How to Troubleshoot Memory Leaks in IIS

how to use Performance Monitor to determine if an Internet Information Server (IIS) 4.0 or Internet Information Services (IIS) 5.0 process is leaking memory. Although this article outlines steps that are specific to IIS, the steps apply to any process that is running on Microsoft Windows NT 4.0 and Microsoft Windows 2000.

A memory leak occurs when the memory usage of an IIS process (Inetinfo.exe or Mtx.exe for IIS 4.0, Inetinfo.exe or Dllhost.exe for IIS 5.0) continues to grow steadily over a long time, or when memory usage of IIS grows until IIS runs out of memory. On heavy-use sites, a growth in memory over the first 24 hours of use is not uncommon. IIS caches a lot of data and the Time To Live (TTL) on the cache is 24 hours.

You can generally confirm whether a memory leak exists through a Performance Monitor log that demonstrates the growth of the leak.

Note Because Task Manager can only display real-time memory use of a process (instead of logging it over a period of time), it is not a valid indicator of a memory leak. Ideally, the performance log is started shortly after the server is restarted, and it is run long enough to show that the leak exists.
How to Generate a Performance Monitor Log for IIS 4.0

1. Click Start, point to Programs, select Administrative Tools, and then click Performance Monitor.
2. On the View menu, click Log.
3. On the Edit menu, select Add to log to open the Add to Log dialog box. (You can also click + on the toolbar).
4. Hold down the CTRL key and select each of the following objects:
* Active Server Pages
* Internet Information Services Global
* Memory
* Process
* Processor
* Thread
* Web Service
5. Click Add, and then click Done.
6. On the Options menu, click Log. Provide an appropriate file name, and then verify that the format is .log under Save as Type.
7. For Update Time, provide an interval that is between the time that it takes to show the leak and the time when the computer will run out of hard disk space. If the leak takes several days to occur, a longer interval of 10-15 minutes is appropriate; if it only takes a few hours, a shorter interval is appropriate. Note that for Windows NT, generating a Performance Monitor log requires an active logon to the computer, so you can use a mapped drive or UNC path for the log file output. Generation of the log file stops when one of the following occurs:
* The log is stopped.
* Available hard disk space is exhausted.
* The log file size reaches 2 GB.
* The server stops responding because of the memory leak.
8. After you click Start Log, Performance Monitor starts to log data. While the log is running, you can view the size of the log that is being generated in the lower right corner of Performance Monitor.
9. After sufficient time has passed for the leak to occur, click Log on the Options menu, and then click Stop Log.

How to Generate a Performance Monitor Log for IIS 5.0

1. Click Start, point to Programs, select Administrative Tools, and then click Performance.
2. Expand Performance Logs and Alerts.
3. Right-click Counter Logs, and then click New Log Settings.
4. Provide a name for the new log file.
5. On the General tab, click Add.
6. Click both All Counters and All Instances.
7. In the Performance Object list, click Active Server Pages. Verify that All Counters is enabled. Note that All Instances is not available. Click Add.
8. Repeat this process for the following objects:
* Internet Information Services Global
* Memory
* Process
* Processor
* Thread
* Service
If you do this correctly, each counter is listed as \\computername\counterobject\* on the General tab.
9. Set the sample data interval that is between the time that it takes to show the leak and the time when the computer will run out of hard disk space. If the leak takes several days to occur, a longer interval of 10-15 minutes is appropriate; if it only takes several hours, a shorter interval is appropriate. Make sure to pay attention to the unit of the interval (seconds, minutes, hours, or days).
10. On the Log Files tab, change the location of the log if you have to. Leave all other options on this tab at the default values.
11. If you must generate the log file without anyone being logged on to the server, set a start and stop time for the log file on the Schedule tab. (This option does not exist on Windows NT 4.0).
12. Click OK to return to the Performance Microsoft Management Console (MMC) snap-in.
13. If you have to, in the right pane of the MMC snap-in, right-click the log file name that you created, and then click Start. If the icon is green, the log is running. If it is red, it is stopped.

How to Open and View the Performance Monitor Log for IIS 4.0

1. Click Start, point to Programs, select Administrative Tools, and then click Performance Monitor.
2. On the Options menu, click Data From.
3. Click Log File, and then click the Edit (...) button to open the Open Input Log File dialog box.
4. Select the Performance Monitor log that you want, and then click Open.
5. In the Data From dialog box, click OK.
6. On the Edit menu, click Add to Chart (or click the + toolbar button).
7. In the Object list, click Memory. In the Counter list, click Available Bytes.
8. In the Object list, click Process. In the Counter list, hold down the CTRL key, and then click Private Bytes, Virtual Bytes, and Working Set. In the Instance list, click the appropriate process name (Inetinfo.exe or Mtx.exe), and then click Add. If you have to, repeat this process for each instance of Mtx.exe.
9. Click Done after you add the counters to the chart.

How to Open and View the Performance Monitor Log for IIS 5.0

1. Click Start, point to Programs, select Administrative Tools, and then click Performance.
2. Under Console Root, click System Monitor.
3. In the right pane, right-click in the chart area, and then click Properties.
4. On the Source tab, click Log file. Locate and select the Performance Monitor log that you want.
5. Click Open to return to the Source tab.
6. Click the Data tab, and then click Add.
7. In the Performance object list, click Memory. Under Select counters from list, click Available Bytes, and then click Add.
8. In the Performance object list, click Process. Under Select counters from list, hold down the CTRL key, and then click Private Bytes, Virtual Bytes, and Working set. Under Select instances from list, select the process that you suspect is leaking memory (Inetinfo.exe or Dllhost.exe). If you have to, repeat this process for each instance of Dllhost.exe.
9. Click Close to return to the Data tab.
10. Click OK to display the data.

How to Confirm a Memory Leak With a Performance Monitor Log
A memory leak is confirmed if you see the following in the Performance Monitor log:

* The Available Bytes counter under the Memory object drops over time and does not eventually level off.
* Under typical conditions, the Process object counters for a process (Private Bytes and Virtual Bytes) are basically parallel. If one of these counters for a process is not consistent with the other, a memory leak may exist.

Note that troubleshooting a memory leak is a repetitive process that frequently requires isolating suspected applications down to the individual processes to determine the application that is the source of the leak. For additional information about how to isolate applications to individual processes for troubleshooting, click the following article numbers to view the articles in the Microsoft Knowledge Base:
281434 (http://support.microsoft.com/kb/281434/EN-US/ ) How to Isolate a DLL Into a Separate Process By Using Microsoft Transaction Server (MTS)
281335 (http://support.microsoft.com/kb/281335/EN-US/ ) How to Isolate a DLL Into a Separate Process By Using Component Services
After you have confirmed the memory leak and, if necessary, isolated the leak to an individual process, contact Microsoft Product Support Services for more help. Having a Performance Monitor log available decreases the troubleshooting time.