2008 R2 - Memory Leak from svchost.exe - Module "rpcrt4" is the culprit

Hi All
Over the past week or so (after a set of Windows updates and restart) svchost.exe has increasingly used more and more memory. It probably gobbles up an extra 1GB per day and doesn't relent.
After running various diagnostics, the debug diagnostic tool finally provided me this information after a memory leak test:
rpcrt4.dll is responsible for 1.76 GBytes worth of outstanding allocations. The following are the top 2 memory consuming functions:
rpcrt4!AllocWrapper+2b: 1.76 GBytes worth of outstanding allocations.
rpcrt4!Ndr64ClientInitialize+964: 1.36 MBytes worth of outstanding allocations.
Detailed module report(Memory)
Module details for rpcrt4
Module Name rpcrt4
Allocation Count 946941 allocation(s)
Allocation Size 1.76 GBytes
Module Information
Image Name: C:\Windows\System32\rpcrt4.dll Symbol Type: PDB
Base address: 0x00000003`00905a4d Time Stamp: Sat Nov 20 13:13:18 2010
Checksum: 0x00000000`00000000 Comments:
COM DLL: True Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Remote Procedure Call Runtime
ISAPIFilter: False File Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
Managed DLL: False Internal Name: rpcrt4.dll
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights reserved.
Loaded Image Name: rpcrt4.dll Legal Trademarks:
Mapped Image Name: Original filename: rpcrt4.dll
Module name: rpcrt4 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating System
Module Size: 1.18 MBytes Product Version: 6.1.7601.17514
Symbol File Name: c:\symcache\rpcrt4.pdb\7D748DA6D7454C9EA38C8CEF1C9E75F22\rpcrt4.pdb Special Build: &
rpcrt4!AllocWrapper+2b has 944,468 allocations!
I'm running 2008 R2 64bit with anywhere up to 80/100 simultaneous RDP connections at any one time.
Can anyone help or advise as I cannot find any hotfixes for this issue.
Thanks
Ryan

Hi Ryan,
Please narrow it down to the specific service that is having the issue. That way you will know where to focus on.
For the specific svchost.exe that is showing the large memory usage, use task manager/process explorer/etc. to determine which service(s) are running within it. If there are multiple services running within it, I recommend you isolate them and then
restart your server. For example, say you determined that the following services are running in the "problem" svchost.exe: AudioEndpointBuilder, Netman, TrkWks, UmRdpService, Uxsms. You would open an admin command prompt and enter the following
commands:
sc config AudioEndpointBuilder type= own
sc config Netman type= own
sc config TrkWks type= own
sc config UmRdpService type= own
sc config Uxsms type= own
After entering the above commands you would restart your server for the changes to take effect. Over time you would monitor memory usage of the suspect services, and eventually it will become apparent which one is using too much memory.
Thanks.
-TP

Similar Messages

Memory leak for services.exe

Hi,
I have been observing memory leak for "Services.exe" process and which causes server hung issue. I am having server 2008 R2, hosting SQL server 2008 R2.
the handle count for services.exe rises to its limit quickly and the casues the server hung issue.

Hi,
I agree with Milos that you can install Process Monitor to find the root reason for this issue:
http://technet.microsoft.com/en-au/sysinternals/bb896645.aspx
In addition, it may caused by some corrupt event logs, please make sure you have applied the Maximum log size setting for event logs appropriately.
Best regards,
Susie

Memory leak in tagsrv.exe

I'm seeing a memory leak in tagsrv.exe on my laptop, where I use DSC
v8.2. When I close the screen (suspend the laptop), and then open
it again (resume), the tagsrv.exe memory usage jumps dramatically,
often to over 125MB. What is more, it appears each time I do this
the memory jumps again by this amount (I'm not completely sure how
consistent the incremental increase is, but I've often seen over 250MB
memory usage, and as high as 500MB). Has anyone else encountered
this, or does anyone have a solution?
Thanks.
David Moerman
TruView Technology Integration Ltd.

