Hello,I have a memory leak on the server, so as a result nonpaged pool is growing continuously.Using the pool monitor I found that it's because of MDL tag (OS, not any external driver/software)... seams to be Memory Descriptor List, which some drivers can allocate.I tried to find how can I check which driver precisely causes that instant grow, but... don't know how to do it..Verifier? But there I have to choose drivers to monitor... and to monitor all (I tested on the virtual machine) is very resource consuming. Unfortunately on the prod server I'm not able to do something like that, I'm not able to restart it when I need and... I'm not sure if verifier it's a good way...OS: W2k3 R2 SP2Thank you for any advises,Arek

hi there,what is the amount of memory a process is using yes you are using correct tool , its driver verifier which is helpful in detecting the memory leaks.there are several other utilities but i would prefer driver verifier in first place.here are some indicators using driver verifier on production machineshttp://support.microsoft.com/default...b;EN-US;251233Questions=======since when the issue is occuring ? have u upgraded any driver ? or installed any driver ?i would require complete memory dump for analysis and also process explorer is a good utility to check whch process is consuming more memory and also it will give you stack info about the dll which th eprocess is calling and the corresponding address ( stack ) which you can track easily.2) what is the imapct of this memory leak sainath Windows Driver Development

Unfortunately the server for me is like a black box... In the EventLog I have history from last 3 months only, so I don't know when it started... maybe from the beginning.. possible... I don't know anything about its history. Verifier is not very safe (BSOD possible) as I read before and as it is written in that kb you sent. In this case I don't know even which drivers are more, which less suspected. Of course it's not recommended to add all of them... On my test VM I saw it... Memory:10484816K Avail: 6954868K PageFlts: 2791 InRam Krnl: 1944K P:127892K Commit:6232816K Limit:18243340K Peak:7030484K Pool N:164600K P:13560 System pool information Tag Type Allocs Frees Diff Bytes Per Alloc Mdl Nonp 1032980 ( 13) 251818 ( 0) 781162 100049992 ( 1664) 128 MmSt Paged 1370854 ( 16) 1349307 ( 24) 21547 35483320 ( -640) 1646 CM35 Paged 4404 ( 0) 4160 ( 0) 244 9408512 ( 0) 38559 MmCm Nonp 14763681 ( 37) 14763556 ( 37) 125 7218448 ( 0) 57747 NtfF Paged 167211 ( 0) 161517 ( 0) 5694 5329584 ( 0) 936 File Nonp 47849128 ( 490) 47815933 ( 491) 33195 5131736 ( -152) 154 CMAl Paged 41549 ( 0) 40444 ( 0) 1105 4526080 ( 0) 4096 UlHT Paged 1 ( 0) 0 ( 0) 1 4198400 ( 0) 4198400 Stor Nonp 236499 ( 1) 224217 ( 7) 12282 3606304 ( -1728) 293 NAI0 Nonp 209358597 (2252) 209349664 (2259) 8933 3248456 ( -1776) 363 IoNm Paged 74447892 ( 652) 74432093 ( 653) 15799 3043488 ( -256) 192 LSwi Nonp 1 ( 0) 0 ( 0) 1 2576384 ( 0) 2576384 ... Mdl allocates continuously 700-800 kb each an hour, so a lot. 1. Unfortunately I wouldn't be able to send you the dump file, but it would be nice if you tell me what and where should I look for... 2. Result: empty nonpaged pool.... Best regards, Arek

Hi there, thanks for the inform, i would like you to update yoru windows operating system for latest security patches at first place. secondly can you reboot your server in safe mode ? if you do not encounter error in safe mode i would suggest eliminating driver one by one, but if you run process explorer it would give you clear indication of which process is consuming lot of memory. did you had a chance of running it ?sainath Windows Driver Development

