All it takes is one time for the lazy writer to fail for the event flooding to begin.
Registry bloat: The registry suddenly grows in size, which makes it increasingly difficult for the lazy writer to commit the changes to disk, commonly occurring on terminal servers.Įspecially frustrating is how the events continue to flood the System event log (many times per minute) until the server is rebooted.Disk was too busy or inaccessible: Sometimes a busy disk might not respond quickly enough to handle the lazy writer’s request to commit modified pages of memory to disk.Often this type of problem is accompanied by either an event ID 2020 or 2019.
Memory resource depletion: At the time the lazy writer attempted to write the modified pages in cache to disk, there weren’t enough resources to complete the operation.Generally, event ID 333 can be classified into one of three categories: Once they log on, they may be able to work without a slow experience however, the logon takes several minutes instead of a few seconds. Delayed Terminal Services connections: Users trying to log on to a terminal server could experience slow or delayed logons.Server sluggishness: The server is extremely slow to respond at the console, and processing information is significantly delayed.Server hangs: Your server may completely stop responding to keyboard or mouse movements and appears completely locked up, requiring a hard reboot.The symptoms that might accompany the event ID 333 error include: When the lazy writer fails, an event ID 333 is recorded in the System event log.
#Poolmon.exe location windows#
Windows uses what is called the lazy writer to periodically write modified pages of memory to disk. This means that the image of the registry held in memory could not be written to disk. The Registry could not read in, write out, or flush, one of the files that contain the system’s image of the Registry. Mircosoft has also a list of Pooltags used by Windows.Event ID 333 description is An I/O operation initiated by the Registry failed unrecoverable.
#Poolmon.exe location driver#
To identify the correspondending driver open a cmd shell and navigate to c:\Windows\System32\driversĬ:\Windows\System32\drivers> findstr /m /s /l DSOb *.sys Also a large difference betweenn “Allocs” and “frees” are a hint of leaking memory.
#Poolmon.exe location drivers#
In this case the drivers with the tags DSOb and DSqe have an exessive usage of the paged and nonpaged pool. The Tool is located in the Installation folder of DDK in the tools\other directory. Poolmon – This is shipped with the Windows Device Driver Kit. To analyze this behaviour a additional tools is requiered. If your system runs out of (physical) memory and no process could be identified who is allocating the memory, the paged- or nonpaged pool could also have an high memory load.