Deallocate Elastic Search Memory after uninstall - elasticsearch

I am on Windows 10 and I installed ElasticSearch from msi package and installed it as a service. I configured 2GB memory for its cluster and nodes while installing.
Now I want to uninstall it completely and deallocate all the memory, I uninstalled it from Add or Remove Programs and also made sure that I don't have any service named Elasticsearch in services.msc.
Even after uninstalling I see in my Task manager that 2GB ram is still being used and I believe its because of Elasticsearch.
How can I deallocate that memory? I have also tried restarting my computer multiple times but still 2GB memory is still allocated.

Task manager doesn't show usefull info, try to download https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
run it as administrator and discover dllhost.exe process - try to understand which dll is consuming resources.

Related

Why the ballon service on Windows KVM guest needs to be restart or manually start can host get real memory usage?

I've installed virtio-win on the Windows guest.
Actually it works fine but one problem is that the service can not be automatically started, if do so, not memory stats can be found in the host.
When I manually started or restarted, the stats will works okay.
How could that happened? Is the problem of virtio-win or mine? I just installed it without any actions :(
Thank you for your help.

Task Manager shows Hard drive at 100%

My hard drive is at 100% in Task Manager.
I disabled Windows Search and Superfetch and hard drive is still at 100%.
I am using Windows 10.
Any suggestions would be helpful.
Update: Task Manager won't show what process is clogging up hard drive at 100%.
Task Manager won't show any processes that use up a lot of percentage of hard drive.
I suggest you see the processes tab and see if any process that might be using maximum read/writes in your hard drive.
Disable Indexing service that sometimes use more resources. Disable any startup process that might be using your system resources.
Windows + R -> Run Menu -> Type: msconfig and see any startup process that you can disable. Disable any program that seems suspicious.
You can try some other repair methods like:
Perform a diskcheck
Reset Virtual Memory
Disable Antivirus Software temporarily
Change the settings in Google & Skype
Fix your StorAHCI.sys driver
Update your device drivers
Win10 100% disk usage
I had the same issue on my WINDOWS 10 system and I tried a lot of things like turning off the search indexing feature of windows but nothing worked using all that. Here is what worked for me. I opened the task manager and found that there was a task with Microsoft Compatibility Telemetry (CompatTelRunner.exe). It is a Windows process that is designed to collect and send usage and performance data to Microsoft. The executable file collects and regularly sends usage and performance information to Microsoft in order to analyze the user experience and improve it. The described file also helps Microsoft to identify compatibility issues and ensure compatibility when installing the latest Windows OS version. However, Microsoft Compatibility Telemetry eats CPU by scanning computer files and check their compatibility with Windows 10 in case an update is initiated.
I simply clicked on End Task for Microsoft Compatibility Telemetry and my disk usage went from 98% to 15% within few seconds. I hope it helps others experiencing the same issue as well.
I had the same issue with windows 10 on Laptop.
I set the windows update service from automatic to manual.
Now i am always under 5%.
Click on administrative tools in control panel
Then click on Services
set windows update to manual.
Had the same problem for months. Desactivated SrTasks.exe and it started working.
However this task is clearly something important, so I think it's not recommanded to stop it.

