Endpoint Protection

From past 1 month I am seeing this errors in PC where SEP is installed "Insufficient system resources exist to complete requested service"

all icons will disappear, none of the programs will run properly the moment I stop smc -stop everything will start working fine...

What may be the issue, it was found before SEPM Date issue & even after pathc update...I searched the forum but didn't find any solutions...

Can anybody help out...

What is the version of SEP installed?

We see this issue on SEP MR4 installations.  Upgrading systems to RU5 resolves it...

yes its MR4 version...11.0.4014.26..r u sure RU5 will resolve the problem..

which version of RU5 will fix the issue & which version is more stable.

 Before you upgrade lets try to troubleshoot this issue a bit more. I did not see this particular issue on our list of problems that was fixed in RU5 (not saying it isn't but it wasn't on our list).

So if you could do a few things for me:

1. What is the user doing when he/she sees the error. IE) what is the requested service that is mentioned in the error.

2. Please let us know if there are any processes that are spiking the CPU usage during this time. Particularly rtvscan.exe.

3. If you could post a screenshot of the error that might be helpful (but not necessary).

4. Report what OS you are running on the machine seeing the error.

Thanks
Grant

there is no time to troubleshoot as user requires PC very badly...( we format & give ) but main culprit is SEP

1. it will be normal usage ..I have seen this problem when user takes remote of the machine from other machine..everything hangs..when user tries to login( domain ) directly they get ..system attached to this system is not functioning or cannot connect to existing session...

2. if login through local account & check cpu usage will be normal..if we try to access shared path it shows error not enough storage is available to process this command ( even tried some google tips like increase irpstacksize ,but no use most of sites shows its symantec problem )
if u ping the system latency time incerease & decreases from 20ms to 1 ms ( varaible ) other machine usually pings @ 1ms constant

affected system ping latency time

Pinging 192.168.248.103 with 32 bytes of data:

Reply from 192.168.248.103: bytes=32 time=20ms TTL=128
Reply from 192.168.248.103: bytes=32 time<1ms TTL=128
Reply from 192.168.248.103: bytes=32 time=5ms TTL=128
Reply from 192.168.248.103: bytes=32 time=5ms TTL=128
Reply from 192.168.248.103: bytes=32 time<1ms TTL=128
Reply from 192.168.248.103: bytes=32 time=11ms TTL=128
Reply from 192.168.248.103: bytes=32 time<1ms TTL=128
Reply from 192.168.248.103: bytes=32 time=2ms TTL=128
Reply from 192.168.248.103: bytes=32 time=17ms TTL=128
Reply from 192.168.248.103: bytes=32 time<1ms TTL=128
Reply from 192.168.248.103: bytes=32 time=15ms TTL=128
Reply from 192.168.248.103: bytes=32 time<1ms TTL=128
Reply from 192.168.248.103: bytes=32 time=14ms TTL=128
Reply from 192.168.248.103: bytes=32 time<1ms TTL=128
Reply from 192.168.248.103: bytes=32 time<1ms TTL=128
Reply from 192.168.248.103: bytes=32 time=10ms TTL=128
Reply from 192.168.248.103: bytes=32 time=11ms TTL=128
Reply from 192.168.248.103: bytes=32 time=7ms TTL=128
Reply from 192.168.248.103: bytes=32 time<1ms TTL=128

system which is not affected much

Pinging 192.168.248.216 with 32 bytes of data:

Reply from 192.168.248.216: bytes=32 time=20ms TTL=128
Reply from 192.168.248.216: bytes=32 time<1ms TTL=128
Reply from 192.168.248.216: bytes=32 time<1ms TTL=128
Reply from 192.168.248.216: bytes=32 time<1ms TTL=128
Reply from 192.168.248.216: bytes=32 time<1ms TTL=128
Reply from 192.168.248.216: bytes=32 time<1ms TTL=128
Reply from 192.168.248.216: bytes=32 time<1ms TTL=128
Reply from 192.168.248.216: bytes=32 time<1ms TTL=128
Reply from 192.168.248.216: bytes=32 time<1ms TTL=128
Reply from 192.168.248.216: bytes=32 time<1ms TTL=128




3. refer 1

4. XP sp3/sp2


any idea how to fix this issue without formatting...