Attached are some images of memory usage. Interesting, but the
problem does NOT occur if I simply hibernate then resume over a short
period of time. The images you see are the result of hibernating
OVERNIGHT. Not sure what to make of that. I did not have
LabVIEW running when the memory jump occured.
The LV DSC project I'm working on has about 40 shared variables, many
of which are supposed to be connected to a Modbus/TCP client via
OPC. However, during this development period I do not have the
hardware, so some shared variable errors result which I ignore.
Also, I'm using a dataset I/O server to create batch-oriented datasets.
-Dave
Attachments:
memory1.GIF ‏49 KB
memory2.GIF ‏49 KB

There appears to be a MAJOR issue (hang/memory leak) in "about:home", also known as the Firefox Start Page, in Firefox 26.0 on Windows!

There appears to be a MAJOR issue (hang/memory leak) in "about:home", also known as the Firefox Start Page, in Firefox 26.0, on Windows!
observed on:
- Windows 7 x64 machine with 12GB RAM and high-performance CPU (core i7-920)
- Virtual Machine guest running WinXP SP3 (in Oracle VirtualBox) on the same machine
- Intel Atom D525 netbook with 4GB RAM, running Win7 x64
Neither of these machines are connected via Sync or anything like that. The Firefox instance on the VM is a fresh/clean install.
The problem:
- 100% cpu usage for 10 seconds, memory usage (PF usage in XP) goes up to 1.7GB
- if "about:home" is the Firefox Start Page, effectively it hangs the computer at Firefox startup for 10 seconds
- if "about:home" is NOT the Firefox Start Page, startup is fine - BUT if I press the "home" button on the toolbar it loads "about:home" which causes the same issue again

Thank you cor-el! Your suggestion has solved the problem on my WinXP VM which I was using to test, and I will soon confirm that it has also solved the problem on my primary Win7 desktop.
To recap:
- I set "browser.aboutHomeSnippets.updateUrl" to an empty string
OLD VALUE: https://snippets.mozilla.com/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/
NEW VALUE: (blank)
- I deleted the folder \storage\persistent\moz-safe-about+home under the Profile directory
Actual folder name on WINDOWS XP:
C:\Documents and Settings\<USERNAME>\Application Data\Mozilla\Firefox\Profiles\<PROFILENAME>\storage\persistent\moz-safe-about+home
However I have a concern that the '''OLD VALUE''' of "browser.aboutHomeSnippets.updateUrl" will creep back in, in a future update! Can you communicate this issue to someone on the development team?

Memory Leak on SpoolSv.exe

Hi
I have a Windows 7 x64 (Ultimate) running on my laptop. Weeks ago i started noticing weird errors like: "memory low", can not start virtual machine. I wasn't running special memory consuming programs. "A reboot a day keeps the troubles away" was my temporary workaround.
When i started digging into the problem, i noticed that memory usage of the process spoolsv.exe was rather high. I have a screenshot of my task manager showing that the "Private Working Set" and also Commit Size is very large.
In the meantime, I have read in another post about a general memory leak in Windows 7 where they suggested using the driver verifier, but it didn't gave me any clue. I uploaded the screenshot of the driververifier.
When the process is skyhigh in memory usage, i can kill it. But a few minutes later i have taken these screenshots from the process explorer.
1) SpoolSv is using CPU. Apparently it is not only consuming RAM but also CPU power.
2) spoolsv.exe graph
I am not printing, or have not printed since days (and several reboots).
Normally I wouldn't care about (temporarly) high memory usage, but it really never drops... Other programs do crash because the lack memory (like videodriver or skype).
Has someone any idea why this process slows down my pc and keeps getting bigger minute after minute?
Kind regards
Please click 'Mark as Answer' on the post that helped you.

