
behavior.

Eric

On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife 
<joseph.hea...@wildlife.ca.gov<mailto:joseph.hea...@wildlife.ca.gov>> wrote:
This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284<tel:(916)%20323-1284>

Every Californian should conserve water.  Find out how at:
SaveOurWater.com<http://saveourwater.com/> · 
Drought.CA.gov<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Michael B. Smith]

Tasklist, get-process, perfmon

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Heaton, Joseph@Wildlife
Sent: Thursday, April 27, 2017 12:06 PM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Strange memory issue on a DC

Unfortunately, this is a VM in a field office, which is a standalone host.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Charles F Sullivan
Sent: Thursday, April 27, 2017 8:00 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Strange memory issue on a DC

Are you in a position to migrate to a different host? That would be quick and 
easy. In any case, check other Windows VMs on the same host and see if they are 
having similar problems.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com>] 
On Behalf Of Heaton, Joseph@Wildlife
Sent: Thursday, April 27, 2017 10:11 AM
To: 'NT System Admin Issues Discussion list' 
<ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>>
Subject: [NTSysADM] Strange memory issue on a DC

This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284

Every Californian should conserve water.  Find out how at:
SaveOurWater.com<http://saveourwater.com/> · 
Drought.CA.gov<http://drought.ca.gov/>

RE: [NTSysADM] Strange memory issue on a DC

[Heaton, Joseph@Wildlife]

Unfortunately, this is a VM in a field office, which is a standalone host.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Charles F Sullivan
Sent: Thursday, April 27, 2017 8:00 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Strange memory issue on a DC

Are you in a position to migrate to a different host? That would be quick and 
easy. In any case, check other Windows VMs on the same host and see if they are 
having similar problems.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com>] 
On Behalf Of Heaton, Joseph@Wildlife
Sent: Thursday, April 27, 2017 10:11 AM
To: 'NT System Admin Issues Discussion list' 
<ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>>
Subject: [NTSysADM] Strange memory issue on a DC

This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284

Every Californian should conserve water.  Find out how at:
SaveOurWater.com<http://saveourwater.com/> · 
Drought.CA.gov<http://drought.ca.gov/>

Re: [NTSysADM] Strange memory issue on a DC

[Jonathan Link]

Is the host's memory over-subscribed by all of the guests?

On Thu, Apr 27, 2017 at 10:11 AM, Heaton, Joseph@Wildlife <
joseph.hea...@wildlife.ca.gov> wrote:

> This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
> memory utilization.  I’m not sure for how long, but I happened to see an
> alarm for CPU utilization on the guest when I was in vCenter yesterday
> afternoon.  When I RDP into the domain controller, it is very slow to
> login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
> and steady.  I look at the Processes tab, and the memory shown as used
> doesn’t add up.  There are lots of processes using memory, but the largest
> user is using around 100MB.  The box has 4GB assigned.  Looking at the
> Details tab doesn’t shed any more light on the issue.  So, our first
> thought is some kind of memory leak, so we schedule and perform a reboot
> last night.  As soon as the box comes back up, I log in, and memory is
> right back at 98%.  I compare with a couple other DCs, and one of those has
> around the same number of processes running, but its highest user is right
> around 1GB, and its overall usage is around 60%.   What other tools can I
> use to help figure out where that memory is going?
>
>
>
> Thanks,
>
>
>
> Joe Heaton
>
> Information Technology Operations Branch
>
> Data and Technology Division
>
> CA Department of Fish and Wildlife
>
> 1700 9th Street, 3rd Floor
>
> Sacramento, CA  95811
>
> Desk:  (916) 323-1284
>
>
>
> Every Californian should conserve water.  Find out how at:
>
> SaveOurWater.com  · Drought.CA.gov
> 
>
>
>

RE: [NTSysADM] Strange memory issue on a DC

[Charles F Sullivan]

Are you in a position to migrate to a different host? That would be quick
and easy. In any case, check other Windows VMs on the same host and see if
they are having similar problems.