If my above suggestion not helps try this 
1.Exit all programs.
2.On the Windows taskbar, click Start > Run.
3.In the Run dialog box, type the following text:
regedit
4.Click OK.
5.Navigate to the following registry key:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
6.In the right pane, right-click the value IRPStackSize.
7.Click Delete.
8.Click Yes.
9.Close the Registry Editor.
ref:Error: "Not enough server storage is available to process this command" after installing Norton AntiVirus

Try this
You can increase the IRPStackSize value. You must first add this value to the following key if it is not already present:
HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Value Name: IRPStackSize
Data Type: DWORD
Default: 0x4
Maximum: 0xC
Increasing this value requires some memory from the non-allocated memory pool, but the impact should not be noticeable.

NOTE: It is not always advisable to set the IRPStackSize value to its maximum of 12. Generally, you should start the value at 4 and work your way up, increasing the value by 1 each time. The problem may still occur if the value is too high.
ref:Err Msg: Not Enough Server Storage Is Available to Process This Command
 

i have already tried all these IRPstacksize increase ,decrease & delete nothing helps...
any other quick solution to fix it completely.

Atleast tell which is the most stable Version in SEP ( these network problems should not reappear)


in some pc's  I get these errors

Application popup: Network Activity: SmcGui.exe - Application Error : The exception unknown software exception (0x40000015) occurred in the application at location 0x6b1a20e8.

Application popup: Network Activity: SmcGui.exe - Application Error : The instruction at "0x67f493a7" referenced memory at "0x00000000". The memory could not be "read".

Did you tried with the IRPstacksize value 11 if no try it.. 

in many threads ( google)  they have mentioned if IRPstackzie by default is 15 & increase in value will have some impact rather than decreasing....as of now system is formatted ( no time for troubleshooting) if I see tat problem again will check with irpstacksize 11. in another pc I have unistalled & reinstalled SEP client with IRP stacksize 30 & i have kept the pc under observation..will update u soon on this issue

atleast can u tell me which is stable version of sep without any probs

the moment I stop smc -stop latency time will become constant i.e 1ms ..if again I start latency time will increase

In event viewer any error? 

event viewer this is the error but not on all machine

Application popup: Network Activity: SmcGui.exe - Application Error : The exception unknown software exception (0x40000015) occurred in the application at location 0x6b1a20e8.

Application popup: Network Activity: SmcGui.exe - Application Error : The instruction at "0x67f493a7" referenced memory at "0x00000000". The memory could not be "read".

I am getting the same error on two computer we have on our network, but they are both running version 10.1.7.7000.  We are running a box with version 11 but it is only in testing mode.  Could it be happening with verion 10?

Are you 100% sure SAV is the culprit? Does stopping the Symantec service restore the computer to its normal state? Also you might consider making your own thread on this issue since the previous one is not solved yet. I don't want to take away from his solution.

Thanks
Grant

I'm getting the same problem "insufficient system resources" problem.  It's been around at least 2 months now.

Symptom:
I only get the issue with three computer models, HP DC7600/7700 SFF and HP Elitebook 8350p.
The issue only occurs when I try to read a CD/DVD.  (All three model have lightscribe drives)
Removing SAV/SEP will remove symptoms.
I have the same issue with SAV 10.1.4.4000 (server managed) or SEP 11.0.2000.1567 (unmanaged)
The symptoms always starts with the following event id:
for SAV:  1001, SAVRT, System memory is running very low.  Norton Antivirus Auto-Protect may not be able to function properly.
for SEP: 1003, SRTSP, Failed to allocate required pool.

I've tried changing the IRPStackSize value and it makes no difference.
I've ran poolmon from the XP support pack and I don't see any significant memory leaks.

I would like to know which version of 10.x (if one exists) addresses and/or fixes this problem.  We're not quite ready to upgrade our servers to SEP yet.  If I know which version fixes the issue, I can talk to licensing to get the appropriate upgrade files.

Help would be much appreciated.

removed SEP in 1 of the pc ..so far no such errors ..PC is under observation.

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
On the Edit menu, point to New, and then click DWORD Value.
Type PoolUsageMaximum as the entry name, and then press ENTER.
Right-click PoolUsageMaximum, and then click Modify.
Click Decimal.
In the Value data box, type 60, and then click OK.
 