Hi DamPee,
In addition, I would like to suggest you perform the following steps to check the issue.
Clear Printer Spooler Files and Restart the Spooler Service
=================================
1. Click Start, type "Services.msc" (without the quotation marks) in the Start Search box and press Enter.
2. Double-click "Printer Spooler" in the Services list.
3. Click Stop and click OK.
4. Click Start, type "%WINDIR%\system32\spool\printers" in the Start Search box and press Enter, delete all files in this folder.
5. Click Start, type "Services.msc" (without the quotation marks) in the Start Search box and press Enter.
6. Double-click "Printer Spooler" in the Services list.
7. Click on Start. In the Startup Type list, make sure that "Automatic" is selected and click OK.
What’s the result?
Arthur Li - MSFT

Windows Server 2008 X64 - gpupdate takes 10min - svchost.exe (gpsvc) pid logs 8.5 million events in procmon

Hello,
We've seen that on our 2008 x64 servers the svchost.exe that holds gpsvc in it takes up alot of CPU-time. Upon further investigation I saw that when it refreshes policies it holds 1 core for 10 minutes. I setup a procmon and filtered it on the pid off the gpsvc-svchost and saw that it logged 8.5 million events.
It keeps looping events where it seems to be checking history-data under "C:\ProgramData\Microsoft\Group Policy\History\<GUIDS>".
We are using GPPreferences. Has anyone seen anything like this before?
I have the .PML-file from procmon, however its 350MB zipped so I dont know how to attach it to case.

Hi,
To better understand the issue, please help confirm the following:
1.    Do all computers encounter this issue?
2.    When did this issue begin to occur? Did it coincide with any events, such as the installation of some software?
Meanwhile, please perform the steps below to see if the issue goes away:
1.    Delete the contents in the "C:\ProgramData\Microsoft\Group Policy\History\" folder.
2.    Please perform a clean boot on the server:
1)    Click Start, type msconfig in the Start Search box, and then press ENTER.
2)    On the General tab, click Selective Startup.
3)    Under Selective Startup, click to clear the Load Startup Items check box.
4)    Click the Services tab, click to select the Hide All Microsoft Services check box, and then click Disable All.
5)    Click OK.
6)    When you are prompted, click Restart.
If the issue continues, please help collect the following information for further research:
1.    Enable gpsvc.log:
Please create the following key in Registry Editor:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
Type: DWORD
Value: GPSvcDebugLevel
Data: 0x30002 (hexadecimal)
2.    Please run gpupdate /force to reproduce the issue and then collect MPSReport on the server:
1) Download the MPSReport from the website below:
http://www.microsoft.com/downloads/details.aspx?FamilyID=CEBF3C7C-7CA5-408F-88B7-F9C79B7306C0&displaylang=en
2) Double-click the executable to launch the report gathering tool on the computer.
3) Follow the steps as guided by the Wizard.
4) On the Select the diagnostics you want to run page, select General, Internet and Networking, Business Networks, and Server Components.
3.    After that, please zip the gpsvc.log (%windir%\debug\usermode\gpsvc.log), MPSReport and the PML.file and upload to the following space:
https://sftasia.one.microsoft.com/choosetransfer.aspx?key=ef4b8b4e-0e6c-4774-a132-2d072f8b77b0
Password: fQxbhTjUV
More Information about MPSReport:
http://blogs.technet.com/askperf/archive/2009/05/01/two-minute-drill-the-new-mps-reports.aspx
This posting is provided "AS IS" with no warranties, and confers no rights.

