System Services Stop, Server Slows Down, or Access Violation Errors Occur When You Use a Program or Script to Generate and Monitor Events (816213)


The information in this article applies to:

  • Microsoft Windows XP Professional
  • Microsoft Windows XP Home Edition

SYMPTOMS

When you use a custom program or a Microsoft Visual Basic script that uses Windows Management Instrumentation (WMI) to generate and monitor events, a memory leak condition may appear on the computer that is running the program or the script. You can use the Windows Task Manager to see the memory leak by monitoring the service host process (Svchost.exe) for Windows Management.

The memory leak condition will eventually cause system services to stop, will slow down server performance, and may result in access violation errors (0xC0000005).

CAUSE

This problem occurs because WMI does not release event objects after they are sent to semi-synchronous clients or to other WMI consumers. When the event registration is synchronous or semi-synchronous, the events are cached inside the WMI service. The memory that is used by the event object is not released until the consumer is unregistered.

RESOLUTION

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Windows XP service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The global version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. 
   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   25-Apr-2003  09:41  5.1.2600.1214     480,256  Wbemcore.dll

WORKAROUND

To work around this problem, use asynchronous API consumers instead of synchronous or semi-synchronous consumers in your custom script or program.

MORE INFORMATION

Although this is not an actual memory leak, this problem can result in the same symptoms as a memory leak for semi-synchronous WMI consumers that receive many events and that run for long periods of time.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
Modification Type:MinorLast Reviewed:10/10/2005
Keywords:kbHotfixServer kbQFE kbPerformance kbinterop kbMiscTools kbQFE kbfix kbBug KB816213 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.