Interesting Memory Leak in Configuration Manager Agent (ccmexec.exe)

Last week I encountered an interesting issue with the System Center Configuration Manager 2012 R2 client. The issue is seen as a memory leak in the ccmexec.exe process, driving up the memory consumption in excess of 10GB of memory.

We saw the issue only on Windows 2008 R2 machines where an specific update (KB2775511 – Enterprise Update – See https://support.microsoft.com/da-dk/kb/2775511)

When examining the CCM\Logs nothing was shown but examining the process using Process Explorer and Process Monitor showed a large number of threads being started and ending. These threads have a stack trace looking like

ntoskrnl.exe!memset+0x61a

ntoskrnl.exe!KeWaitForMultipleObjects+0xd52

ntoskrnl.exe!KeWaitForMutexObject+0x19f

ntoskrnl.exe!PoStartNextPowerIrp+0xba4

ntoskrnl.exe!PoStartNextPowerIrp+0x1821

ntoskrnl.exe!KeWaitForMultipleObjects+0xf5d

ntoskrnl.exe!KeRemoveQueueEx+0x323

ntoskrnl.exe!ExQueryAttributeInformation+0x1803

ntoskrnl.exe!KeDetachProcess+0x4d6

ntoskrnl.exe!KeSynchronizeExecution+0x3a23

ntdll.dll!ZwWaitForWorkViaWorkerFactory+0xa

ntdll.dll!RtlValidateHeap+0x39b

kernel32.dll!BaseThreadInitThunk+0xd

ntdll.dll!RtlUserThreadStart+0x21

I have been working with Microsoft Support (I still think of them as PSS) on the issue and they have confirmed the problem and tracked it to CBS (Component Base Servicing). For an introduction to CBS see http://blogs.technet.com/b/askperf/archive/2008/04/23/understanding-component-based-servicing.aspx

According to Microsoft the issue can happen on a number of updates but I have only seen the issue when deploying kb2775511. And that update should not, in my opinion, be installed using Software Updates since a number of updates must be installed afterwards to fix problems introduced with the update.

Advertisements
This entry was posted in Configuration Manager and tagged , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s