Troubleshooting Event ID 333 Errors

Video X Drivers » Troubleshooting Event ID 333 Errors

Video X Drivers » Troubleshooting Event ID 333 Errors — Tue, 30 Oct 2007 16:41:08 GMT

PingBack from http://videoxdrivers.net/2007/10/30/troubleshooting-event-id-333-errors/

re: Troubleshooting Event ID 333 Errors

Hrishikesh — Wed, 31 Oct 2007 17:34:20 GMT

I've seen event id 333 with a filter driver that keeps on writing a 64KB binary blob in the registry at every transaction - it just replaces the whole blob because the registry API doesn't allow flushing / writing part of the blob. Probably a poor design with the filter driver, but doesn't happen on all the systems. What's more interesting is that the system logs event id 333 every time the driver writes this blob, but the registry API doesn't fail - it succeeds and the driver continues with further writes.

Do you think something like this would happen because of the disk queue length? Are there any other parameters like the amount of data being written, the frequency of writes to the registry, any workarounds?

re: Troubleshooting Event ID 333 Errors

Aurthur Anderson — Fri, 02 Nov 2007 20:17:21 GMT

Thanks for the information. What could be happening is when the information is being written it coincides with the OS attempt to flush the registry to disk. Another workaround to the symptoms that I forgot to include in the above post is changing the RegistryLazyFlushInterval value to a higher value which increases time between flushes and allows other disk I/O more access to the disk:

--> Configure RegistryLazyFlushInterval in the registry to 60 seconds. (KB 317357)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Configuration Manager]

"RegistryLazyFlushInterval"=dword:0000003C

Thanks for the feedback and let me know if you have any additional questions.

re: Troubleshooting Event ID 333 Errors

Hot Rats — Sat, 03 Nov 2007 12:20:51 GMT

Let's assume that a driver is leaking memory. Beyond "make sure your drivers are updated" what specific functions would be used with Event Tracing for Windows to identify such a driver?

With respect to "For x64 systems, remove all accounts listed" (above), I see that http://support.microsoft.com/kb/918483/en-us says "To prevent SQL Server 2005 64-bit buffer pool memory from being paged out of physical memory, you can enable the lock pages in memory permissions."

Are you saying that it would be "best" to allow SQL Server's buffer pool to be paged memory? Isn't the salient purpose of SQL Server's buffer pool to reduce I/O demands?

Wouldn't allowing SQL Server's buffer pool to be paged out of memory (by removing “Lock pages in memory” for sqlservr.exe) thus be detrimental to SQL Server's performance?

If some other driver is leaking, wouldn't it be best (from the perspective of SQL Server's performance) to identify that leaking driver, first?

re: Troubleshooting Event ID 333 Errors

Virtual — Tue, 08 Jan 2008 12:39:58 GMT

I've seen event 333 and at the same time i received the following message in Console:

Windows - Low On Registry Space

The system has reached the maximum size allowed for the system part of the registry. Additional storage requests will be ignored.

The size of system hive is about 5MB.

The size of Software hive is about 100MB.

The hive that doesn't flush is software.

The OS is Windows Server 2003 SP2.

I checked Disks performance, memory usage , filters driver installed and "Lock Pages in Memory" user right, i didn't find anything wrong.

Any idea?

Thanks

re: Troubleshooting Event ID 333 Errors

Sharif — Fri, 11 Jan 2008 01:24:26 GMT

I had the same issue and none of these worked for me. Simply rebooting the server got rid of the issue.

re: Troubleshooting Event ID 333 Errors

Sharif — Fri, 11 Jan 2008 19:11:23 GMT

Although the errors were no longer appearing in the event log and I was able to do backup of the system using NTBACKUP, I found out that everytime the legato backup started it generated the same error in the event log and then the backup would fail. I took the following step and it fixed the issue for good now:

Uninstall legato networker from the server and reboot

Reinstall it after the reboot is complete

Legato clien (Legato Networker) was uninstalled and reinstalled priro to this but no reboot was done and that made all the difference.

