RE: MS Firewall Service (WSPSRV.EXE) memory leak?

  • From: "Thomas W Shinder" <tshinder@xxxxxxxxxxxxxxxxxx>
  • To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
  • Date: Wed, 22 Jan 2003 21:34:51 -0600

Hi guys,

Check this out:

==========================
GrahamW 
Junior Member 
Member # 9179 

Rate Member   posted October 31, 2002 04:02 PM                     
------------------------------------------------------------------------
--------
I thought that I would update you guys on this. I used the Microsoft
Partner newsgroup and had a reply from Microsoft.

>-----Original Message-----
>Hi Graham,
>
>We may narrow down the problem from these aspects:
>
>1. Do you install any 3rd party application filters in the ISA server?
E.g. 
>Surf Control, or WebTrends. You may temporarily disable all of them and

>then restart the server.
>
>2. Another possibility is that it is an known issue reported by
Microsoft:
>
>The peak in the memory usage may be seen when the data retrieval rate 
>between ISA and the Web server that hosts the content is faster than
the 
>data sending rate between ISA and the requesting client. Typically this
may 
>be seen when content is served from the Web Proxy cache or if the link 
>between ISA and the Web server that hosts the content is faster than
the 
>link between ISA and the internal client that sends the request.
>
>To resolve this problem immediately, contact Microsoft Product Support 
>Services to obtain the fix. For a complete list of Microsoft Product 
>Support Services phone numbers and information about support costs,
visit 
>the following Microsoft Web site:
>
> http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS
>
>and provide this Q number to support center: Q321844 (Notes: it is not
an 
>public article so you may not see it from external web site)
>
>3. One of the internal box has virus on it and keeping send udp packets
to 
>ISA server internal interface. You may try to disable the internal
access 
>or just use Network Monitor to capture the traffic to perform an
analysis.
>
>4. Disable the caching function and check if it is the corrupted
caching 
>issue.
>
>Please let me know if this solves your problem or if you would like
further 
>assistance. 
> 
>I look forward to hearing from you.
>Sincerely,
> 
>Microsoft Online Support Engineer  
====================================

HTH,
Tom
www.isaserver.org/shinder


-----Original Message-----
From: Wayne Small [mailto:wayne@xxxxxxxxxxxxxx] 
Sent: Wednesday, January 22, 2003 9:06 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: MS Firewall Service (WSPSRV.EXE) memory leak?


http://www.ISAserver.org


Warren,

I've seen this problem on one of our sites, but have not resolved it.
The ISA service would take up to 1.5GB of firtual RAM over the period of
2 weeks.  We traced the fact that it only increased when we had VPN or
RAS connections inbound and that after working hours the increase would
cease.  We lodged a support case with PSS, and eventually we got to a
point where the only option left was to run some very invasive tools to
monitor the systems usage - apparently these tools would have caused a
large impact on the system due to their nature.  The client
(understandably) did not want this level of degredation, and we settled
for a scheduled reboot each Sunday night.  It's been running solid since
then - still using large amounts of RAM though.  As Microsoft had
suggested that we were the only ones affected by this issue we are
hoping that it may be a side effect of some other issue that may be
fixed in a future service pack.  We have a large number of other sites
running almost the identical configuration without any issues like this.

I know it's not an answer for you but I hope it helps to know that
others have seen it and how we got around it.

Regards,
Wayne Small  [SBS-MVP]
MCSE+I  MCSE 2000
Technical Director - Correct Solutions Pty Ltd
For all the answers on Small Business Server 2000 - check out
www.sbsfaq.com


-----Original Message-----
From: Warren Cundy [mailto:warrenc@xxxxxxxxxxxx] 
Sent: Tuesday, 14 January 2003 11:24 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] MS Firewall Service (WSPSRV.EXE) memory leak?


http://www.ISAserver.org


Hi guys,

I'm running ISA Sp1 on Win2k Sp3.  Recently ISA crashed a few times,
with only 2-3 days between crashes.  I couldn't figure out what it was,
as there was nothing in the error logs, but some perfmon analysis shows
that
(sometimes) this service starts eating up memory and never gives it
back, finally leading to a crash.

Any ideas?  It gets up to something like 700mb of physical and virtual
memory. (512 on the server)  What does this service do?  We don't run
anything else on the ISA Server itself.  I have it serving up an
internal ftp, web site, and Exchange server.  We use SecureNAT.  The
weird thing is that nothing has been touched for at least 6 months, and
this problem showed up about 2-3 weeks ago.

Thanks for any help.

-Warren

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/ Windows
Security Resource Site: http://www.windowsecurity.com/ Windows 2000/NT
Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
wayne@xxxxxxxxxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')


Other related posts: