Memory allocation failure

Memory_allocation_failure_1_Rule (Rule)

Knowledge Base article:

Management Pack
Summary
The Network Address Translation (NAT) protocol encountered a memory allocation failure.
 
Causes
The most common reason for this error is there is not enough available memory in the system.
 
Resolutions
If the server is low on memory, take appropriate action to increase the available memory. See Help and Support Center for information on low memory.
 
Sample Event
Sample Event#1: The DHCP allocator was unable to allocate %1 bytes of memory.This may indicate that the system is low on virtual memory,or that the memory-manager has encountered an internal error.
Sample Event#2: The DNS proxy agent was unable to allocate %1 bytes of memory.This may indicate that the system is low on virtual memory,or that the memory-manager has encountered an internal error.
Sample Event#3: The Network Address Translator (NAT) was unable to allocate %1 bytes.This may indicate that the system is low on virtual memory,or that the memory-manager has encountered an internal error.
Sample Event#4: The H.323 transparent proxy was unable to allocate %1 bytes of memory.This may indicate that the system is low on virtual memory,or that the memory-manager has encountered an internal error.
 
© 2004 Microsoft Corporation, all rights reserved.

Element properties:

TargetMicrosoft.Windows.Server.RRAS.Microsoft_Windows_2003_Routing_and_Remote_Access_Servers_Installation
CategoryEventCollection
EnabledTrue
Event Sourceipnathlp
Alert GenerateFalse
RemotableTrue
Event LogSystem
CommentMom2005ID='{E86108AD-5B5F-47CB-AB68-4B35FC2F28B4}';MOM2005ComputerGroupID={2C66DD87-4D20-48F6-B6A3-19A1598ED025}

Member Modules:

ID Module Type TypeId RunAs 
_907D4578_146C_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default
GenerateAlert WriteAction System.Mom.BackwardCompatibility.AlertResponse Default

Source Code:

<Rule ID="Memory_allocation_failure_1_Rule" Target="Microsoft.Windows.Server.RRAS.Microsoft_Windows_2003_Routing_and_Remote_Access_Servers_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{E86108AD-5B5F-47CB-AB68-4B35FC2F28B4}';MOM2005ComputerGroupID={2C66DD87-4D20-48F6-B6A3-19A1598ED025}">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="_907D4578_146C_11D3_AB21_00A0C98620CE_" Comment="{907D4578-146C-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesMOM2005BooleanRegularExpression</Operator>
<Pattern>^(30003|31004|32002|34002)$</Pattern>
</RegExExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>ipnathlp</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">
<AlertGeneration>
<GenerateAlert>false</GenerateAlert>
</AlertGeneration>
<InvokerType>1</InvokerType>
</WriteAction>
<WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
</WriteActions>
</Rule>