Windows server 2016 goes non responsive and needs to reboot to work again

%3CLINGO-SUB%20id%3D%22lingo-sub-1851948%22%20slang%3D%22en-US%22%3EWindows%20server%202016%20goes%20non%20responsive%20and%20needs%20to%20reboot%20to%20work%20again%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1851948%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20There%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOur%20file%20server%20(windows%202016%20)%20frequently%20becomes%20non%20responsive%20and%20needs%20to%20reboot%20to%20get%20it%20working%20again%3C%2FP%3E%3CP%3EWhen%20i%20checked%20event%20viewer%20i%20found%20in%20application%20log%20that%26nbsp%3B%3C%2FP%3E%3CP%3Esvchost((636)SoftwareUsageMetrics-Svc%3AAn%20attempt%20to%20write%20the%20file%20C%3A%5CWindows%5Csystem32%5CLogFIles%5CSum%5CCurrent.mdb%20at%20offset%20921600(0x00000000000e1000)%20for%204096%20bytes%20failed%20after%200.034%20seconds%20with%20systemerror%201453%3A%20Insufficient%20quota%20to%20complete%20the%20requested%20service.%20The%20write%20operation%20will%20fail%20with%20error%201011%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1851948%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1854174%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202016%20goes%20non%20responsive%20and%20needs%20to%20reboot%20to%20work%20again%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1854174%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20file%20may%20be%20corrupt.%20You%20could%26nbsp%3Bstop%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EUser%20Access%20Logging%20Service%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E(UALSVC)%20delete%20all%20the%20files%20in%3B%3C%2FP%3E%0A%3CP%3EC%3A%5CWindows%5CSystem32%5CLogFiles%5CSum%5C%3C%2FP%3E%0A%3CP%3Estart%20the%20service%20back%20up.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1855204%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202016%20goes%20non%20responsive%20and%20needs%20to%20reboot%20to%20work%20again%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1855204%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F51719%22%20target%3D%22_blank%22%3E%40Dave%20Patrick%3C%2FA%3E%26nbsp%3B%20thanks%20for%20the%20suggestion..%20I%20will%20try%20it%20and%20update%20how%20it%20goes%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1855294%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202016%20goes%20non%20responsive%20and%20needs%20to%20reboot%20to%20work%20again%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1855294%22%20slang%3D%22en-US%22%3E%3CP%3EYou're%20welcome.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E(please%20don't%20forget%20to%20mark%20helpful%20replies)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1855451%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202016%20goes%20non%20responsive%20and%20needs%20to%20reboot%20to%20work%20again%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1855451%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F51719%22%20target%3D%22_blank%22%3E%40Dave%20Patrick%3C%2FA%3E%26nbsp%3BUnfortunately%20the%20issue%20came%20back%20with%20the%20event%20id%20481%20and%20482%20logged%20for%20SystemIdentity.mdb%20andcurrent.mdb%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi There

 

Our file server (windows 2016 ) frequently becomes non responsive and needs to reboot to get it working again

When i checked event viewer i found in application log that 

svchost((636)SoftwareUsageMetrics-Svc:An attempt to write the file C:\Windows\system32\LogFIles\Sum\Current.mdb at offset 921600(0x00000000000e1000) for 4096 bytes failed after 0.034 seconds with systemerror 1453: Insufficient quota to complete the requested service. The write operation will fail with error 1011

14 Replies

The file may be corrupt. You could stop the User Access Logging Service (UALSVC) delete all the files in;

C:\Windows\System32\LogFiles\Sum\

start the service back up.

 

 

@Dave Patrick  thanks for the suggestion.. I will try it and update how it goes

You're welcome.

 

(please don't forget to mark helpful replies)

 

 

@Dave Patrick Unfortunately the issue came back with the event id 481 and 482 logged for SystemIdentity.mdb andcurrent.mdb

@Dave Patrick  As suggested disabled UAL service, Windows update service as well but still no luck.

Symptoms: The memory usage increases and the server becomes non responsive finally. The CPU usage spikes. Once rebooted the memory usage comes down but it increases again...

BUt when I checked if the memory usage for any process increases as well , I couldnot find any significant increase in the memory usage of any process but the total memory usage is increasing..

 

Its the VM in VMware..

 

 


but it increases again...

 


Seems you'll need to get to the bottom of the process responsible as first step. ProcMon may help you to that end.

https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

 

 

 

 

Hi Dave

When i checked further i found that ntfs.sys is using huge Nonpaged pool Memory..


Thanks
Dil

Hello,

 

We get the same error, did found a solution ?

 

Lilian.

please check if any particular d rive is having problem

@DilKS85 

 

Arrrgggg... this is our TSE VM... no drive problem...

We will do that in last time...

 

Thx's

@null null 

 

Our file server was also VM but we had extra Data drive as well.

Since it was mainly due to nonpaged pool memory growing and only option to release the memory was to restart the machine,

 

IF you have not checked yet please check the process consuming the memory

in our case it  was ntfs.sys