Event ID 2019

[jknight_1]

DL140
Windows Server 2003
System Log: Event ID 2019
"The server was unable to allocate from the system nonpaged pool because the pool was empty."
All Microsoft articles say it is AV software related, and reference macafee, symantec versions 7,8 on windows nt/2000. This is not helpful to me, as I am running 2003 with symantec version 10.1.0.1000 scan engine 51.2.0.12. There does not appear to be any updates for this symantec version. I cannot find the cause of this issue.

[Igor Karasik · Accepted solution]

See
http://www.eventid.net/display.asp?eventid=2019&eventno=661&source=Srv&phase=1
I see your question in Symantec forum today, maybe you will receive answer there although usualy it takes 4-7 days for Symantec peoples.
You can post this question also in Windows 2003 forum here:
http://forums1.itrc.hp.com/service/forums/categoryhome.do?categoryId=278

[Terry Hutchings]

How often does this happen? The best thing to do to determine what's causing this is to start logging on the server. Another thing you can do to help determine the cause is, especially if this happens pretty quickly after the server is rebooted, is to bring up task manager, under the view menu select "select columns", then add the non paged pool counter. After you've done this you should see the non paged pool rising on whatever process is causing this error.

[jknight_1]

Igor and Terry,
I believe the post you saw on Symantec was mine. I haven't had an answer from them yet. However, I wish I would have thought of opening task manager with the nonpaged view checked the day the error happened. I was logged into the box at that time and could've been more useful. To my knowledge this is the second time this has happened, and I will know for next time. Thank you both for your answers they were very helpful.

JKnight
PS - For anyone experiencing this as well, rebooting fixes the issue but doesn't tell you the source.

[jknight_1]

See http://www.eventid.net/display.asp?eventid=2019&eventno=661&source=Srv&phase=1


The best thing to do to determine what's causing this is to start logging on the server. Another thing you can do to help determine the cause is, especially if this happens pretty quickly after the server is rebooted, is to bring up task manager, under the view menu select "select columns", then add the non paged pool counter. After you've done this you should see the non paged pool rising on whatever process is causing this error.

[jknight_1]

I have found a more indepth solution.
I was receiving the error again, and I opened task manager and viewed the nonpaged columb. This did NOT show me anything although the idea was a good one. While the error was occuring, I installed the support tools from the 2003 server cd. There is a program on there called poolmon.exe Run it and hit the 'D' key. This will organize the data on your screen (which will probably be a lot) from the highest to lowest on the difference column. The difference is the allocations minus the frees. Which basically will tell you what is taking memory but not freeing it. The problem that I was experiencing was with a the tag NtFC, it had a difference value 760,000 and when fixed it held 0. The Fix: NtFC - my suspicions were confirmed. Symantec v10 on a domain controller. There was an update to version 1007. I had 1000. I believe there is also an executable you can get from symantec, but updating to 10.0.1.1007 fixed my issue.