LSASS private bytes
Indicates that the virtual memory used for Local Security Authority Service (LSASS) on the domain controller is above the preset threshold.
The amount of memory used for LSASS varies depending on the load of the computer. As the number of running threads increases, so does the number of memory stacks. Lsass.exe usually uses 100 MB to 300 MB of memory. Lsass.exe uses the same amount of memory no matter how much RAM is installed in the computer. However, when a larger amount of RAM is installed, Lsass.exe can use more RAM and less virtual memory.
|
• |
Supported on: Windows Server 2016, Windows Server 2019, and Windows Server 2022 |
|
• |
Required permissions: When monitored locally and remotely, only domain user privilege is required and the user must be a part of the Performance Logs user group. |
Tests the Process(lsass)\Virtual Memory performance counter on the domain controller for the lsass service to see if the value in the performance counter goes above the configured threshold for a period exceeding the configured duration.
This situation can occur when event tracing for Security Accounts Manager (SAM) events is enabled. When event tracing for SAM events is enabled, the remote procedure call (RPC) binding is not released. Therefore, a memory leak occurs in the Lsass.exe process.
Please refer to the Microsoft knowledge base articles listed below.
LSASS working set
Indicates that the working set memory used for Local Security Authority Service (LSASS) on the domain controller is above the preset threshold.
The amount of memory used for Lsass varies depending on the computer’s load. As the number of running threads increases, so does the number of memory stacks. Lsass.exe usually uses 100 MB to 300 MB of memory. Lsass.exe uses the same amount of memory no matter how much RAM is installed in the computer. However, when a larger amount of RAM is installed, Lsass.exe can use more RAM and less virtual memory.
|
• |
Supported on: Windows Server 2016, Windows Server 2019, and Windows Server 2022 |
|
• |
Required permissions: When monitored locally and remotely, only domain user privilege is required and the user must be part of the Performance Logs user group. |
Tests the Process(lsass)\Working Set performance counter (corresponding to Mem Usage from Task Manager) on the domain controller for Lsass to see if the value in the performance counter goes above the configured threshold for a period exceeding the configured duration.
It is also possible that the number of bytes allocated to the working set has increased to some pathological condition in a particular application.
Please refer to the Microsoft knowledge base articles listed below.
Memory details
Information only. Indicates total, free, and used physical and virtual memory.
Memory page faults a second
Indicates that the performance of the server may be degraded because of too many page faults.
|
• |
Supported on: Windows Server 2016, Windows Server 2019, and Windows Server 2022 |
|
• |
Required permissions: When monitored locally and remotely, only domain user privilege is required and the user must be a part of the Performance Logs user group. |
Tests the Page Faults/sec performance counter on the domain controller to see if the number exceeds the configured threshold.
A page fault occurs whenever the Windows® 2000 operating system tries to access a virtual memory page that is not currently in memory or is in the incorrect place in memory. The process requesting the page must wait while the operating system makes room for the requested page in memory and reads it from disk or relocates it, which may cause a significant delay for the faulting process. If many processes are causing page faults, a condition known as thrashing can occur. If this happens, the performance of the server goes to zero as the operating system spends most of its time managing memory and very little running applications.
A continuously high page fault rate is an indication that the server is running too many processes with insufficient real memory. If left unattended, Active Directory® performance will suffer greatly, and eventually the directory system agent (DSA) will be unable to service requests, which can result in failed logins and authentications, as well as the inability of some applications and services to run at all.
First, determine if the page fault rate is too high or if the threshold is set too low. Assess the overall performance of the server while the page fault rate is high. If the performance seems adequate, increase the threshold; if the performance seems poor, try to reduce the page fault rate.
To reduce the page fault rate on the server, determine if the page faults are due to a single process or a combination of several processes.
|
3 |
Select Memory Delta and Page Fault Delta, if necessary. |
If there is only one process, run that program on another server or at a different time when the server is not as loaded.
If there are several processes that are generating high page fault rates, you will either have to run some of them on another server, or you will have to add more RAM to the server.