Hi Arek, To narrow down the memory leak issue, you may try booting the problematic system with clean boot to check if the issue still exists. Steps to clean boot: 1. Click Start->Run...-> type msconfig and press Enter 2. Click Services tab and select Hide All Microsoft Services and Disable All third party Services. 3. Click Startup tab and Disable All startup items 4. Click OK and choose Restart 5. After reboot, check whether the problem still occurs If the memory leak issue still continues in clean boot mode, for the further troubleshooting, you may check in the Task Manager to see which process takes the memory resources. For example, if the SVCHOST takes the memory in climbing, you need to check which services are running with that SVCHOST process. For other processes such as explorer.exe, iexplorer.exe, you need to check which DLL files are launched by the processes. If the process is a service, you can use these steps to find out what applications are using most of the memory: Open Task Manager, click on the Processes tab, look for the process that is using the memory and note its' PID (Process ID). Please note that you may need to go to the View/Select Columns menu and make sure that PID (Process Identifier) is checked. Once you have the PID run the following from a command prompt: tasklist /svc This should give you the application associated with the PID you identified in the previous step. With the previous steps, you can locate which service or application causes this memory leak and system crash issue. If you want to know the root cause of the issue, we need to analyze the performance log and crash dump file. Since the forum is not the best channel to troubleshoot this issue, I would suggest that you contact Microsoft Customer Support service to troubleshoot this issue efficiently. They are the best resource for this kind of issues. You may obtain the phone numbers for specific technology request please take a look at the web site listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607 Hope the issue will be resolved soon. David Shen - MSFT

Hi,Thanks for answers at the beginning.During the week I can't do a lot on that servers.... servers, because I have the second one with the same problem..The same hardware, the same OS w2k3 SP2 R2, completely different applications...Before that on the first one I checked all processes using the ProcessExplorer and haven't found nothing strange, any of them allocated more then should... especially that MDL allocated then 150 MB! During the weekend I stopped all services I was physically able (stop button wasn't gray), killed spare processes and MDL still was allocating the nonpaged pool as before (700-800 kb per hour). Server doesn't have any remote access card, so I didn't start it in the safe mode.I started to work also with the verifier.exe... and first checked some non microsoft drivers like AV, scsi raid drivers and verifier doesn't report that they are allocating that much the non paged memory. Till now I checked also MS ntfs.sys driver and seems to be all right (max allocated 1.5MB, while MDL allocated till now 23 MB). Now I will try to check others... (few non-MS first, later other MS) but restart required to change it... so not that easy.So I think I did something like clean boot check as all possible to stop services were stopped, all possible to kill processes killed and MDL still was incresing. I checked also most of non MS drives using verifier... Now I have to do the same with MS one...If I forgot about anything, please remind me..One question related with verifier... "Driver Verifier Manager: The coverage for pool allocation verification is only 2%. Adding more physical memory to this computer could improve your coverage."Server has 6GB RAM... 5GB are available... paged/nonpaged now are almost empty... What's up?Regards,Arek

Hi Arek, Please check if the aritcle can help you out on the memory leak issue http://support.microsoft.com/kb/843528 Thanks and regards, Scorprio MCTS, MCITP:Enterprise Admin

To Scorpio:"Your Windows 2000-based computer (...)"I have W2k3 SP2 R2, not 2000....I saw it before... also for XP... therefore I checked ntfs driver at the beginning...Anyway, thx..Arek

Hi there,It took some time, but I found that ntoskrnl.exe is allocating it... I guess because of any driver... Right?At this moment..* MDL nonpaged pool allocation: 100 MB* ntoskrnl.exe nonpaged pool allocation: 117.5 MB (max 118.3)Both are constantly increasing at the same rate of course...Is the online debugging the only way to find what exactly is causing it? What about the manual crash and an offline debugging of the kernel dump?I have some experience with it, but maybe you know any good articles/documents on Internet about it... it's quite interesting, and everywhere you can find something new... Thx.Regards,ArekL

for you to diagonize the issue i would suggesta) windbg, with complete memory dump , if you could crash the process i can go through the dump b) process explorer c) you can crash the process using drwtsn or you can use adplus dump utility d) with these we will be in better position to check what is causing the problemsainath Windows Driver Development

So I found it... some time ago, but forgot to close the problem... So of course it was a non-MS service... How? Stopping/Starting services and monitoring.... I was doing it just at the beginning... but for some reasons I haven't noticed it then... Second time I was more lucky... Thanks a lot for your help guys... Arek