Windows Server 2003, EventID 2019, non-paged pool

[Punkrulz]

Hey guys,

I'm looking for some support trying to resolve this issue. We have a Windows 2003 Server that's our domain controller. We've had an issue twice where once every minute a critical error for EventID 2019 would appear. It would appear for a few hours, and then wind up bringing the server down. I've gone on EventID.net trying to figure out how to resolve this issue. One of the things that it's suggesting is to use perfmon and determine what is using the nonpaged pool.

The guide on using that though is cryptic to me, I'll be honest. It says to keep an eye on each application that is using the nonpaged pool... but how? Sure, I can bring up the nonpaged allocation counter on perfmon, but I have no idea of knowing what is using it. Can someone assist me in figuring this out and being able to fix this issue, before the server goes down again?

 

[kcnychief]

If you are running Symantec Anti-Virus, read this document :

http://support.microsoft.com/?id=272568

That would be my bet, as that's a common AV solution for servers

 

[Punkrulz]

I wonder if this is the issue or not. See we're not running Windows 2000, we're running Windows Server 2003... and the Symantec Antivirus client we have is 10.0.1.1000. Any other ideas? How can I check to see though if it is the Symantec Antivirus that's causing it?

 

[DwarfData]

The Microsoft KB Article does say that the issue has been addressed in release 10.3.1.13 of the Symantec SymEvent driver

 

[Punkrulz]

Yeah, so my questions then, just to try and rule this out:

1) How do I check the version of this driver?
2) How do I update this driver?
3) Where can I obtain the updated driver?

***EDIT***

Alright, I found out how to update it. I downloaded sevinst.exe, and ran the command on the server sevinst.exe savce (It's Symantec Antivirus after 9.0). So it's run, it's updated, and I found the driver and saw it's 12.0.1.3... I guess now I wait? Any other suggestions guys?

 

[kcnychief]

Download this file, run it and reboot. That should update your symevent drivers -

ftp://ftp.symantec.com/public/english_us_canada/symevnt/sevinst.exe