Troubleshooting Event ID 333 and performance issues

Troubleshooting Event ID 333 and performance issues



Article Summary: This article provides troubleshooting steps to assist in identifying the cause of Event ID 333



Issue:

Event ID 333 is logged in the System event log when performance related issues arise such as paged pool, nonpaged pool or physical memory depletion. Event ID 2019 and Event ID 2020 are sometimes logged indicating a nonpaged pool memory depletion or paged pool depletion respectively. Often times a stop error occurs as a result.

Solution:

1. Review the System event logs for Event ID 2019 and Event ID 2020. Often times the source of the paged or nonpaged pool memory leak is identified in the Event ID. Contact the software vendor of the identified software application or driver if identified.

2. If a stop error occurs the memory dump file can be used to determine the paged pool and nonpaged pool consumption. It can also identify paged and nonpaged pool tags consuming excessive amounts of memory. Follow the steps in the Additional Information section to determine if there is a memory leak.

3. Review the free physical RAM to determine if it is depleted. Often times free physical RAM is depleted because an application is configured to utilize all available memory on the server or the application may have a memory leak. Applications such as Microsoft SQL Server can be configured to consume all available memory causing performance issues and resource depletion. Instructions about setting the SQL Server Maximum Memory Setting can be found here.

4. Review the processes in Windows Task Manager to determine if an application or process is consuming too many file handles indicating a memory leak. Information about using Windows Task Manager to identify these issues can be found here.

5. Add additional physical RAM to the server especially if the operating system is 32-bit. 32-bit versions of Windows are allocated smaller pools of paged and nonpaged pool memory thus increasing the chances of pool depletion. Smaller amounts of pool memory may be allocated depending on the version of the operating system and whether it is 32-bit or 64-bit.

6. The Registy size can also cause performance issues as it consumes paged pool memory and can cause pool depletion. This was common on Windows Server 2003 servers acting as a Terminal Server. Export the registry to determine the file size. Reinstalling the operating system will likely be necessary if this problem occurs.

Additional Information:

Event ID 333 logged in the System event log.

Event Type: Error
Event Source: Application Popup
Event Category: None
Event ID: 333
Date: date
Time: time
User: domain\user
Computer: computer.domain.com
Description: An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.

Perform the following steps to determine the paged, nonpaged and pool tag consumption using a memory dump file and Debugging Tools for Windows.

1. Open the memory dump file in Debugging Tools for Windows.

2. Type !vm and the output will occur similar to the following. Review the NonPagedPool Usage and the PagedPool Usage values to determine if the are excessive.

1: kd> !vm
*** Virtual Memory Usage ***
Physical Memory: 1569558 ( 6278232 Kb)
Page File: \??\C:\pagefile.sys
Current: 6278232 Kb Free Space: 6221056 Kb
Minimum: 6278232 Kb Maximum: 18834696 Kb
Available Pages: 1043301 ( 4173204 Kb)
ResAvail Pages: 1482140 ( 5928560 Kb)
Locked IO Pages: 0 ( 0 Kb)
Free System PTEs: 33520036 ( 134080144 Kb)
Modified Pages: 5092 ( 20368 Kb)
Modified PF Pages: 5092 ( 20368 Kb)
NonPagedPool Usage: 34589 ( 138356 Kb)
NonPagedPool Max: 1167102 ( 4668408 Kb)
PagedPool 0 Usage: 84198 ( 336792 Kb)
PagedPool 1 Usage: 6442 ( 25768 Kb)
PagedPool 2 Usage: 3747 ( 14988 Kb)
PagedPool 3 Usage: 3698 ( 14792 Kb)
PagedPool 4 Usage: 3721 ( 14884 Kb)
PagedPool Usage: 101806 ( 407224 Kb)
PagedPool Maximum: 33554432 ( 134217728 Kb)
Session Commit: 3478 ( 13912 Kb)
Shared Commit: 6435 ( 25740 Kb)
Special Pool: 0 ( 0 Kb)
Shared Process: 7337 ( 29348 Kb)
PagedPool Commit: 101807 ( 407228 Kb)
Driver Commit: 5070 ( 20280 Kb)
Committed pages: 420930 ( 1683720 Kb)
Commit limit: 3138650 ( 12554600 Kb)
Total Private: 218939 ( 875756 Kb)

3. Type !poolused /t 10 4 and the output will occur similar to the following. Review the pool tag values to determine which are excessive.

