Potential Memory Leak Detected

Microsoft.LS.2013.Monitoring.IIS.ApplicationPool.MemoryLeak.Monitor (UnitMonitor)

Knowledge Base article:

Summary

The application pool is recycled too frequently because its virtual or physical memory consumption reached the configured limit. This could be indicative of a memory leak inside the code which the application pool is executing.

Configuration

The way this monitor works is it looks for a number of application pool recycling events due to reaching the configured memory usage threshold (this is configured inside IIS Admin tools). There are two parameters you can configure for this monitor. The first is "Number Of Occurrences", this is the number of times that events which the monitor is looking for need to occur in the configured time interval. The second parameter is "Number Of Minutes", this is the time interval in which the monitor looks for the event occurrences.

Causes

There is a memory leak inside the code which the application pool is executing.
The physical or virtual memory limit is set too low.

Resolutions

To check or configure application pool limit settings by using IIS Manager:

Click Start, click Control Panel, and then click Administrative Tools.
Right-click Internet Information Services (IIS) Manager and select Run as administrator.
In the Connections pane on the left, expand the computer, then select the Application Pools folder underneath the computer name.
In Features View, select the application pool. In the Actions pane, select Advanced Settings.
Check or configure the settings for application pool limits under the appropriate section(s).

Note: Because this is a manual reset monitor, after fixing the problem you will need to reset the state of this monitor in health explorer. You can do this by right clicking on the monitor and selecting the "Reset Health" menu item. Unless you manually reset the monitor, it will not switch to healthy state.

Element properties:

Target

Microsoft.LS.2013.IIS.WebApplication

Parent Monitor

System.Health.AvailabilityState

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.LS.2013.MonitorType.IIS.RepeatedEventLogManualReset2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Potential Memory Leak Detected

Application Pool {0} on server {1} was restarted several times due to exceeding memory thresholds specified for this application pool. This could indicate a memory leak inside the web application's code.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.LS.2013.Monitoring.IIS.ApplicationPool.MemoryLeak.Monitor" Accessibility="Public" Target="Microsoft.LS.2013.IIS.WebApplication" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Microsoft.LS.2013.MonitorType.IIS.RepeatedEventLogManualReset2StateMonitorType" ConfirmDelivery="false">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.LS.2013.Monitoring.IIS.ApplicationPool.MemoryLeak.Monitor.AlertMessage">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Target/Property[Type="Microsoft.LS.2013.IIS.WebApplication"]/Name$</AlertParameter1>

      <AlertParameter2>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter2>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="PotentialMemoryLeakDetected" MonitorTypeStateID="RepeatedEventRaised" HealthState="Warning"/>

    <OperationalState ID="Healthy" MonitorTypeStateID="ManualResetEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <RepeatedComputerName>.</RepeatedComputerName>

    <RepeatedLogName>System</RepeatedLogName>

    <RepeatedExpression>

      <And>

        <Expression>

          <RegExExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>MatchesRegularExpression</Operator>

            <Pattern>^(5117|5077)$</Pattern>

          </RegExExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-WAS</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[2]</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="Microsoft.LS.2013.IIS.WebApplication"]/Name$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </RepeatedExpression>

    <NumberOfSeconds>3600</NumberOfSeconds>

    <NumberOfOccurrences>10</NumberOfOccurrences>

  </Configuration>

</UnitMonitor>