Hope this helps you guys resolve your issue.

re: Troubleshooting Event ID 333 Errors

Alex — Tue, 29 Jan 2008 13:26:52 GMT

I've got this problem on a 64bit server running Exchange 2007 SP1. Rebooting keeps it at bay for a while then it comes back again. There is nothing on this server other than Exchange and a Symantec BackupExec 11d Remote Agent. Have no idea where to look next as none of the above helps...

re: Troubleshooting Event ID 333 Errors

Tessy — Sun, 09 Mar 2008 18:01:33 GMT

One of my Windows 2003 with SP2 is having this event id 333 problem. Server might hang and have to reboot to clear up the problem.

It's a dell pe2800. All dell drivers, firmware and software are updated.

I'm not sure what is the Dell RegFix F6 do.

I have Backup Exec 10d, Mcafee VSE 8.0i patch 15.

re: Troubleshooting Event ID 333 Errors

Amzad Bhasha — Tue, 18 Mar 2008 21:18:54 GMT

We had the same error in our servers (DELL 6850 and 2850), which had 4X1GB and 2X2GB memory (added seperately).

Removing the 2x2GB memory solved the problem.

re: Troubleshooting Event ID 333 Errors

Troy — Mon, 21 Apr 2008 20:49:40 GMT

I have the exact same issue was Alex. Once the server reboots the issue comes back and either connection to AD causes all OWA access to cease, or the most recent event was all outbound email ceasing to work. Unfortunately I don't have a baseline to compare to so that won't work for me but what specific counters should I be looking at for memory/hard disk issues?

re: Troubleshooting Event ID 333 Errors

Robert McCammon — Mon, 28 Apr 2008 15:39:56 GMT

We have just encountered this error after a Symantec set of updates went through. We're running version 10.1.5.5000. A product update rolled through at midnight on April 25/26 and we have received this message ever since.

re: Troubleshooting Event ID 333 Errors

Eleanor Andreasen — Wed, 30 Apr 2008 02:42:10 GMT

I have this messages across ALL siebel servers I support. Usually after reboot the system works fine. Then it deteriorates. When the problem surfaces, even the ping command gets the message "transmit failed error code 1450". Not to mention VNC and remote desktop stop working, and a valid address in the IE browser, e.g., http://good-ip gets the message "Page cannot be displayed" rather than "page under construction".

We have patch KB913446 installed (instead of KB898060), but no improvement can be seen. Actually, right after reboot, I already see the popup error in the env logs.

re: Troubleshooting Event ID 333 Errors

Ralph Hosmer — Wed, 21 May 2008 21:07:13 GMT

Would we expect to see Event ID 333 errors because of running out of Virtual Mem space?

I am seeing the same issue as Troy and Alex on my exchange 2007 sp1 server. I suspect it's related to the Page file size and Virtual Memory being insufficient. Server has 12gb of physical memory but only 2-4gb set for page file. I'm going to add a 18gb page file to another partition (G:), remove the page file from C: and give it a reboot this evening. If it works, I'll let you know.

I can be reached at ralph.hosmer1@gmail.com

re: Troubleshooting Event ID 333 Errors

Brian o'Cualain — Wed, 04 Jun 2008 13:04:20 GMT

I'm seeing this problem on our backup server (using Synamtec Backup Exec 11d) since we migrated from a WFW/Novell to an AD based setup. I noticed that no account has been given the "Lock pages in memory" right. As BackupExec uses SQL, should the SQL account be in there or not?

re: Troubleshooting Event ID 333 Errors

Ralph Hosmer — Fri, 20 Jun 2008 16:32:59 GMT

Moving the page file to another partition and expanding it to equal 1.5*the memory size (in this case 18gb partition file) solved the Event ID 333 errors for me.

re: Troubleshooting Event ID 333 Errors

Vijay_Wipro — Tue, 15 Jul 2008 10:29:17 GMT

Removing the /3gb switch in Boot.ini will solve the 333 event errors.

re: Troubleshooting Event ID 333 Errors

Nick Laurino — Thu, 24 Jul 2008 21:07:33 GMT

I am getting the ID 333 Event on a Virtual Machine. I have not seen any post realated to Vm's so need to get more info. Nothing I have read here seems to be the problem.

