failed again this weekend. i don't have a report on gi's and handles but whilest running they look ok. for hostmon.exe process
Handles between 200-300
gdi object = 0
threads between 10-100
memory = 322.200 kb on a server than runs for a week now.
memory = 26.000 kb on a server rebooted 4 hours ago.
memory = 12.000 kb on a server just rebooted now.
it appears to go up slowly suggesting a memory leak.
These are the event logs when it crashed
Event Type: Error
Event Source: hostmon.exe
Event Category: None
Event ID: 0
Date: 26/08/2005
Time: 00:39:36
User: N/A
Computer: SCTW0046
Description:
The description for Event ID ( 0 ) in Source ( hostmon.exe ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: List index out of bounds (19).
then
Event Type: Error
Event Source: hostmon.exe
Event Category: None
Event ID: 0
Date: 26/08/2005
Time: 00:39:41
User: N/A
Computer: SCTW0046
Description:
The description for Event ID ( 0 ) in Source ( hostmon.exe ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Access violation at address 004022EC in module 'hostmon.exe'. Write of address 00000000.
then
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 26/08/2005
Time: 00:40:06
User: TECHNP\IPHM001X
Computer: SCTW0046
Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.
then
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 26/08/2005
Time: 00:40:07
User: NT AUTHORITY\SYSTEM
Computer: SCTW0046
Description:
Windows saved user TECHNP\IPHM001X registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
