Event ID 1011 — Resource Exhaustion Resolver

Applies To: Windows Server 2008

When your system has a critical amount of memory committed to applications, the Resource Exhaustion Resolver component of Windows Resource Exhaustion Detection and Resolution (RADAR) provides details about corrective action you can take to recover system resources by shutting down the top resource consumers.

Event Details

Resolve

Resolve a low virtual memory condition

If your system is so low on virtual memory that it cannot perform resource exhaustion detection, you must close some open applications in order to make additional system resources available. You can use Task Manager to identify applications consuming the most memory and to close them.

Close top resource consumers using Task Manager

To close top resource consumers using Task Manager:

1. Press CTRL+SHIFT+ESC to open Task Manager.
2. On the Processes tab, click the column header to sort by Memory (Private Working Set). Click the column header again to reverse the sort order.
3. Use the list to identify applications consuming the most memory. Attempt to close an identified applications normally. To do this, click the Close button on the application window or on the File menu, click Exit.
4. If the application is unresponsive, on the Applications tab in Task Manager, click the application you want to close and then click End Task. Windows will attempt to close the application normally. You might be prompted to save your work. Note that in low resource conditions, this step can take several seconds.
5. If Windows cannot close the application normally, you will be prompted to end the process. Ending a process can cause data loss. You can choose a different application to close if you are concerned about losing data in the current application.

Generate a System Diagnostics Report or Use Resource Monitor

You can also identify what is causing the system to be low on resources by:

• Generating a System Diagnostics Report using Reliability and Performance Monitor 
• Using Resource Monitor 

These procedures may take several minutes if the system is critically low on resources.

Membership in the local Administrators group is the minimum required to complete these procedures.

To collect system information for 60 seconds and generate a System Diagnostics Report:

1. Open an elevated command prompt. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
2. Type perfmon /report and press ENTER. Reliability and Performance Monitor will start collecting data to create the System Diagnostics Report.
3. When the report is ready for viewing, locate the Diagnostic Results section of the report and check for any Warnings. You can follow links to additional help on resolving warnings from this section. In addition, you can expand each category in the Basic System Checks section to see more details about why warnings appear. Also, the Performance section provides process-level detail about top consumers of resources.

To start Resource Monitor:

Important: Resource Monitor stops collecting information while a System Diagnostics Report is being generated. To start collecting information after a System Diagnostics Report has completed, in Monitor, click Start.

1. Open an elevated command prompt. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
2. Type perfmon /res and press ENTER. Resource Monitor will start running.
3. Four scrolling graphs in the Resource Overview pane display the real-time usage of CPU, Disk, Network, and Memory. Four expandable sections below the graphs contain process-level detail about each resource. Click the resource labels to see more information, or click a graph to expand its corresponding details. You can use the real-time usage information to identify top resource consumers. Click a column heading to sort the data in the table by that column. Click the column heading again to reverse the sort order.

Verify

Membership in the local Administrators group is required to complete these procedures.

Verify that the Diagnostic Policy service is running

To verfy that the Diagnostic Policy service is running:

1. Click Start, click in the Start Search box, type services.msc, and then press ENTER. Microsoft Management Console (MMC) will open with the Services (Local) snap-in open.
2. In the list of services, verify that the Diagnostic Policy Service status is Started.

Verify that the Resource Exhaustion Detector is running

To verify that the Resource Exhaustion Detector is running:

1. Click Start, expand All Programs, and expand Accessories.
2. Right-click Command Prompt, and then click Run as administrator.
3. At the command prompt, type sc queryex dps, press ENTER, and review the results to ensure that the Diagnostic Policy service and Windows Diagnostic Infrastructure (WDI) service are running.

Verify that the Resource Exhaustion Resolver is enabled

To verify that the Resource Exhaustion Resolver is enabled:

1. Click Start, click in the Start Search box, type gpedit.msc, and then press ENTER. MMC will start with the Local Group Policy Editor open.
2. In the navigation tree, expand Computer Configuration, expand Administrative Templates, expand System, expand Troubleshooting and Diagnostics, and double-click Windows Resource Exhaustion Detection and Resolution.
3. In the console pane, right-click Configure Scenario Execution Level, and then click Properties.
4. On the Setting tab, verify that Enabled is selected.

Related Management Information

Resource Exhaustion Resolver

Reliability Infrastructure