SQL SERVER – Event ID: 2004 – Resource Exhaustion Diagnosis Events

Recently I was working with a client where they were having an issue with SQL Server memory usage. They received below warning message in System Event log – Resource Exhaustion Diagnosis Events.

Log Name: System
Source: Microsoft-Windows-Resource-Exhaustion-Detector
Event ID: 2004
Task Category: Resource Exhaustion Diagnosis Events
Level: Warning
Keywords: Events related to exhaustion of system commit limit (virtual memory).
User: NT AUTHORITY\SYSTEM
Description: Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: sqlservr.exe (2303) consumed 129733837434 bytes, ReportingServicesService.exe (17805) consumed 6491374460 bytes, and msmdsrv.exe (1643) consumed 2905451451 bytes.

I have never seen such a message earlier so did some more research and found some interesting information. I am sharing it here for the benefit of my blog readers.

As you can see the source of the error message and tell that this message is a part of operating system resource monitoring.  The important part of this error message is that it shows top consumers of virtual memory. In the above sample from my client, they are executable of SQL Server, Reporting Services and Analysis services.

It was clear that SQL Server process was using lots of virtual memory. I started analyzing DBCC MEMORYSTATUS output but none of the memory clerks was consuming memory.  This would mean that some other process within SQL is doing it? I checked loaded modules DMV in SQL Server and found something interesting.

SELECT description, *
FROM sys.dm_os_loaded_modules
WHERE description like 'McAfee%'

WORKAROUND/SOLUTION

After a lot of search on the internet, I was able to find that McAfee has a known issue where SQL Server would consume more memory. Memory leak in sqlserver.exe process with the Host Intrusion Prevention 8.0 SQL engine

I checked client version and they were on lower version of Host IPS. Once they applied the latest version of Host IPS, the issue was resolved, and we did not see those messages again.

Reference: Pinal Dave (https://blog.SQLAuthority.com)

First appeared on SQL SERVER – Event ID: 2004 – Resource Exhaustion Diagnosis Events