Extremely High memory usage by the winlogon.exe process? (> 650MB) 1

[skhoury]

Hello all,

One of our production servers is running into a really odd issue.

This server is running Win2K3 Standard with 4GB of Ram and dual procs.

It is running a series of custom COM objects and services...

When I pull up the system stats, It says that the winlogon.exe (not winlogin.exe) process is chewing up over 650megs of ram, for no particular reason! Not to mention it has over 12 million page faults (but a delta of 0).

I just wanted to see if any one else out there has experienced this before and knows the problem/fix?

Any help is much appreciated,

Thanks,

Sam

 

[pbxman]

Im assuming it's staying that high and not decreasing? No event viewer problems?
Check your startup environment in the registry, too. If it's not decreasing, it seems like it would be an issue with a service - maybe some sort of logon failures or permission issues? Could be a ton of things, really.

pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[skhoury]

pbxman - Right, it is staying high.

Now, I just flipped through the event viewer and noticed that I am consistently getting the following messagee:

Event ID 1517 & 1524, both relating to our Com object user id being unable to free memory relating to the registry file.

How can I check the startup environment in the registry...not quite sure where or what to look for.

Also, the login that the Com object uses is an admin account, so permission *shouldn't* be a problem.

Any more thoughts (thanks...)

 

[pbxman]

Sounds like either a service is using a user account (should be local service or network service) or the com object is. If the object was installed or setup under user credentials and that com object goes into effect, it will lock onto the user profile that created it in the registry.
Also it could be A/V or print spooler issues also, but it doesn't sound like it.
I believe if you reboot, it should take care of that and let you watch and see if it climbs that high again - in that case, i'd highly suspect a user account login being accessed by a system object.

pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[pbxman]

sorry - startup environment is things like the HKLM\software\microsoft\currentversion\run keys in the registry and the startup tab in your start/programs menu, etc.

pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[skhoury]

Yup, looks like that is what it is.

I'm going to try two different things.

1) see if the custom object can run under a system service account (like local or network).

2) if it really has to run as a user account, employ the UPHC Service to force the cleanup and closing of resources.

http://www.microsoft.com/downloads/...6d-8912-4e18-b570-42470e2f3582&displaylang=en

Hopefully this will help!

Thanks for the tips,

Sam

 

[pbxman]

rockon - glad it worked. local service should work for you as long as the service using it stays local to the PC. If it needs network access, go with the network service. On one box here we had to create a domain admin account and use that strictly for this service account. It stinks, but sometimes poorly written applications force things like that.

pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[skhoury]

yep that is exactly the case here. Developers...