*From:* listsad...@lists.myitforum.com [mailto:
listsad...@lists.myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife
*Sent:* Thursday, April 27, 2017 10:11 AM
*To:* 'NT System Admin Issues Discussion list' 
*Subject:* [NTSysADM] Strange memory issue on a DC



This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
memory utilization.  I’m not sure for how long, but I happened to see an
alarm for CPU utilization on the guest when I was in vCenter yesterday
afternoon.  When I RDP into the domain controller, it is very slow to
login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
and steady.  I look at the Processes tab, and the memory shown as used
doesn’t add up.  There are lots of processes using memory, but the largest
user is using around 100MB.  The box has 4GB assigned.  Looking at the
Details tab doesn’t shed any more light on the issue.  So, our first
thought is some kind of memory leak, so we schedule and perform a reboot
last night.  As soon as the box comes back up, I log in, and memory is
right back at 98%.  I compare with a couple other DCs, and one of those has
around the same number of processes running, but its highest user is right
around 1GB, and its overall usage is around 60%.   What other tools can I
use to help figure out where that memory is going?



Thanks,



Joe Heaton

Information Technology Operations Branch

Data and Technology Division

CA Department of Fish and Wildlife

1700 9th Street, 3rd Floor

Sacramento, CA  95811

Desk:  (916) 323-1284



Every Californian should conserve water.  Find out how at:

SaveOurWater.com  · Drought.CA.gov

Re: [NTSysADM] Strange memory issue on a DC

[Jack Kramer]

Cache?

Sent from my iPhone

On Apr 27, 2017, at 10:18 AM, Heaton, Joseph@Wildlife 
> wrote:

This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+ memory 
utilization.  I’m not sure for how long, but I happened to see an alarm for CPU 
utilization on the guest when I was in vCenter yesterday afternoon.  When I RDP 
into the domain controller, it is very slow to login.  I open Task Manager, and 
on the Performance tab, Memory is at 98%, and steady.  I look at the Processes 
tab, and the memory shown as used doesn’t add up.  There are lots of processes 
using memory, but the largest user is using around 100MB.  The box has 4GB 
assigned.  Looking at the Details tab doesn’t shed any more light on the issue. 
 So, our first thought is some kind of memory leak, so we schedule and perform 
a reboot last night.  As soon as the box comes back up, I log in, and memory is 
right back at 98%.  I compare with a couple other DCs, and one of those has 
around the same number of processes running, but its highest user is right 
around 1GB, and its overall usage is around 60%.   What other tools can I use 
to help figure out where that memory is going?

Thanks,

Joe Heaton
Information Technology Operations Branch
Data and Technology Division
CA Department of Fish and Wildlife
1700 9th Street, 3rd Floor
Sacramento, CA  95811
Desk:  (916) 323-1284

Every Californian should conserve water.  Find out how at:
SaveOurWater.com · 
Drought.CA.gov

Re: [NTSysADM] Strange memory issue on a DC

[Eric Wittersheim]

Joseph,

I had the exact same thing happen last night to a 2012R2 DC running on
ESXi.  Additionally, we have 2 2012 R2 IIS server that are exhibiting the
same behavior.

Eric

On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife <
joseph.hea...@wildlife.ca.gov> wrote:

> This DC is 2012R2.  It is a VMWare guest.  It has been running at 95%+
> memory utilization.  I’m not sure for how long, but I happened to see an
> alarm for CPU utilization on the guest when I was in vCenter yesterday
> afternoon.  When I RDP into the domain controller, it is very slow to
> login.  I open Task Manager, and on the Performance tab, Memory is at 98%,
> and steady.  I look at the Processes tab, and the memory shown as used
> doesn’t add up.  There are lots of processes using memory, but the largest
> user is using around 100MB.  The box has 4GB assigned.  Looking at the
> Details tab doesn’t shed any more light on the issue.  So, our first
> thought is some kind of memory leak, so we schedule and perform a reboot
> last night.  As soon as the box comes back up, I log in, and memory is
> right back at 98%.  I compare with a couple other DCs, and one of those has
> around the same number of processes running, but its highest user is right
> around 1GB, and its overall usage is around 60%.   What other tools can I
> use to help figure out where that memory is going?
>
>
>
> Thanks,
>
>
>
> Joe Heaton
>
> Information Technology Operations Branch
>
> Data and Technology Division
>
> CA Department of Fish and Wildlife
>
> 1700 9th Street, 3rd Floor
>
> Sacramento, CA  95811
>
> Desk:  (916) 323-1284
>
>
>
> Every Californian should conserve water.  Find out how at:
>
> SaveOurWater.com  · Drought.CA.gov
> 
>
>
>