Hi Guys I have a Server running 2003 (fully updated) that has started hanging. A small number of users access the server via RDP and can be on it for hours until it starts to become unresponsive, after that no one can do anything and you can't log on to see what is happening. Looking at the server screen directly it is just black. After a reboot everything works fine again. There are no errors of an relevance in the Event Logs, any advise would be most welcome..

Sounds like it is most likely a memory leak, http://www.microsoft.com/downloads/details.aspx?FamilyID=9D467A69-57FF-4AE7-96EE-B18C4790CFFD&displaylang=en I would look at using these two tools: # Memmonitor.exe: Memory Monitor # Memtriage.exe: Resource Leak Triage Tool -- Mike Burr

I might also look here: http://support.microsoft.com/kb/177415 Hope this helps. -- Mike Burr

Many thanks i'll give them a try. Before posting here i did go into msconfig and remove all non essential programs from startup and also any services, the server so far has been stable, look like an application is most likely to blame!

Hi I could find no memory leaks, however, i'm starting to see alot of these errors: Event ID: 7034 The Windows Agent service terminated unexpectedly. It has done this 660 time(s). When I attempt to start the service is get Error 1067: The process terminated unexpectedly Any ideas??

an update I installed Process Explorer. This has shown that the SVCHOST process NETSVCS appears to be the cause. The system will run fine until this process starts to consume memory, i can watch it jump from 24,000k to 200,000 in less than a minute. If i try to open a CMD prompt or Task Manager during this nothing happens, if i then Kill the NETSVCS Process everything returns to normal and CMD or TM appear! I can see that NETSVCS contains a number of services, i disabled the Windows Update Service as i had read this can cause this issue, however, it still occured. My question is - is there a way (without creating separate SVCHOST Services for every service) to see which one of the services is responisble? Many Thanks T.

Hi , you have to identify the pid , once you have identified the PID and if this is related to the SVCHOST , then you have 2 options a) you can use process explorer to identify the process underneath the svchost b) you can use tasklist/svc to break the svchost and identify the application at this point you have 2 options a) you can take a adplus dump on that process and analyze the threads b) if you are not a debugger then you can make probability on the applications and try stoppint the services ( if any )