Docker won't start on Windows: Not Enough memory to start docker

I am trying to get started with Docker on Windows. My machine has 4GB of RAM and a 1.9GHz - 2.5GHz Intel i5 processor, running Windows 10 Pro x64. I know these aren't powerful specs, but I would have thought I should be able to run Docker?
However, having downloaded Docker, I get the error message:
Not Enough memory to start docker
I have seen various forum posts and github issues about this and followed all the advice I can see, such as modifying the settings in Docker, I tried these:
They also mentioned changing the settings of the Hyper-V VM however, this seems to be deleted and recreated with the Docker specified settings on every attempted launch. I tried 2048MB, 1792MB, 1536MB, 1280MB and 1024MB of RAM, all of which failed.
What else can I do? Surely I can run docker in some form on my machine? NB: I have closed all non-essential background apps. There doesn't seem to be many other suggestions for what seems to be a fairly common issue, where the given solutions don't work?
I have also encountered the same problem. Tried everything from giving dynamic memory to enabling and disabling Hyper V and many more. But with all that, I got no success.
Then I tried these steps for
Docker won't start on Windows: Not Enough memory to start docker:
From System Tray menu, right click on Docker icon
Select Switch to Windows containers...
Restart the system.
There you go after restarting your docker status should be showing as: Docker is running
PS: Switching back to Linux container should work now after switching to Windows Containers for most of the users as said by rfay.
Updates (May 01, 2019)
Despite of the above methods if you're still unable to start docker on your Windows Machine, try with the following things:
Download RAMMap from Microsoft's Official website
Open the application and select Empty menu
From the sub-menu list select the first option Empty Working Sets
Now refresh it by pressing F5
Now try running docker and I believe this should work.
I solved this issue by right clicking on the docker tray icon chose settings and then tapped on the "Advanced" section.
Then I lowered the memory from the default 2048 to 1536 and works like charm.
Another option is try to switch to Windows Containers then Restart the Machine and switch back to Linux Containers.
Below is my docker settings with Advanced tab open. Note the Memory is 1536 and My laptop has 4GB Ram.
Also the virtual machine "MobyLinuxVM" is running as shown below;
I hope this helps someone one day even if was a late answer :)
if you are on window and got this error,
Go to Search box
#1 type Hyper-V Manager
Click on it,
a window like attached screenshot open,
#2 Select MobilinuxVM(normally same name if running windows docker)
#3 Right click and open - Setting
2 The second window will open(setting for MobiLinux) i.e to the screenshot.
#4 Go to Memory Tab in left Pane.
#5 click on a dynamic checkbox and set minimum value to some lower amount say 512, and max value to the desired one,
#6 apply
now it will start running as well after few minutes take the amount it required as well.
It is not the problem of RAM. It is the allocated disk memory to docker.
It means there is not enough space for docker to create an image or any other docker related operations.
Open the docker settings >> advanced >> disk image max size
Increase this size and apply the changes.
It will restart automatically and then you're good to go.
In Settings, I did a reset to factory defaults.
And restarted the laptop.
It Worked for me
Posting what worked for me:
Open Resources settings in docker
Set memory to lowest setting, in my case 1024MB
Open Task manager, verify that I've at least the memory I specified above free
Restart docker, switch to linux containers
In my case this worked because I was using almost all of my RAM with VScode and firefox, so closed them and tried and it worked
Have you enabled NUMA spanning in your HyperV settings? if not enable it i bet that will solve your issue.
By default, Windows Server enables NUMA spanning, which provides the most flexibility as virtual machines (VMs) can access and use memory in any NUMA node. But it may result in lower performance compared to forcing VMs to use memory on the same NUMA node as the processor cores.
By disabling NUMA spanning, you ensure that VMs use memory and processor cores in the same NUMA node, giving the best performance.
This should only be changed once, if, as an administrator, you feel comfortable with NUMA and the implications of disabling and also if you have some additional management suite that can help ensure best configuration.
To configure NUMA spanning, open the Hyper-V Settings and select the NUMA Spanning option and disable it, I am sure, it will get solved; I struggled with the issue for a week and resolved it by disabling NUMA.
