Windows server 2016 goes non responsive and needs to reboot to work again

%3CLINGO-SUB%20id%3D%22lingo-sub-1851948%22%20slang%3D%22en-US%22%3EWindows%20server%202016%20goes%20non%20responsive%20and%20needs%20to%20reboot%20to%20work%20again%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1851948%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20There%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOur%20file%20server%20(windows%202016%20)%20frequently%20becomes%20non%20responsive%20and%20needs%20to%20reboot%20to%20get%20it%20working%20again%3C%2FP%3E%3CP%3EWhen%20i%20checked%20event%20viewer%20i%20found%20in%20application%20log%20that%26nbsp%3B%3C%2FP%3E%3CP%3Esvchost((636)SoftwareUsageMetrics-Svc%3AAn%20attempt%20to%20write%20the%20file%20C%3A%5CWindows%5Csystem32%5CLogFIles%5CSum%5CCurrent.mdb%20at%20offset%20921600(0x00000000000e1000)%20for%204096%20bytes%20failed%20after%200.034%20seconds%20with%20systemerror%201453%3A%20Insufficient%20quota%20to%20complete%20the%20requested%20service.%20The%20write%20operation%20will%20fail%20with%20error%201011%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1851948%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1854174%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202016%20goes%20non%20responsive%20and%20needs%20to%20reboot%20to%20work%20again%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1854174%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20file%20may%20be%20corrupt.%20You%20could%26nbsp%3Bstop%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EUser%20Access%20Logging%20Service%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E(UALSVC)%20delete%20all%20the%20files%20in%3B%3C%2FP%3E%0A%3CP%3EC%3A%5CWindows%5CSystem32%5CLogFiles%5CSum%5C%3C%2FP%3E%0A%3CP%3Estart%20the%20service%20back%20up.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1855204%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202016%20goes%20non%20responsive%20and%20needs%20to%20reboot%20to%20work%20again%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1855204%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F51719%22%20target%3D%22_blank%22%3E%40Dave%20Patrick%3C%2FA%3E%26nbsp%3B%20thanks%20for%20the%20suggestion..%20I%20will%20try%20it%20and%20update%20how%20it%20goes%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1855294%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202016%20goes%20non%20responsive%20and%20needs%20to%20reboot%20to%20work%20again%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1855294%22%20slang%3D%22en-US%22%3E%3CP%3EYou're%20welcome.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E(please%20don't%20forget%20to%20mark%20helpful%20replies)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1855451%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202016%20goes%20non%20responsive%20and%20needs%20to%20reboot%20to%20work%20again%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1855451%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F51719%22%20target%3D%22_blank%22%3E%40Dave%20Patrick%3C%2FA%3E%26nbsp%3BUnfortunately%20the%20issue%20came%20back%20with%20the%20event%20id%20481%20and%20482%20logged%20for%20SystemIdentity.mdb%20andcurrent.mdb%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hi There

 

Our file server (windows 2016 ) frequently becomes non responsive and needs to reboot to get it working again

When i checked event viewer i found in application log that 

svchost((636)SoftwareUsageMetrics-Svc:An attempt to write the file C:\Windows\system32\LogFIles\Sum\Current.mdb at offset 921600(0x00000000000e1000) for 4096 bytes failed after 0.034 seconds with systemerror 1453: Insufficient quota to complete the requested service. The write operation will fail with error 1011

9 Replies
Highlighted

The file may be corrupt. You could stop the User Access Logging Service (UALSVC) delete all the files in;

C:\Windows\System32\LogFiles\Sum\

start the service back up.

 

 

Highlighted

@Dave Patrick  thanks for the suggestion.. I will try it and update how it goes

Highlighted

You're welcome.

 

(please don't forget to mark helpful replies)

 

 

Highlighted

@Dave Patrick Unfortunately the issue came back with the event id 481 and 482 logged for SystemIdentity.mdb andcurrent.mdb

Highlighted

@Dave Patrick  As suggested disabled UAL service, Windows update service as well but still no luck.

Symptoms: The memory usage increases and the server becomes non responsive finally. The CPU usage spikes. Once rebooted the memory usage comes down but it increases again...

BUt when I checked if the memory usage for any process increases as well , I couldnot find any significant increase in the memory usage of any process but the total memory usage is increasing..

 

Its the VM in VMware..

 

 

Highlighted

but it increases again...

 


Seems you'll need to get to the bottom of the process responsible as first step. ProcMon may help you to that end.

https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

 

 

 

 

Highlighted
Hi Dave

When i checked further i found that ntfs.sys is using huge Nonpaged pool Memory..


Thanks
Dil
Highlighted