The Host server is a Windows 2003 R2 SP2 64BIT server and Virtual Server 2005 R2 SP1. I am running 8 VM's on this host and only one is having this issue. The VM is running Windows 2003 Standard SP2. I have 1GB of memory allocated to the VM and it is an IIS Intranet server.

It is running McAfee VS 8.0 and there have been no new applications or any other software installs on this server for over a year.

This problem only started about 2 weeks ago and the funny part is that there have been no crashes and perforance does not appear to be any different.

I would like to get this resolved before we have a major problem, but as I mentioned none of the remedies listed seem to apply.

Please help if possible.

re: Troubleshooting Event ID 333 Errors

CC Hameed — Fri, 25 Jul 2008 00:09:20 GMT

Nick -

Your best bet would be to open a support incident with Microsoft Product support. It would be inappropriate to speculate about possible causes, although if all the servers are at the same patch level etc, then it could be a problem with your IIS Application. However, getting a support incident with Microsoft Product Support would be the way to go.

- CC

re: Troubleshooting Event ID 333 Errors

Joshua Perry — Tue, 29 Jul 2008 19:30:18 GMT

We saw this with a custom service and it seemed to be related to netbios keepalives. Turning off the keepalives seems to have resolved it.

http://support.microsoft.com/kb/924325

re: Troubleshooting Event ID 333 Errors

Rob Stormes — Mon, 11 Aug 2008 20:01:29 GMT

I have the same errors (over 70,000 in the last 3 days) on an HP AiO600. At the same time, I have been receiving error messages that Windows needs to be activated even though this machine has been in production for over 2 years.

re: Troubleshooting Event ID 333 Errors

luke_galutia@dell.com — Mon, 08 Sep 2008 17:10:36 GMT

great artical. helped to resolve my issue for a customer thanks.

re: Troubleshooting Event ID 333 Errors

NevJam — Thu, 09 Oct 2008 19:23:55 GMT

OK 333 fans - We've managed to fix the issue on all our servers (of which there were many)

Rebooting the server will temporarily get rid of the error however it WILL return.

A simple degrag got rid of this error for me once, however again the persistent error returned.

The laxyregflush mentioned by Aurthur helped occassionally however I've seen the error return even with this configured.

To eliminate the error totally on all our server we added the lazyregflush key as mentioned above and deleted:

HKLM\System\CurrentControlSet\Control\RegistrySizeLimit

If you have this key in the registry and you are receiving 333's, removing this key will fix your issue.

re: Troubleshooting Event ID 333 Errors

333 Fan — Wed, 05 Nov 2008 01:42:52 GMT

Every article I've read says that the RegistrySizeLimit key is not used in Windows Server 2003.

Can anyone else validate that removing this key solved their issue?

Mine is set to 136314880 (Decimal)

re: Troubleshooting Event ID 333 Errors

Morales — Mon, 24 Nov 2008 07:23:20 GMT

333 Fan, the RegistrySizeLimit key is not created by default on XP/Win2k3 systems. However, if the key is present then the value of RegistrySizeLimit will be honored.

Hope that helps.

re: Troubleshooting Event ID 333 Errors

Eymard jp — Fri, 09 Jan 2009 11:55:22 GMT

For me i had the problem on a group of 3 cluster server HPDL380 G4 after installing 8Gb of RAM (upgrade from 4) and put /PAE /3GB options in boot.ini.

The 3 OS were very instable, the cluster crash sometimes.

The solution for me was to remove /3GB option in boot.ini --> restart servers and no more problems since a few days...

I remark that we have Win2003 SP2 server with 8 GB with /3GB option with never problems, but they are not in Cluster environment.