I am sure this would be marked as resolved by disabling NUMA in Hyper-V Manager.
I lowered my memory and swap to the lowest it would go as well as the disk image size to 32gb and it finally started without switching to windows containers or having to reboot.
To fix this issue, you need (but firstly see Note #4 below):
Back up the DockerDesktopVM virtual drive
To find this path, open Hyper-V manager and Open setting of DockerDesktopVM, and find path. Usually it exists in vm-data folder in DockerDesktop ProgramData folder.
Switch to Windows containers via tray icon
Usually this file is locked. To unlock it, for me works, turning of all services with name Hyper-V and with name docker: Docker and Docker Desctop. Also, Docker Desctop UI should be turned off via tray icon right click on it.
Back up the file DockerDesktopVM !!!
When the file DockerDesktopVM was back up, so all folder vm-data with this file maybe deleted (be aware and careful this file contains all your containers and images.)
Starts all services back and run docker desktop UI.
Switch back to Linux containers
At this moment you will see the settings in DockerDesktop UI and new file was created in vm-data folder with name DockerDesktopVM
Stop the all services again and replace the new file DockerDesktopVM with your old file which was backed up at the step 5.
Start all services and Docker Desktop UI.
Note #1: most of difficulties ware with locked file DockerDesktopVM. Reboot is not required during manipulations with locked file. Updated: This file maybe acidentially attached as a disk to the host system. So, you need diskmgmt.msc on the host server. The disk was listed there, right click and choose detach. It prompts for confirmation that you have the correct file. At that point, process explorer confirms that the file is no longer open by pid 4 (nt kernel & system) and I am able to work freely with the .vhdx file. Updated 2: Or you need to run command net stop vmms. Manipulate with file and start the vmms back with command net stop vmms (origin https://community.spiceworks.com/topic/603713-solved-vhdx-can-t-be-deleted) Update 3: Anyway the vhdx file maybe locked due to VM is still running or hang. To determine this you can open vhdx file permission and see in the list of user one user with strange name similar to GUID - this is NT VIRTUAL MACHINE{GUID}. So, this is a virtual user under which your VM's process is running in windows. Then you can find the process vmwp.exe under this user in Taskmanager -> Details. Another way, you can find this process from Process Explorer latest version in Find Handler or DLL section by a search keyword 'vhdx'. You need to kill this process! After that, the vhdx file will be unlocked.
Note #2: If you backed up your DockerDesktopVM.vhdx file, so you can probably reset Docker to default for instance after step 7, or just reinstall the Docker Desktop
Note #3: Sometimes DockerDesktopVM.vhdx will be unlocked when it was deleted from Hyper-V Mager UI
Note #4: If your docker was able to start with wrong settings some how, but now it does not able to start. So, probably, you can try to avoid all manipulations above and just close all applications which consume a lot of memory, like chrome. And, try start docker again.
But the core idea run Docker with fresh DockerDesktopVM file and replace it with the old one after when settings UI will be unlocked.
I have also the same problem. Maybe you have other virtual machine in Hyper-v, other Virtual machin need memory too. please stop all other Hyper-v Virtual machine and test again. for me worked
My Hyper-v Manager
When I experienced this problem I modified the PowerShell script MobyLinux.ps1 found in the resources folder on the Docker install in C:\Program Files\Docker\Docker\resources. Essentially I forced the values for the $CPUs to 2 and the $Memory to 512, which worked for my dev box's limited resources!
At this point when Docker drops the MobyLinuxVM instance in Hyper-V and re-creates it from the PowerShell script it now uses my values:
This time the VM remains up and stable, and Docker successfully switches from the Windows Containers to the Linux Containers:
Hope this helps someone.
Issue resolved after just restarting the PC -_-. Dont know what is that.
So to begin with I normally start off with opening Visual Studio Code then my terminal and finally Docker Desktop WSL2. The problem being is that Visual Studio Code is a chunky memory hogger and initially requires a lot of memory to run. Especially if you used the integrated terminal, multiple tabs, and ultimately multiple windows.
