none
Event ID 333 and Event ID 2020 in windows server 2003

    Question

  • I'm having problems with "event ID 333", in almost all of my servers. This situation started suddenly since last January and I would like to know if there are an explanation to this situation related with some windows update or patch.
    I know how mitigate the situation, because I've followed the MS recommendations to apply the hot fix for  the event id 333 and also I've applied the workaround for the event id 2020. 
    I'm interest in knowing Why this situation has started suddenly, in all my servers?..Is it related with a windows update or patch?.


    Monday, July 09, 2012 8:17 PM

Answers

  • Hello,


    The Event ID 333 is usually caused because of memory pressure either physical RAM, virtual memory, paging file etc. or kernel. Usually we will also see the Event ID 2020 (Low Paged) along with Event ID 333. Sometimes the disk hosting on the system partition is not keeping up with the load (high disk queue lengths) also generates Event ID 333.


    After applying the hotfix, did it solve the problem? Also apply the Registry remediation in the below URL. I’d suggest that you monitor the server for some days and check the result. Or, consider open a ticket to Microsoft support http://support.microsoft.com/contactus/


    Server is unable to allocate memory from the system paged pool (event id 2020)
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;312362


    Thanks
    Zhang

    Tuesday, July 10, 2012 5:37 AM
    Moderator
  • Pavel,

    If you have a system that's currently impacted you can find the instigator fairly easily using the sysinternals LiveKD tool

    http://technet.microsoft.com/en-us/sysinternals/bb897415.aspx

    After running livekd execute the command:

    !poolused 4

    This will present a list ordered by paged pool usage. Look for the output containing the largest amount of paged memory used. This should give you the pool tag of the component leaking memory on you. if you suspect a driver, you can use the sysinternals strings command (http://technet.microsoft.com/en-us/sysinternals/bb897439) to search the drivers folder (c:\windows\system32\drivers) on the server and look for the tag you're seeing.

    As an example, I did this recently on a server to determine pooltag NTID was leaking non-paged pool and found it to be the HP NIC Teaming Driver.

    It should at least arm you with information to approach the specific cause of your problem.


    Doug Kentner

    Tuesday, July 10, 2012 4:35 PM

All replies

  • Pavel, is this Windows 2003 (X86)?  There are many possibilities.  You likely have a 3rd party driver leaking paged pool.  Fortunately, you should be able to track this down using tools like poolmon.exe.

    Typically customers will perform a clean reboot and start poolmon data collection to baseline the system, depending on how bad the leak is, trend by pool tag should be able to be determined.  If you are uncomfortable with the links below, configuire the machine for kernel dump per KB244139 and get kernel dump over to Microsoft Support to have a look.

    http://blogs.msdn.com/b/ntdebugging/archive/2006/12/18/understanding-pool-consumption-and-event-id_3a00_--2020-or-2019.aspx

    http://blogs.technet.com/b/markrussinovich/archive/2009/03/26/3211216.aspx

    Windows feature lets you generate a memory dump file by using the keyboard
    http://support.microsoft.com/kb/244139

    Here is a blog post from similar scenarion I worked a few months ago:

    http://blogs.technet.com/b/davguents_blog/archive/2011/08/26/the-case-of-the-unexplained-server-hang.aspx

     


    Dave Guenthner [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. http://blogs.technet.com/b/davguents_blog

    Monday, July 09, 2012 8:29 PM
  • Hello,


    The Event ID 333 is usually caused because of memory pressure either physical RAM, virtual memory, paging file etc. or kernel. Usually we will also see the Event ID 2020 (Low Paged) along with Event ID 333. Sometimes the disk hosting on the system partition is not keeping up with the load (high disk queue lengths) also generates Event ID 333.


    After applying the hotfix, did it solve the problem? Also apply the Registry remediation in the below URL. I’d suggest that you monitor the server for some days and check the result. Or, consider open a ticket to Microsoft support http://support.microsoft.com/contactus/


    Server is unable to allocate memory from the system paged pool (event id 2020)
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;312362


    Thanks
    Zhang

    Tuesday, July 10, 2012 5:37 AM
    Moderator
  • Hi Dave

    All the servers are VMware virtual machines, Windows 2003 SP2 (x86). I'll follow your recommendations. These errors (333 2020) suddenly appeared since January. I'm trying to identify what is causing this problem, why only on some servers and not others. All my servers are virtual and are supported on identical physical host? .. I'll get back to you with more results.

    Thanks a lot

    Tuesday, July 10, 2012 3:58 PM
  • Sure.  Windows 2003 (X86) are severly limited in the amount of Paged\NonPaged Pool available based on its architecture which is why the product team no longer offers X86 at all on Windows 2008 R2.  Most productive thing to do is locate one or two VMs which may be experiencing problem the most and identify root cause. Move forward from there, no problem.

    Dave Guenthner [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. http://blogs.technet.com/b/davguents_blog

    Tuesday, July 10, 2012 4:03 PM
  • Hello Zhang

    Agree with you in the general explanation of the event, also I've applied the 333 hotfix and the Registry remediation you mentioned. I'm focused on identified what's triggering this situation because before January 2012 we never had had this kind of problems in our servers and they are handle the same workload.

    We have the issue in servers with high workload and in servers with low workload as well. I've found servers experiencing the problem during the weekends at midnight.

    As the issue start suddenly in many servers at same time, I though that was related with a MS update patch. I'll work in identified what is causing the 2020 error (NonPaged memory)

    Thanks so much

    Tuesday, July 10, 2012 4:15 PM
  • Pavel,

    If you have a system that's currently impacted you can find the instigator fairly easily using the sysinternals LiveKD tool

    http://technet.microsoft.com/en-us/sysinternals/bb897415.aspx

    After running livekd execute the command:

    !poolused 4

    This will present a list ordered by paged pool usage. Look for the output containing the largest amount of paged memory used. This should give you the pool tag of the component leaking memory on you. if you suspect a driver, you can use the sysinternals strings command (http://technet.microsoft.com/en-us/sysinternals/bb897439) to search the drivers folder (c:\windows\system32\drivers) on the server and look for the tag you're seeing.

    As an example, I did this recently on a server to determine pooltag NTID was leaking non-paged pool and found it to be the HP NIC Teaming Driver.

    It should at least arm you with information to approach the specific cause of your problem.


    Doug Kentner

    Tuesday, July 10, 2012 4:35 PM
  • Same issue here; you mention a hotfix which works?  you don't have a link / more info do you? (not had much luck with other solutions thus far)
    Friday, November 30, 2012 12:41 PM