none
Spoolsv.exe memory leak, high swap usage, on terminal server (2008 R2 SP1)

    Question

  • Hello,

     I'm running a Terminal Server on Windows Server 2008 R2 SP1 and I'm having a memory leak issue on spoolsv.exe.

    The pagefile.sys (swap) takes 30Gb due to spoolsv.exe and still grow even if there is 20Gb of available RAM.

    I saw this KB : http://support.microsoft.com/kb/955560 but I can't download the fix, and 2008 R2 SP1 isn't in the "applies to" list.

    I read somewhere that SP1 was supposed to fix this issue but I still have it.

    I read several topic on the same subject but I can't find a solution.

    The only solution I have for the moment is to restart the server every night so the swap partition doesn't run out of space.

    Any idea ?

    Thank you.

    Thursday, May 15, 2014 8:00 AM

Answers

  • Hi,

    Thanks for your comment. Sorry for late response.

    Within the spoolsv.exe process and all PrintIsolationHost.exe processes, there is a new DLL, PrintIsolationProxy.dll that proxies the calls for specific printers between the processes. 

    There are two new group policy settings that you can use to control the isolation mode of drivers on machines to which the policy applies.  Both settings are in the Computer Configuration\Administrative Templates\Printers.

    - Execute Print Drivers in Isolated Processes
    - Override Print Driver Execution Compatibility Setting Reported by Print Driver

    Also associate registry setting for this setting. You can check the below article for more troubleshooting for your issue.
    Windows 7 / Windows Server 2008 R2: Print Driver Isolation

    In addition to above, also check beneath 2 links might get useful in your case.
    1. The Case of the Mysteriously Large Spooler.xml File
    2. Server 2008 R2 Terminal Spoolsv.exe

    Hope it helps!

    Thanks.

    Dharmesh Solanki

    Wednesday, June 04, 2014 1:56 AM

All replies

  • Hi,

    Thank you for posting in Windows Server Forum.

    Please try to install below hotfix and check the result.
    Memory leak occurs in the Spoolsv.exe process after you run an application that performs WMI queries in Windows 7 or Windows Server 2008 R2
    http://support.microsoft.com/kb/2796647

    Hope it helps!

    Thanks.

    Dharmesh Solanki

    Friday, May 16, 2014 7:33 AM
  • Hi,

    Is there any update regarding your case?

    Thanks.


    Dharmesh Solanki

    Monday, May 19, 2014 6:09 AM
  • Sorry for the time I took to reply and thank you for your answer.

    I'll install that fix today. I'll come back to tell if it worked !

    Tuesday, May 20, 2014 8:42 AM
  • Hello again,

     I installed the hotfix and restart the machine, but it doesn't seem to solve my problem.

    Here's a screenshot of the resource monitor (my interface is in french, the "validation" colomn is for "commit" and "plage de travail" for "working set")

    http://s28.postimg.org/7pmfobt25/spoolsv_memory.jpg

    I made a script to restart spoolsv.exe 2 time a day so the swap partition doesn't go full, but I'd like a defenitive solution.

    Anyway, thanks again Dharmesh for your response.



    Thursday, May 22, 2014 1:23 PM
  • Hi Flavien,

    Thanks for your comment.

    The issue might occurs as follows, kindly check details. If the print spooler (spoolsv.exe) is under stress or the print server is very busy and the spooler enters an error condition, the errors are written to the spooler.xml file.  The CPU utilization is caused by the spooler process rapidly writing the errors to the log file and the file will continue to grow until the error condition ceases or the operating system is restarted.
    You can work around this problem by disabling Windows Error Reporting for the print spooler. To disable WER, perform the following steps: 

    1. Open the Registry Editor by running regedit.exe. 

    2. Browse to the following registry key: 
        HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\ 

    3. Add a REG_DWORD value named DisableWERLogging and set this value to 0x1 (hexadecimal)
    4. Restart the Print Spooler service.

    Hope it helps!

    Thanks.

    Dharmesh Solanki

    Monday, May 26, 2014 2:51 AM
  • Hi,

    Do you need any other assistance?

    Thanks.


    Dharmesh Solanki

    Friday, May 30, 2014 9:38 AM
  • Hello,

    Yes, I still need help.

    My problem isn't about the CPU utilization but about memory leak on spoolsv, but I tried to disable the logging in the registry as you proposed, it didn't change : Spoolsv.exe stills swap until the swap partition is full (almost 50Gb)

    This KB describe pretty well my issue : http://support.microsoft.com/kb/955560 but the fix isn't available for download.

    Thank you again for following my case.


    Friday, May 30, 2014 1:34 PM
  • Hi,

    Thanks for your comment. Sorry for late response.

    Within the spoolsv.exe process and all PrintIsolationHost.exe processes, there is a new DLL, PrintIsolationProxy.dll that proxies the calls for specific printers between the processes. 

    There are two new group policy settings that you can use to control the isolation mode of drivers on machines to which the policy applies.  Both settings are in the Computer Configuration\Administrative Templates\Printers.

    - Execute Print Drivers in Isolated Processes
    - Override Print Driver Execution Compatibility Setting Reported by Print Driver

    Also associate registry setting for this setting. You can check the below article for more troubleshooting for your issue.
    Windows 7 / Windows Server 2008 R2: Print Driver Isolation

    In addition to above, also check beneath 2 links might get useful in your case.
    1. The Case of the Mysteriously Large Spooler.xml File
    2. Server 2008 R2 Terminal Spoolsv.exe

    Hope it helps!

    Thanks.

    Dharmesh Solanki

    Wednesday, June 04, 2014 1:56 AM
  • Hi,

    Any further update?

    Thanks.


    Dharmesh Solanki

    Friday, June 06, 2014 1:50 AM
  • Hi,

    Thanks for posting in Windows Server forum.

    As this thread has been quiet for a while, we will mark it as ‘Answered’ due to policy and if there is anything new to update we will let you know by following up this thread.

    BTW,  we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems. 

    Thanks for your Support & understanding!
    Regards.

    Dharmesh Solanki

    Monday, June 09, 2014 9:08 AM