Windows server 2016 goes non responsive and needs to reboot to work again

[DilKS85]

Hi There

Our file server (windows 2016 ) frequently becomes non responsive and needs to reboot to get it working again

When i checked event viewer i found in application log that 

svchost((636)SoftwareUsageMetrics-Svc:An attempt to write the file C:\Windows\system32\LogFIles\Sum\Current.mdb at offset 921600(0x00000000000e1000) for 4096 bytes failed after 0.034 seconds with systemerror 1453: Insufficient quota to complete the requested service. The write operation will fail with error 1011

[#2]

The file may be corrupt. You could stop the User Access Logging Service (UALSVC) delete all the files in;

C:\Windows\System32\LogFiles\Sum\

start the service back up.

[#3]

@Dave Patrick  thanks for the suggestion.. I will try it and update how it goes

[#4]

You're welcome.

(please don't forget to mark helpful replies)

[#5]

@Dave Patrick Unfortunately the issue came back with the event id 481 and 482 logged for SystemIdentity.mdb andcurrent.mdb

[#6]

Maybe the User Access Logging service is not required?

https://docs.microsoft.com/en-us/windows-server/administration/user-access-logging/manage-user-acces...

https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/esent-event-327-326

[#7]

@Dave Patrick  As suggested disabled UAL service, Windows update service as well but still no luck.

Symptoms: The memory usage increases and the server becomes non responsive finally. The CPU usage spikes. Once rebooted the memory usage comes down but it increases again...

BUt when I checked if the memory usage for any process increases as well , I couldnot find any significant increase in the memory usage of any process but the total memory usage is increasing..

Its the VM in VMware..

[#8]

---

but it increases again...

---

Seems you'll need to get to the bottom of the process responsible as first step. ProcMon may help you to that end.

https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

[#9]

Hi Dave

When i checked further i found that ntfs.sys is using huge Nonpaged pool Memory..


Thanks
Dil

[#10]

I'd start a case here with product support.

https://support.serviceshub.microsoft.com/supportforbusiness

[#11]

Hello,

We get the same error, did found a solution ?

Lilian.

[#12]

we did build the new server

[#13]

please check if any particular d rive is having problem

[#14]

@DilKS85 

Arrrgggg... this is our TSE VM... no drive problem...

We will do that in last time...

Thx's

[#15]

@null null 

Our file server was also VM but we had extra Data drive as well.

Since it was mainly due to nonpaged pool memory growing and only option to release the memory was to restart the machine,

IF you have not checked yet please check the process consuming the memory

in our case it  was ntfs.sys

[#16]

@DilKS85 

We have exactly this issue, the server seems to run out of resources then needs a reboot
I'm not sure which process it is

Did anyone have a fix?

[#17]

Hello,
I've been having the same problem for weeks. I tested on several vm and still the same problem.
Has anyone been able to fix this problem of memory dump and having to restart the server for it to work again.
Thanks

[#18]

@kamsysyskam 

We ended up having to deploy a new server with fresh install 

No issues after that.

Not what you want to hear I know !