IIS and Notification Server become unstable because of memory leak caused by Trend Micro antivirus

Products

• IT Management Suite

Issue/Introduction

A very decent Notification Server (managing 2,000 clients) with 4 CPUs, 8 GB of RAM, running 2003 Enterprise Edition becomes unstable on almost a weekly basis, wherein IIS quits servicing requests, the Notification Server becomes sluggish, and the logs become a sea of red errors ranging from unserviced requests to being unable to store files or retrieve package information.

Eventually, the Microsoft thread manager cisvc.exe loads up trying to do damage control, around which time the CPU utilization rises to 80 percent or more for the duration. The only way to recover is to reboot the server.

Cause

It was identified (using SystInternals Process Explorer) that Trend Micro* antivirus (Trend Officescan* 8.5 and 8.55) was spawning processes that were sapping resources and causing CPU spikes even when things should be calm.

Resolution

Trend Micro Support acknowledged that a problem previously thought correctly was still occurring (based on analysis tools they provided) and that it would be fixed in a future release. The following is some workaround information (in its original form) that they provided the customer which did help to stabilize things:

The CORE and SEG Teams have provided the following recommendation for the Server Page Pool Memory.

Please add the following registry key to enlarge the paged pool size. Don't forget to "reboot" the computer. 

**(NOTE: The setting will be ignored if our customer's server is with /3G boot option.)**
** Always make a back-up of your registry before making any changes **

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Value: PagedPoolSize
DWORD Data: 0xFFFFFFFF

After the change, please monitor the server for stability.

If this does not help, and it is suspected that Trend Micro antivirus may be to blame then contact Trend Micro support.

Applies To
Notification Server 6.0.6074 SP3 R5