Memory leak in oracle.exe and mds.exe

We are facing Memory leak in oue MDM server. Our environment details
are as follows;
MDM 5.5 SP5 ( Build 5.5.41.70)
Oracle 10.2 patch 2
windows server 2003 SP1
XI 7.0 SP 9
If server is running continuously 3-4 days then Nonpaged memory is
getting exausted and server does not respond. Now we have to retart the
windows server manually.
If we see the task manager it is shows more than 200,000 handles for
oracle.exe and more than 100,000 handles for mds.exe.
1: Oracle.exe -- more than 200000 handles ( Approx >5000 is problem)
2: Mds.exe -- more than 100000 handles ( Approx >5000 is problem)
Since these applications are not releasing the handles properly so all
nonpaged memory gets exausted and server stops responding.
If we restart the mdm server, database and OracleserviceMDMD, then
nonpaged memory is released. But some times even if we restart these
services, we do not get nonpaged memory released. So we have to restart
the windows server.
please help me if anyone else have faced the same problem.
regards
Saurabh

Closing as question is answered in MDM forum.

Memory Leak in NK.exe

Hi All,
OS: Windows Embedded Compact 7 with updates till Feb 2015.
Hardware: AM335x based
Applications running: one serial port application and one tcpclient and tcpserver apps. all are managed (C#) applications
I am facing memory leak issue with our headless device.
When I connect the device to LAN network, memory usage keep increases and after few hour (some times <1 hour, some times 4-5 hour) devices go to hang state due to low memory.
I also tried to run the resource leak detector and found
1. NK.exe heap is increasing
2. on startup : API Handle Count = 4118, DuplicatedHandle - Count : 4,082, Size : 4,082 bytes
After few minutes: APIHandle - Count : 49,172, Size : 49,172 bytes, DuplicatedHandle - Count : 48,810, Size : 48,810 bytes
NK.exe heap increases as available RAM decreases.
our application heap is constant only. please find below memory snapshots taken by devhealth.
1. On device start up after all apps started
2. After 1 hour of device running. - refer attachment
where exactly might be this leak, any Guess?
Thank you...
rakesh

Hi tomleijen,
Thanks for your suggestions.
Even we tried without any user apps, then also we found ~1 MB increase in NK.exe heap every 30-40 min.
we have 2 images 1. with all WEC7 updates (Till feb 2015) and 2. without any of the WEC7 updates
almost same problem we are facing with both images.
rakesh

IPod generates a svchost.exe error and blocks the computer

Ok, I got an iPod Nano 2GB Silver today and when I plug it in the USB port, a svchost.exe error pops up. The only thing I can do is to press OK, but when I do that, another and another and another... same error pops up. I have to reset the computer in order for the computer to start functioning normally.
I will try to translate what the Event Viewer says about the error (and this is what the error pop-up also states):
Opening application: svchost.exe - Program error : Instructions on »0x00000000« reffered to the memory on »0x00000000«. The memory couldn't be written.
The thing is though, it's working fine on some other laptop, but I don't understand why this is happening on my desktop?! And some of the older mp3 players (not iPods) are working just fine.
Please, help me!

I have a similar problem which began a couple weeks ago. Same svchost.exe closure, only I couldn't figure out what was causing the problem. Did the format C: and clean XP install, then gradually reinstalled software. When I got around to installing iTunes again, and about 24 hours goes by, I get the same message again. Both the popup and event viewer tell me that the iPod
Service caused the failure. Windows would only suggest that the problem was caused by Windows Update.
Before the fault bucket was generated, there was an Application Information message that states:
The description for Event ID ( 0 ) in Source ( iPod Service ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Service started.
So now I am unable to keep my iPod updated, charged, used. Is this what I paid a premium price for?

SVCHost NetSVCS On Windows Server 2008 Standard memory leak with windows update

I have a particular situation that has surfaced lately. I have a series of Windows Server 2008 Standard. I have applications that use WMI to do application interfacing. For years this has been running fine until recenly in the last month
I have seen memory being swallowed by the process SVCHost Netsvcs. I have done significant research into this. The problem appears almost like clock work on a daily basis. I have traced this to windows update which seems to kick off, it is
also using WMI, it starts and seems to get lost then netsvcs starts running off until all memory is consumed and the svchost process eventually fails. At that point I can get back into the system to view it. If I catch it in time I can simply stop windows
update but sometimes I have to take the drastic and unsafe measure to kill that particular svchost process.
There are a lot of threads regarding SVCHost and nothing comes remotely close to this issue as far as I can see.
I have allready ensured that windows update is up to date.
At present I am forced to ensure that windows update is disabled. I then have to manually shut down the other services that are using WMI to do an update. This means down time for my applications realtime updates.

