How To Isolate and Identify the Source of Inetinfo or Other Process Memory Leaks
This article has been archived. It is offered "as is" and will no longer be updated.
Memory leaks, regardless of where they occur, tend to manifest the same behavior. As a process continues to run, a decreasing amount of memory is available over time and eventually the process can run out of memory to allocate.
Internet Information Server (IIS) has no known memory leaks at this time. There are, however, typically dozens of components that are used within the Inetinfo process that may have memory leaks. Over time, these leaks can accrue, potentially causing the entire process to stop responding.
Be aware that on high volume sites, a growth in memory over the first 24 hours of use is not uncommon. IIS caches much of its data and the Time To Live (TTL) on the cache is 24 hours. In fact, the IIS file cache is set to use up to half of available memory by default.
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
NOTE: You can use the procedures given below to examine any process that you suspect has a memory leak; to do so, replace "Inetinfo.exe" with the name of your process.
To get memory usage logs of the Inetinfo process which can be resolved against modules that are allocating memory, complete the following steps:
- Install the necessary symbol files.
- At the command prompt, type the following:
- To enable memory allocation tracking:
- Start Registry Editor (Regedt32.exe).
- Locate the GlobalFlag value under the following key in the registry:
- On the Edit menu, click DWORD, type 23000, and then click OK.
- Quit Registry Editor.
- Download two utility programs, Dh.exe (Display Heap) and Dhcmp.exe (Heap Compare), into a temporary directory. Both programs are available at the following Web site:
Dh.exe is included as part of the Windows NT 4.0 Resource Kit, Supplement 2 or higher. To download it, expand Network/Server Administration Tools from the tree on the left, and click Dh.exe.
Dhcmp.exe is included as part of the Windows NT 4.0 Resource Kit, Supplement 4. To download it, expand New Tools from the tree on the left, and click New Tools with Supplement Four.
- Restart your web server.
- Press CTRL+ALT+DELETE, click Task Manager, click the Processes tab, and locate the process ID (PID) for Inetinfo.exe.
- Open a command window, switch to the directory into which you copied Dh.exe and Dhcmp.exe, and enter the following command:
dh -p PID -f before.txt
- Wait for the leak to show, and then enter the following command:
dh -p PID -f after.txt
- Once the logs are captured, enter the following command:
dhcmp -d before.txt after.txt>cmp.txt
- Send the Before.txt, After.txt, and Cmp.txt files to your Microsoft Support Professional via FTP. (If you like, you may zip these files.) Please see the Microsoft File Exchange Web page for information on transferring files via FTP:
- Send email to your Microsoft Support Professional with the following information:
- The version of Windows NT and Service Pack that you are running.
- Any IIS hotfixes that you have installed.
- A full description of the events leading up to the system not responding.
- A full description of your web site's architecture.
243318 How to Use Dh.exe to Troubleshoot User-Mode Memory LeaksFor additional information, including the command-line options of Dh.exe, see the following article:
168609 How to Use Display Heap (DH.EXE) Resource Kit Utility
Article ID: 253706 - Last Review: 01/10/2015 03:53:33 - Revision: 3.0
- kbnosurvey kbarchive kbbug kbdebug kbgrpdssie kbhowto KB253706