High page pool memory usage by Srtsp.sys causes system instability.

Products

• Endpoint Protection

Issue/Introduction

The system is slow and unresponsive or crashes. When performance monitoring is enabled, srtsp.sys appears to be using a large amount of page pool memory.

Cause

One of the drivers utilized by srtsp.sys, naxev15.sys, is using too much page pool memory.

Resolution

This issue has been addressed in Symantec Endpoint Protection 11 MR4 MP2:

High paged pool memory usage for Auto-Protect
Fix ID: 1511152
Symptom: Pool monitor shows high memory usage for SavE and SaEe pooltags.
Solution: AV engine update 

 

Please upgrade to Symantec Endpoint Protection Client MR4 MP2 or above to address the memory issue with the srtsp.sys process.

Alternate solution
Change paged pool maximum to at least 200MB
It is also possible to set the registry value PagedPoolSize to 209715200 decimal or C800000 hexidecimal. Please refer to http://technet.microsoft.com/en-us/library/cc976157.aspx for more information.

Addendum

Symantec released an optimized AV engine on February 4th 2010 that lowers the amount of page pool memory usage in SEP and SAV.
While this is available to all customers and will lower our overall product footprint, we also recommend upgrading to the latest version of
Symantec Endpoint Protection or Symantec AntiVirus products to receive all our memory optimization fixes.
The change will be visible in the file version of naveng.sys and naveng15.sys to be 20091.2.2.11


References
Title: 'Release notes for Symantec Endpoint Protection 11.0.x and Symantec Network Access Control 11.0.x'

Technical Information
The srtsp.sys process allocates memory for navex15.sys which is using too much paged pool memory. The memory usage for navex15.sys was corrected to address this issue.