# How to escape from Event ID 2019?



## dipz (Feb 24, 2008)

Hello,

We have been using Windows Server 2003 (Enterprise 32bit). We are facing problem of server becoming totally non-responding every day, and we need to re-start the server. While checking Event Logs, I found "Event ID: 2019 - The server was unable to allocate from the system nonpaged pool because the pool was empty."

Googling for the event id, found lots of documents describing the same, but could not find any having clear guidance on how to get the rid of the error.

I tried to troubleshoot using poolmon.exe as guided in http://support.microsoft.com/kb/177415/ but could not understand the output it resulted. Also tried to understand or find out the tags, as guided in http://support.microsoft.com/kb/298102/ but could not find any drivers for tags displayed in poolmon screen.

Please guide me to solve the problem.

Thanks in advance.

Dipesh


----------



## Elvandil (Aug 1, 2003)

When you say "every day", do you mean about only once a day and then it runs OK? Is it the same time each day or varies?

Have you done the basics like memory tests and drive scans for errors?


----------



## dipz (Feb 24, 2008)

Elvandil said:


> When you say "every day", do you mean about only once a day and then it runs OK? Is it the same time each day or varies?


Thanks for an immediate reply. We have couple of servers of almost similar configuration and OS. One of the server faces this problem only once a day (and between 3.30 to 4.30 pm), and after restarting it works fine for approx next 24 hours, while another one faces this problem two to three times a day (no schedule).

I tried disabling auto-updates for some of softwares like antivirus etc.



Elvandil said:


> Have you done the basics like memory tests and drive scans for errors?


Yes, but could not find any problem.

Dipesh


----------



## Elvandil (Aug 1, 2003)

Well, I have no better idea than you do, but does the same error occur in Event Viewer each time on both, and is this a new problem, and did it start on both around the same time? It's not clear to me from your first post whether the error was seen once or every time.


----------



## dipz (Feb 24, 2008)

Elvandil said:


> does the same error occur in Event Viewer each time on both


Yes, the error logged is same each time when the server stops responding.



Elvandil said:


> and is this a new problem, and did it start on both around the same time?


This problem occurred just before few days, and still remains unsolved. One server which tends to stop responding two-three times a day had started this error first, and after a week or so the another also started having this error.



Elvandil said:


> whether the error was seen once or every time.


This error has been seen every time the server stops responding and lots of events are there with same error during this phase.

Thanks for looking into the issues, it would be a great help for me if can solve the problem.

Dipesh


----------



## Elvandil (Aug 1, 2003)

The fact that it is both should give us some clues. For example, were there any driver updates done, or other things done, on both machines that could have led to the problem?

And since it is 2 machines, it is also possible that an infection is responsible, possibly one that was caught by one of them first and passed to the other, or simply caught by the other independently. Have you seen any evidence of an infection or rootkit (such as unexplained CPU usage or network traffic)?

It wouldn't hurt to go to Malware for an evaluation there. If malware is removed as a possibility, we could then explore other possibilities.


----------



## dipz (Feb 24, 2008)

Elvandil said:


> For example, were there any driver updates done, or other things done, on both machines that could have led to the problem?


We recently installed 'Zimbra Desktop' on both servers.



Elvandil said:


> It wouldn't hurt to go to Malware for an evaluation there. If malware is removed as a possibility, we could then explore other possibilities.


I would scan for virus or malwares this evening, and post updates here.

In the mean time, can you please tell me how do I identify tags displayed at poolmon ?

Dipesh


----------

