Windows Sysinternals Process Monitor https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx
Tony Kibble From: [email protected] [mailto:[email protected]] On Behalf Of Heaton, Joseph@Wildlife Sent: 27 April 2017 15:11 To: 'NT System Admin Issues Discussion list' <[email protected]> Subject: [NTSysADM] Strange memory issue on a DC This DC is 2012R2. It is a VMWare guest. It has been running at 95%+ memory utilization. I'm not sure for how long, but I happened to see an alarm for CPU utilization on the guest when I was in vCenter yesterday afternoon. When I RDP into the domain controller, it is very slow to login. I open Task Manager, and on the Performance tab, Memory is at 98%, and steady. I look at the Processes tab, and the memory shown as used doesn't add up. There are lots of processes using memory, but the largest user is using around 100MB. The box has 4GB assigned. Looking at the Details tab doesn't shed any more light on the issue. So, our first thought is some kind of memory leak, so we schedule and perform a reboot last night. As soon as the box comes back up, I log in, and memory is right back at 98%. I compare with a couple other DCs, and one of those has around the same number of processes running, but its highest user is right around 1GB, and its overall usage is around 60%. What other tools can I use to help figure out where that memory is going? Thanks, Joe Heaton Information Technology Operations Branch Data and Technology Division CA Department of Fish and Wildlife 1700 9th Street, 3rd Floor Sacramento, CA 95811 Desk: (916) 323-1284 Every Californian should conserve water. Find out how at: SaveOurWater.com<http://saveourwater.com/> * Drought.CA.gov<http://drought.ca.gov/> ________________________________ DISCLAIMER This material has been checked by us for computer viruses and, although none has been found, we cannot guarantee that it is completely free from such problems and we do not accept liability for loss or damage which may be caused. This message is intended only for use of the individual or entity to whom it is addressed and may contain information which may be privileged and confidential. If you are not the intended recipient you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please notify the sender immediately via e-mail and delete the message. Thank you. ******************************************************* Travelers Insurance Company Limited is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority in the UK and is regulated by the Central Bank of Ireland for conduct of business rules. Registered in England 1034343. Registered as a branch in Ireland 903382. Travelers Syndicate Management Limited is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. Registered in England 03207530. Travelers Underwriting Agency Limited is authorised and regulated by the Financial Conduct Authority. Registered in England 03708247. Travelers Professional Risks Limited is an appointed representative of Travelers Insurance Company Limited which is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. Registered in England 05201980 Travelers Management Limited. Registered in England 00972175. The registered offices for all companies listed above is: Exchequer Court, 33 St Mary Axe, London, EC3A 8AG. All other branch offices are available from our websites. travelers.co.uk travelers.ie Issues to: mailto: [email protected] ________________________________ This communication, including attachments, is confidential, may be subject to legal privileges, and is intended for the sole use of the addressee. Any use, duplication, disclosure or dissemination of this communication, other than by the addressee, is prohibited. If you have received this communication in error, please notify the sender immediately and delete or destroy this communication and all copies. TRVDiscDefault::1201
