That is fine, perhaps Strawgate can find a different solution and or just remove the fixlets from the site.
1 Like
or perhaps if we figure out if the cause is limited to a specific versions of trusted installer / OS, then those buggy versions could be excluded in the relevance.
I’m not sure if this would change anything or not (in this specific topic)
What we have found is that even stopping the BES client after the Trustedinstaller.exe has grow in size does not cause the leak to end and for trustedinstaller to return to its normal state. The only thing that seems to clear its memory leak is to terminate the process entirely.
1 Like
This definitely points to the issue being outside of BigFix itself.
One thing I would try is installing the newest version of the BigFix client available on an affected system even if this is a higher version than the root/relay. It will still work and is a good diagnostic test to see if there are any bug fixes in the newest version to address this. I don’t think this will fix the issue, but definitely worth a try.
I would definitely look for any hotfixes or updates for trustedinstaller or wmi.
One recommendation is to try DISM.exe /Online /Cleanup-image /Restorehealth AND sfc /scannow which probably won’t fix anything, but worth a try.
Related:
Do you you of a specific hotfix. I installed the one referenced below on the Server 08 R2, to no avail.
https://support.microsoft.com/en-us/help/3065987/windows-update-client-for-windows-7-and-windows-server-2008-r2-july-20
I will give these a try and report back!
1 Like
Be aware that usage of WMI exposes the client to a lot of 3rd party code that hooks into the WMI system. When we make a WMI call into the OS, all those vendor pieces run and in some cases its a performance issue, but obviously if there is a leak in any of the many providers hooking into WMI ( https://msdn.microsoft.com/en-us/library/aa393920(v=vs.85).aspx ) then the leak will of course be attributed to the calling application which in this case is the agent.
As you are also talking about a “fresh” install of Server 2008 R2 there are several patches (probably ones others have also mentioned) that do fix leaks in the OS so patching the system up is recommended. Also your fresh install might have a specific hardware vendor in the machine for a driver that hooks into the WMI system which may have been updated in the past.
This is part of the reason I’m not a big fan of WMI as it makes the agent somewhat lose control over what is running so performance, cpu usage, memory etc are all at the whim of the management system. I do realize that in many ways this is the only way to get some information so we try to replace commonly used WMI expressions with other inspectors.
1 Like
Sounds a lot like the leak previously mention that occurs when Server Manager is left open. It was described that it was due to Server Manager refreshing the list of installed components/features which was probably also calling WMI.
1 Like
I agree, sounds the same. Do you have a link to that discussion?
Sorry, I thought I had posted this earlier but see I did not. I can’t find the exact site I was looking at at the time but these look related
https://marc.durdin.net/2012/02/further-analysis-on-the-trustedinstaller-exe-memory-leaks/
2 Likes
Even after fully patching the server will all available patches and known hotfixes mentioned, the behavior still exists. I removed those 4 fixlets from that site, and the behavior has stopped for my test machine. This will work for me, as we have no need for those fixlets in our environment.
Thanks everyone for the assists! If you discover anything down the line, keep this odd issue in mind!
Thanks,
Mark
2 Likes
That seems to be the best option for now. Hopefully we can figure out a better long term fix.
1 Like