Saturday, May 4, 2019

windows 7 - Need help tracking lsass.exe memory leak

I'm trying to track down a memory leak in lsass.exe, following guidelines from article1 and article2, among others. I've gotten through setting up gflags for lsass.exe, rebooted, and found it has process ID 804. Now I run the command line:



umdh -p:804 -f:mylog.txt



This immediately spits back the error:



Error: Failed to enumerate process modules.



And the log file has nothing useful:


//
// UMDH: version 6.2.9200.16384: Logtime 2013-05-16 14:49 - Machine=SHAUL-WORK-LT - > PID=804
//
// Debug privilege has been enabled.
// OS version 6.1 Service Pack 1
// Umdh OS version 6.2
//
// Preparing to dump heap allocations.
// Only allocations for which the heap manager collected a stack are dumped. Allocations whithout stack are ignored.
// The stack trace for an allocation is dumped as a list of addresses. They will be resolved to function names at compare time.
//
// Connecting to process 804 ...
// Process 804 opened handle=48.

Where do I go from here?

No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...