I should have put a smiley there. I got what he meant. Op 4 mei 2017 4:06 p.m. schreef "Charles F Sullivan" < [email protected]>:
> Exactly! > > > > *From:* [email protected] [mailto:listsadmin@lists. > myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife > *Sent:* Wednesday, May 3, 2017 7:30 PM > *To:* [email protected] > *Subject:* RE: [NTSysADM] Strange memory issue on a DC > > > > Nope. Based on the context, I figured you meant MB, otherwise your > argument totally would have been weird. J > > > > *From:* [email protected] [mailto:listsadmin@lists. > myitforum.com <[email protected]>] *On Behalf Of *Charles F > Sullivan > *Sent:* Wednesday, May 03, 2017 6:55 AM > *To:* [email protected] > *Subject:* RE: [NTSysADM] Strange memory issue on a DC > > > > Thanks for pointing that out. I meant to say 150 **MB**. This probably > made things really confusing. > > > > *From:* [email protected] [mailto:listsadmin@lists. > myitforum.com] *On Behalf Of *Rene de Haas > *Sent:* Wednesday, May 3, 2017 1:35 AM > *To:* [email protected] > *Subject:* RE: [NTSysADM] Strange memory issue on a DC > > > > 150 GB, now that's a huge one. > > > > Op 2 mei 2017 20:46 schreef "Charles F Sullivan" < > [email protected]>: > > That is a huge log file, at least compared to what I’m used to and the > default size. Might that be the problem? Our Security Log maximum is 150 GB > on DCs and I think even that is way above the default. > > > > I totally understand your motivation for setting a large size because ours > gets overwritten in as little as 1 hour. (We have ArcSight Log Collectors > that archive them, so we’re set if we really need them.) Not sure, but my > guess is that the size is the problem. > > > > *From:* [email protected] [mailto:listsadmin@lists. > myitforum.com] *On Behalf Of *Heaton, Joseph@Wildlife > > > *Sent:* Tuesday, May 2, 2017 2:04 PM > > *To:* [email protected] > *Subject:* RE: [NTSysADM] Strange memory issue on a DC > > > > The log is set to a max of 4GB. It is currently 3.88GB. It is also set > to Overwrite events as needed (oldest events first). > > > > I am again getting the 521 events, but they are not the only events I’m > getting yet. But they are coming in every couple of minutes. > > > > Memory is sitting at 93% right now. > > > > *From:* [email protected] [mailto:listsadmin@lists. > myitforum.com <[email protected]>] *On Behalf Of *Melvin > Backus > *Sent:* Friday, April 28, 2017 7:39 AM > *To:* [email protected] > *Subject:* RE: [NTSysADM] Strange memory issue on a DC > > > > Is that log set to a max size? You may be filling it and there’s no place > for it to go. In that case either make it bigger or circular. Given it’s > the security log circular probably isn’t a good choice unless you’re > actively watching the log in real time but it would prevent it from > stopping if the problem is it getting filled. > > > > -- > There are 10 kinds of people in the world... > those who understand binary and those who don't. > > > > *From:* [email protected] [mailto:listsadmin@lists. > myitforum.com <[email protected]>] *On Behalf Of *Heaton, > Joseph@Wildlife > *Sent:* Friday, April 28, 2017 10:15 AM > *To:* [email protected] > *Subject:* RE: [NTSysADM] Strange memory issue on a DC > > > > I found an issue with my Security log. For quite a while, it has been > unable to log security events, and instead, has been putting event id 521 > entries in. This event id says Unable to log events to security log. The > resolution to that was to clear the log and reboot the server. When I did > that, the memory usage dropped dramatically. However, this morning, it is > back to around 85%, so I’m not sure I resolved the whole issue. > > > > *From:* [email protected] [mailto:listsadmin@lists. > myitforum.com <[email protected]>] *On Behalf Of *Eric > Wittersheim > *Sent:* Thursday, April 27, 2017 7:46 AM > *To:* [email protected] > *Subject:* Re: [NTSysADM] Strange memory issue on a DC > > > > Joseph, > > > > I had the exact same thing happen last night to a 2012R2 DC running on > ESXi. Additionally, we have 2 2012 R2 IIS server that are exhibiting the > same behavior. > > > > Eric > > > > On Thu, Apr 27, 2017 at 9:11 AM, Heaton, Joseph@Wildlife < > [email protected]> wrote: > > This DC is 2012R2. It is a VMWare guest. It has been running at 95%+ > memory utilization. I’m not sure for how long, but I happened to see an > alarm for CPU utilization on the guest when I was in vCenter yesterday > afternoon. When I RDP into the domain controller, it is very slow to > login. I open Task Manager, and on the Performance tab, Memory is at 98%, > and steady. I look at the Processes tab, and the memory shown as used > doesn’t add up. There are lots of processes using memory, but the largest > user is using around 100MB. The box has 4GB assigned. Looking at the > Details tab doesn’t shed any more light on the issue. So, our first > thought is some kind of memory leak, so we schedule and perform a reboot > last night. As soon as the box comes back up, I log in, and memory is > right back at 98%. I compare with a couple other DCs, and one of those has > around the same number of processes running, but its highest user is right > around 1GB, and its overall usage is around 60%. What other tools can I > use to help figure out where that memory is going? > > > > Thanks, > > > > Joe Heaton > > Information Technology Operations Branch > > Data and Technology Division > > CA Department of Fish and Wildlife > > 1700 9th Street, 3rd Floor > > Sacramento, CA 95811 > > Desk: (916) 323-1284 > > > > Every Californian should conserve water. Find out how at: > > SaveOurWater.com <http://saveourwater.com/> · Drought.CA.gov > <http://drought.ca.gov/> > > > > > > >
