Web Server crashing due to memory errors. It's like clock work

Question

I have an IIS server that is crashing at about 3:15 am every Friday and Saturday. I understand that swapping out DIMM A in Bank 1 would probably fix the issue. But I would like to hopefully resolve the issue before we do that. But replacement RAM is scheduled.

Below is a jist of what happens.

3:14:35 am
    SceCli (Informational)
        Security policy in the Group policy objects has been applied successfully

3:15:19 am
    Desktop Window Manager (Informational)
        The Desktop Window Manager has exited with code (0x40010004)

3:15:19 am
    User Profile Service (Warning)
        Windows detected your registry file is still in use by other applicatiion or
        services. The file will be unloaded now. The applications or services that hold 
        your registry file may not function properly afterwards.  

        DETAIL – 1 user registry handles leaked from \Registry\User\S-1-5-XX-
        2507511830-2134150133-3242518477-XXX:

        Process 148 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened 
        key \REGISTRY\USER\S-1-5-XX-2507511830-2134150133-3242518477-
        XXX\Printers\DevModePerUser

3:15:22 am
    User Profile Service (Warning)
        Windows detected your registry file is still in use by other applications or 
        services. The file will be unloaded now. The applications or services that hold 
        your registry file may not function properly afterwards.  

        DETAIL -  2 user registry handles leaked from \Registry\User\S-1-5-XX-
        3491755899-3753403084-3723671508-YYYY:

        Process 4196 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has 
        opened key \REGISTRY\USER\S-1-5-XX-3491755899-3753403084-3723671508-
        YYYY\Software\Microsoft\Windows\CurrentVersion\Internet Settings

        Process 4196 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has 
        opened key \REGISTRY\USER\S-1-5-XX-3491755899-3753403084-3723671508-
        YYYY\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

3:15:29 am
    User Profile Service (Informational)
        The User Profile Service has stopped.

3:16:43 am to 3:16:44 am
    SERVER FAULT (Critical) 
        ECC Error Correction detected on Bank 1 DIMM A
        ECC Error Correction detected on Bank 1 DIMM A
        ECC Error Correction detected on Bank 1 DIMM A
        ECC Error Correction detected on Bank 1 DIMM A
        ECC Error Correction detected on Bank 1 DIMM A

3:18:07 am
    User Profile Service (Informational)
        The user profile service has started successfully.

Any ideas are greatly appreciated.

score 2 · Answer 1 · answered Feb 17 '13 at 22:06

2

Replacing DIMM A in Back 1 was the resolution to this issue. I was also able to reproduce the issue on a separate server using the same DIMM in question.

answered Feb 17 '13 at 22:06

Oxymoron

340
3
12

So, why did you remove your checkmark from my answer? – mfinni Feb 17 '13 at 23:04
1

wow... Only noticed this 5 years later... sorry @mfinni – Oxymoron May 25 '17 at 14:03
No sweat, boss. – mfinni May 28 '17 at 02:41

score 1 · Accepted Answer · answered Dec 22 '12 at 20:09

1

You've identified that faulty hardware is causing problems on your server. You've arranged to have that fixed. What solution are you looking for in the meantime?

I suppose you could remove that DIMM, as long as the remaining memory is a supported configuration for your hardware.

answered Dec 22 '12 at 20:09

mfinni

35,711
3
50
86

I'm just wanting to verify that hardware is the only issue at fault here. Seeing as it's very consistent in a timely matter it has me skeptical. – Oxymoron Dec 22 '12 at 20:27
Also, memtest isn't showing any issues with the DIMM. – Oxymoron Dec 22 '12 at 20:37
What vendor is the hardware from? Run their diagnostics. – mfinni Dec 22 '12 at 21:39
the machine is a Dell Poweredge 2850. I'll be running their diagnostics utilities first thing after the holidays. Thanks. – Oxymoron Dec 22 '12 at 22:35

Web Server crashing due to memory errors. It's like clock work

2 Answers2