The /3GB option with Cluster on Windows 2003 sp2 32bits seems very unstable. bye

re: Troubleshooting Event ID 333 Errors

Wes540 — Wed, 01 Apr 2009 15:46:55 GMT

I started getting this issue 5 days ago,

every 3 hours the server would start generating the 333 events and everything would stop working on the server (used for webhosting) -

the only thing i could do then was make sure i was on remote desktop so when they started i could kill some processes (didnt stop the errors but services kept working- and then reboot the server instead of having the dc techs force a reboot)

defrag, optimizing virtual memory, lockpages in memory - none worked

the lazyreg alteration helped alittle as didnt get the 333 errors for 5-6 hrs after a reboot

finally fixed this problem with reinstalling the a/v software (didnt think it would be that as has been running fine for over a year)

now 2 days without any 333 errors

re: Troubleshooting Event ID 333 Errors

Ashish Mat — Tue, 18 Aug 2009 23:24:22 GMT

I have a VM Windows 2003 SP@ machine (32 bit) where we are getting this error in eventlogs

Data reads :

0000: 00000000 006c0001 00000000 c000014d

0010: 00000000 c000014d 00000000 00000000

0020: 00000000 00000000

Any idea what could be the issue ?

--We have tried the /PAE switch removal.. NOGO.

--HKLM\System\CurrentControlSet\Control\RegistrySizeLimit .. is not present

--- Made changes in registry for memorymanagement under HKLM->currentcontrolset->Control .. NOGO.

We have once moved the Page file to another location after which the errors stopped. But after we moved it back, they started again.

The error is coming thrice every 5 or 10 seconds. Any idea what can be done ??

Thanks in advance !

re: Troubleshooting Event ID 333 Errors

Ashish — Tue, 18 Aug 2009 23:25:49 GMT

I have a VM Windows 2003 SP@ machine (32 bit) where we are getting this error in eventlogs

Data reads :

0000: 00000000 006c0001 00000000 c000014d

0010: 00000000 c000014d 00000000 00000000

0020: 00000000 00000000

Any idea what could be the issue ?

--We have tried the /PAE switch removal.. NOGO.

--HKLM\System\CurrentControlSet\Control\RegistrySizeLimit .. is not present

--- Made changes in registry for memorymanagement under HKLM->currentcontrolset->Control .. NOGO.

We have once moved the Page file to another location after which the errors stopped. But after we moved it back, they started again.

The error is coming thrice every 5 or 10 seconds. Any idea what can be done ??

Thanks in advance !

re: Troubleshooting Event ID 333 Errors

megasound — Wed, 26 Aug 2009 11:04:17 GMT

Hi all

I first want to say thanks for all the info so far..

first i want to say we use Windows 2003 R2 STD ed. with 4Gb internal memory.

in our case..we received event id 333 ,1500 ,1508, 55, 59

so 333, ntfs , side-by-side errors

Until now we installed MS fixes : kb948496 , kb944984 , kb935926 , kb970054 , kb953490 version 2 , kb934885 and kb932578

We also changed the paging file size , poolsize (reg tweak) ,

so far so good we DID NOT receive any 333 anymore with allmost 100 people logged on

what we also did was cleanup the NTUSER.DAT file from the user

in our case a lott of unused registry items were there , so i cleaned the \software part.

there was 10MB in the \software\lexmark registry hive.

so if i do a calculation : 100users x 10Mb (registry hive) = TOO MUCH

i created a BAT file and runned this in the people profile directory (c:\documents and settings\username\ntuser.dat)

!!!! BE CAREFULL WITH THIS...you can corrupt the users registry...

contents of BAT file :

xcopy ntuser.dat ntuser.dat.orig /h /o /v

reg load HKU\TEMPLOAD ntuser.dat

reg delete ---remove registry key you want to remove---

reg unload HKU\TEMPLOAD

echo done

so in this case i have a secure copy of the ntuser.dat

so unitl now...so far so good....

i will keep you up to date...

bye menno