Click Start, click Run, type regedit in the Open box, and then click OK
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
On the Edit menu, point to New, and then click DWORD Value.
Type PagedPoolSize as the entry name, and then press ENTER.
Right-click PagedPoolSize, and then click Modify.
Click Hexadecimal.
In the Value data box, type a value of FFFFFFFF, and then click OK.
 

We have the exact same problem but on our Lenovo 8212 models.......It seems to only affect XP SP3...

Have you figured anything out yet?

As far as I'm aware, there is only one version of SEP RU5 which is the latest release (11.0.5002.333).  We started seeing this error on a daily basis; many on high-end workstations and laptops.  After applying RU5 to these systems as recommended by the Symantec engineer, the issue disappeared.  Any system that experiences the issue and we upgrade to RU5 has not experienced it again.

Reply from Tech Support on this was: 
"What version of MR4 are you running on? If it's lower than MR4 MP2 then there may be some page pool issues which could cause the issues you're seeing. If not already on it I'd highly recommend getting to MR4 MP2 or ideally RU5 as both of these versions have that issue resolved"

Found problem on XP SP2 , HP & Dell machines
User is busy with some project release so can't do R&D..will try modifying in the evening & will update...modifying this will create any probs like blue screen or system performance slow down...???

I recommend you to check this in  test environment first... 

how can I find the result in test environment  pc   ( where there is no problem, it wil not make any sense ),  will try directly on user machine..

aravind do u know  any user who has tried this without any probs..

i am not tried yet, but this can solve some memory management related issues... 

What I mean with the word "test" is a pc f something happens to it's os also no problem. This setting is only for testing. I had seen some solutions with other softwares but not with SEP 

Some my users had same problem: "Insufficient system resources exist to complete requested service". Workaround with IRPstaSize didn't work. We had on computers SEP 11.0.2020.56. So 2 days ago I deployed version 11.0.5002.333 and affected users reporting no problem and quicker system.

We had a month of inconsistent errors among different users - all relating to "insufficient system resources".  As it turns out, this affected all computers that were running on Microsoft Windows XP SP3 and SEP 11.0.4000.2295.  After we pushed the upgrade to version 11.0.5002.333, all of our insufficient system resource issues disappeared! 

Thank you for the help! Hopefully no one else will have to suffer through these errors for a month! 

when my office person contacted symantec ppl they are telling RU5 is not stable no idea wat's going on with symantec...

In 1 of the pc uninstalled 11.4014.26 & installed with  11.4000.2295 --pc under observation....
in 1 of the pc running sep 11.4014.26 & implemented Aravind registry fix https://www-secure.symantec.com/connect/forums/insufficient-system-resources-exist-complete-requested-service#comment-3516221 --its under observation.

will update on this ASAP.

 I found SAVCE10.1.5.5000 have same problem too ,the savce.sys used too many page pool（>100MB), Totle  page pool is 160MB,we can't change all user's page pool setting,  why had savce.sys used so many page pool ?

I've been using this tweak on a systems here that had started reporting "Insufficient Resources" accessing network drives.  It seems to have fixed the problem in our installation.   Thanks AravindKM !

We run SAV 10.1.5.5000 on XP SP3 on our client machines.

as of now systems are smooth with both method...no idea how long it will be like this :-)...https://www-secure.symantec.com/connect/forums/insufficient-system-resources-exist-complete-requested-service#comment-3541781

Wil give final result by next weekend.

systems are working fine, users didn't faced any problem nor blue screen nor system slow...

What was the exact solution? 

1 system downgraded sep version & in another system registry trick, in other 2 affected systems i have done registry thing, even those systems are not having problems..may be both gives desired results...

registry thing should be good & quick..

https://www-secure.symantec.com/connect/forums/insufficient-system-resources-exist-complete-requested-service#comment-3516221" href="https://community.broadcom.com/symantecenterprise/viewthread?MessageKey=f50e6546-a13a-4e6e-8aff-5e71241727f5&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=digestviewer#bmf50e6546-a13a-4e6e-8aff-5e71241727f5" class="linkification-ext">https://www-secure.symantec.com/connect/forums/insufficient-system-resources-exist-complete-requested-service#comment-3516221

( no idea how it will impact system performance with older modles like P4 with 512MB RAM but P4 machine was not having these problems, when i asked user having core 2 duo 1GB RAM ( affected systems ) they told its normal like earlier   . )

Happy to hear your problem got solved.
Some times we will not be able to find the exact reason of the problem and we will get the solution.It is really funny...