IIS and Notification Server become unstable because of memory leak caused by Trend Micro antivirus
Last Updated March 21, 2008
A very decent Notification Server (managing 2,000 clients) with 4 CPUs, 8 GB of RAM, running 2003 Enterprise Edition becomes unstable on almost a weekly basis, wherein IIS quits servicing requests, the Notification Server becomes sluggish, and the logs become a sea of red errors ranging from unserviced requests to being unable to store files or retrieve package information.
Eventually, the Microsoft thread manager cisvc.exe loads up trying to do damage control, around which time the CPU utilization rises to 80 percent or more for the duration. The only way to recover is to reboot the server.
It was identified (using SystInternals Process Explorer) that Trend Micro* antivirus (Trend Officescan* 8.5 and 8.55) was spawning processes that were sapping resources and causing CPU spikes even when things should be calm.
Trend Micro Support acknowledged that a problem previously thought correctly was still occurring (based on analysis tools they provided) and that it would be fixed in a future release. The following is some workaround information (in its original form) that they provided the customer which did help to stabilize things:
The CORE and SEG Teams have provided the following recommendation for the Server Page Pool Memory.
Please add the following registry key to enlarge the paged pool size. Don't forget to "reboot" the computer.
**(NOTE: The setting will be ignored if our customer's server is with /3G boot option.)** ** Always make a back-up of your registry before making any changes **