1: kd> !poolused /t 10 4
....
Sorting by Paged Pool Consumed
NonPaged Paged
Tag Allocs Used Allocs Used
MmSt 0 0 18704 168733760Mm section object prototype ptes , Binary: nt!mm
VMem 9 1440 3730 65399488Volume Manager , Binary: volmgr.sys
CM31 0 0 11340 58851328Internal Configuration manager allocations , Binary: nt!cm
CIcr 0 0 9082 24934320Code Integrity allocations for image integrity checking , Binary: ci.dll
CM25 0 0 2469 12021760Internal Configuration manager allocations , Binary: nt!cm
Ntff 13 4160 8850 10903200FCB_DATA , Binary: ntfs.sys
NtfF 0 0 5666 7977728FCB_INDEX , Binary: ntfs.sys
MmRe 0 0 948 4918272ASLR relocation blocks , Binary: nt!mm
NtFs 7 208688 27412 3912976StrucSup.c , Binary: ntfs.sys
ClfI 0 0 19 2176096CLFS Log marshal buffer lookaside list , Binary: clfs.sys
Ntfs 0 0 4140 2119680SCB_DATA , Binary: ntfs.sys
Obtb 0 0 528 1767888object tables via EX handle.c , Binary: nt!ob
Ntf0 0 0 14435 1754720General pool allocation , Binary: ntfs.sys
IoNm 0 0 8451 1663808Io parsing names , Binary: nt!io
Toke 0 0 892 1541408Token objects , Binary: nt!se
CMAl 0 0 375 1536000internal registry memory allocator pool tag , Binary: nt!cm
TOTAL 180822 123763904 198752 389230112
1: kd> !poolused /t 10 4
....
Sorting by Paged Pool Consumed
NonPaged Paged
Tag Allocs Used Allocs Used
MmSt 0 0 18704 168733760Mm section object prototype ptes , Binary: nt!mm
VMem 9 1440 3730 65399488Volume Manager , Binary: volmgr.sys
CM31 0 0 11340 58851328Internal Configuration manager allocations , Binary: nt!cm
CIcr 0 0 9082 24934320Code Integrity allocations for image integrity checking , Binary: ci.dll
CM25 0 0 2469 12021760Internal Configuration manager allocations , Binary: nt!cm
Ntff 13 4160 8850 10903200FCB_DATA , Binary: ntfs.sys
NtfF 0 0 5666 7977728FCB_INDEX , Binary: ntfs.sys
MmRe 0 0 948 4918272ASLR relocation blocks , Binary: nt!mm
NtFs 7 208688 27412 3912976StrucSup.c , Binary: ntfs.sys
ClfI 0 0 19 2176096CLFS Log marshal buffer lookaside list , Binary: clfs.sys
Ntfs 0 0 4140 2119680SCB_DATA , Binary: ntfs.sys
Obtb 0 0 528 1767888object tables via EX handle.c , Binary: nt!ob
Ntf0 0 0 14435 1754720General pool allocation , Binary: ntfs.sys
IoNm 0 0 8451 1663808Io parsing names , Binary: nt!io
Toke 0 0 892 1541408Token objects , Binary: nt!se
CMAl 0 0 375 1536000internal registry memory allocator pool tag , Binary: nt!cm
TOTAL 180822 123763904 198752 389230112




Article ID: SLN290484

Last Date Modified: 01/15/2019 10:54 AM


Rate this article

Accurate
Useful
Easy to understand
Was this article helpful?
Yes No
Send us feedback
Comments cannot contain these special characters: <>()\
Sorry, our feedback system is currently down. Please try again later.

Thank you for your feedback.