Hi,
does this issue occur on a single server or multiple servers? And is it server 2008 or 2008 R2? (if 2008R2 there is a
hotfix
available which would seem a good fit for your current issue).
If you find the answer of assistance please "Vote as Helpful"and/or "Mark as Answer" where applicable. This helps others to find solutions for there issues, and recognises contributions made to the community :)

Why don't you get some c/c++ grizzled veterans on your team and fix the memory leaks that have dogged FireFox ever since the beginning?

It's not plugins or extensions. This is a problem that never goes away. Memory usage creeps up into the multiple GBs (I have 12 GB of ram, the more you give the more it takes), and eventually the little OOPS Firefox crashed dialog is the only thing running. What about reviving the Electrolysis project for multi-process operation? In modern versions of IE and Chrome, this capability is so useful to kill off offending tabs.

Electrolysis is alive and well, and is currently hot on track for a future release. Please note that Electrolysis (or per-tab process) doesn't improve memory usage (In fact Chrome has significantly worse memory usage than Firefox because of it). One thing we are trying to do right is make sure we don't worsen memory usage because of Electrolysis.
Memory usage is something that's difficult to work on with little information, so if you want help please provide us some more data such as your about:support (type it in your url bar and press enter) and your about:memory (same)

Memory leaks- high memory usage svchost.exe

hello!
im having a kind of a similar problem. Im using a Q6600 with 4Gb of RAM running on Windows 7 x64. My physical memory usage history is 1.75GB idle but my CPU usage looks good ~ 0%.
In Windows Task Manager when i arranged the memory column, the process with the highest memory usge is svchost.exe with 116,572K. And i have 14 svchost.exe in my computer! I opened process exporer and check the legitimate of all those svchost.exe
and they are all legit. When i look at the properties of the highest svchost.exe in process explorer, the services which is running under it is as follows
AudioEndPointBuilder c:\Windows\System32\Audiosrv.dll
CscService c:\Windows\System32\cscsvc.dll
hidserv c:\Windows\System32\hidserv.dll
Netman c:\Windows\System32\netman.dll
PcaSvc c:\Windows\System32\pcasvc.dll
SysMain c:\Windows\System32\sysmail.dll
TrkWks c:\Windows\System32\trkwks.dll
UxSms c:\Windows\System32\uxsms.dll
wudfsvc c:\Windows\System32\WUDFSvc.dll
All are legit DLLS.
Is it normal to have 14 svchost.exe running at the same time(system, local service, network service in Task Manager)
and how can i reduce the memory usage of the svchost.exe?

Hi,
There can be multiple instances of Svchost.exe running at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can
be run depending on how and where Svchost.exe is started.
If you would like to reduce the usage of this service, I could share the following article with you:
Getting Started with SVCHOST.EXE Troubleshooting
PRF: High CPU (SVCHOST.EXE)
Hope it helps.
Alex Zhao
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

OBVIOUS MEMORY LEAK iTunes about:10.6.3.25 (upgraded from 32 to 64) but iTunes*32 process is in memory. clicking on a song to play or right clicking it adds 5MB. Did 32 have this problem and didn't uninstall correctly or is 64 broken too.

OBVIOUS MEMORY LEAK
iTunes about:10.6.3.25
windows 64 bit Home on AMD64 HP G60 laptop
downloaded and installed "iTunes32Setup.exe"
saw the problem and uninstalled it
downloaded and installed "iTunes64Setup.exe"
iTunes about:10.6.3.25
now i see process "iTunes.exe*32
it is ok when it play song list
but ***** UP MEMORY when i click on another song to play. apparently it doesn't release previous player thread
OR,
if you right click on a song, the memory will blow up antother 6MB and won't release it...can do it all day long
-- until run out of memory and iTunes freezes...without any of my changes.
sooooo.. is it the uninstaller or is iTunes64Setup.exe mispackaged or do both have memory problems on AMD 64 ?

