Server 2008 Memory Leak - Zombie Processes

ChinaMan

Gawd
Joined
Jul 9, 2001
Messages
706
I’m working with a windows 2008 server which is experiencing a memory leak. Over the course of 2 weeks, the physical memory gradually decreases until the server locks up and requires a reboot. I have used a number of tools to diagnose the problem including procmon, psexplorer, procmap, sfc , but the one that has been giving me some insight is RAMMAP. When looking at the processes tab, I’m seeing a ton of zombie processes each consuming 20K of memory. So it appears processes are not tearing themselves down properly. I can test this by starting calc.exe and closing it. The process is gone from task manager, but is still present in the processes tab in RAMMAP. I have found a few article which matches the symptoms.

http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/0b610346-fc53-4b39-8cfd-9737d265c3f4

http://forum.sysinternals.com/process-managment-memoryleak-in-windows-x64_topic25425.html

I wanted to run this by folks here before fall down the rabbit hole of analyzing dump files as described in the Microsoft thread. Any way to kill zombie processes in windows? Any insight is greatly appreciated.
 
The 4th last post in the first link is probably your best bet. As he said earlier, it's most likely a driver issue that is causing handle leak.
 
Ha! the answer to my problem was exactly as stated in that post. Ran FLTMC and the same two filter drivers were installed (Aksdf.sys and Hardlock.sys) Stopped them and processes started terminating without being zombied. This has been a festering boil on the rump of progress for month! glad it's finally resolved.
 
Back
Top