Unfortunately I was able to repeat the memory leak even with turning the Toolbar off. To replicate the problem, I was able to watch the memory leak each time I actively selected a new song with the iTunes open. I was able to repeat the leak with and without both Spotify and TuneUp Companion running and not running. The only thing I noticed is when both Spotify and iTunes were open, the memory leak from iTunes added insult to injure with Spotify which kept trying to sync up with iTunes local library which would crash Spotify as well. But I can confirm the memory leak is in iTunes 10.6.3.25 (looking forward to 10.6.4 fixing the problem).

T61 with memory leak on XP for driver battc.sys

Hi
I have an issue with XP where the battc.sys module that is part of Windows XP and responsible for the kernel side of monitoring the battery status. This module continually leaks memory until I have no more kernel paged resources left and programs start to fail on my laptop.
I raised a support case for this with Microsoft and after some investigation and upgrading to the latest T61 power drivers that were released a few days ago on the Lenovo site, MS support told me it is a fault of the T61 and that I would need to disable Microsoft APCI support to stop this memory leak from occuring and to take the issue up with Lenovo.
I have used the verifier tool to confirm that it is the Windows XP SP3 battc.sys memory module leaking.
I am running the latest T61 drivers and fully patch with MS drivers on SP3.
As MS have told me it is the fault of the T61 I am posting this issue here.
Thanks
Stephen

It is memory available to the kernelwhich itself does not show under a process in task manager as far as I am aware (unles it is taken account as part of the system process).
The best way to measure the available kernel memory space available is by using sysinternals procexp.
You need to download procexp and also install the windows debugging tools from Microsoft. Then in procexp set the "Options > Configure Symbols : Debughlp.dll path" to the new debughlp.dll installed with your debu tools and set the symbols path to srv*c:\Symbols*http://msdl.microsoft.com/download/symbols
Then you can choose in procexp "View > System Information" and see the used and total paged and non-paged kernel memory space.
poolmon helps monitor all the symbols that are taking up this memory and verifier lets you drill down to the exact module and the changes in memory for a module that is occuring.
Here are two really good links on it
http://blogs.msdn.com/ntdebugging/archive/2006/12/18/Understanding-Pool-Consumption-and-Event-ID_3A0...
http://blogs.msdn.com/ntdebugging/archive/2008/05/08/tracking-down-mmst-paged-pool-usage.aspx
In my poolmon i notice that Mmst and battc are taking alot of memory after my computer has been running for some time. Mmst being high is normal but battc should not continually be growing as it is which is why I raised the case to MS but they want verification it is not a Lenovo issue.

Memory Leak in Flex Builder

I created Services.mxml in the tutorial, set it as the
default application file, and dragged the first component onto the
design view screen, a label, when Flex Builder seems to get
sluggish. Jumping out to the task manager revealed javaw.exe
rapidly accumulating memory usage, heading for 300,000 K. I killed
FB before it hung the machine and restarted it.
I was able to replicate it by being in a hurry. I created
another Services2.mxml as an application, and while it was Building
the workspace i tried to drag a Label onto the stage. Twice. The
cursor didn't change, but they eventually they appeared. Checking
the task manager revealed that i had put javaw.exe again in a
tailspin, rapidly accumulating memory usage.

I'm also experiencing huge memory leaks from beta 3...after a
couple of builds memory allocation for javaw is around
300MB...hopefully this will get fixed. thanks,
-george

2008 R2 - Memory Leak from svchost.exe - Module "rpcrt4" is the culprit

Similar Messages

Maybe you are looking for