When I open Docker Desktop last it gives me not enough resources error. After a little messing and testing, I found out that Docker initially needs to load first because it needs to obtain a certain amount of memory for your containers and images to run. So starting Docker Desktop manually, not on windows startup, then your other programs and tools should, I am saying should as everyone's environment and problems are different from mine and I am not expecting them to be the same, work fine.
So here are the steps:
On opening your computer, mine is Windows 10 using WSL2 with Home, do not immediately have Docker open on startup. Instead, run the program manually by double-clicking the icon or searching in your start menu and clicking on Docker Desktop.
Next, we then want to open Windows Visual Studio Code and other programs after that.
Before running any commands, as I do run them through node js with specific package.json defined commands, check docker desktop as sometimes your containers and images are already running and therefore shouldn't need to run any commands to bring them up again.
If all this fails try going into your settings and allocating specific memory. Check your task manager processes and see what is taking up all of your resources. I hope this helps. Again everyone's environment is not the same so do not expect similar results as I have had. This SHOULD work doesn't mean it will. Read the documentation as well as it does help with identifying problems faster.
Just follow the step:
Go to Troubleshoot in the Docker dashboard.
Click on Clean/Purge data.
Select all options and press delete.
It takes a few minutes.
(that's work for me)
I had the same problem. In my case I had another VM running on Hyper-V that was consuming all the resources. Even after system restart the VM was always active. I opened Hyper-V Administrator and deactivated the problematic VM. Then I could start Docker properly.
My Windows 10 Laptop has 8 GB of RAM. I also use virtual memory.
When i start my OS and immediately run some RAM hungry applications, I can't start Docker until i stop most of the applications.
Yet: https://stackoverflow.com/a/45816385/7082956 helped me as well.
This may happen because the ram is not free at the time you starting docker
I had opened 20 tabs of the browser, that leads to no free ram so I closed all the tabs refresh the computer several times, and tried restarting once again and it works for me
I have faced same issue: Docker out of memory in windows.
I have solved issue, by following three steps.
1. Quit Docker Desktop by clicking mouse right button.
2. Now run Docker Desktop as Administrator.
3. Now restart your windows system.
Now Docker will work properly. This solution has worked for me. :)
Problem:
Installed Docker Desktop.
Got Out of Memory error upon starting with linux instance.
Details:
OS: Windows 10 Professional
Host: Lenovo ThinkPad Carbon X1, 4GB RAM
Docker Desktop: Version 2.1.0.1 (37199)
Docker advanced settings:
CPUs: 2
Memory: 2048MB (this is the maximum)
Swap: 2048MB
Disk Image Size: 59.6GB (4MB used)
Hyper-V settings for DockerDesktopVM:
Settings > Memory > RAM: 2048MB (tried to increase to 4096; still doesn't work)
Settings > Memory > Enable Dynamic Memory (checked/un-checked; both doesn't work)
Under variations of the above settings, Docker Desktop gives this error when starting/ re-starting:
Not enough memory to start Docker Desktop
You are trying to start Docker Desktop but you don't have enough memory.
Free some memory or change your settings.
The problem resolutions reported in the following links, e.g. starting with Windows instance, then switching back to Linux, don't work for me, regardless of how much memory I allocate via Hyper-V or Docker settings.
It is utterly frustrating because apparently people are reporting being able to start with linux instances on host machines with 4GB of RAM. So I wonder what I am doing wrong.
Resources researched/ tried:
https://forums.docker.com/t/not-enough-memory-to-start-docker/13512/24
Docker won't start on Windows: Not Enough memory to start docker
Questions:
Can I even run Docker Desktop with linux instance on my host machine?
If (1) is yes, then what settings will allow me to do this?

Unload a minifilter driver with no unload routine?

This is probably a pretty easy question to answer for someone that is experienced with FS minifilters. I am trying to script the removal of a filter driver and device.
Some background... this driver is running on Windows 8/10 x64. The vendor that created the driver has not been helpful in fulfilling my request for a removal tool. Unfortunately their MSI uninstall is buggy and only works about half the time you run it... They want us to upgrade to their newest version that doesn't have the bug we are encountering during uninstallation. We aren't interested in continuing use of this software so a paid upgrade seems frivolous... Their only suggestion has been to reimage the computers without the software that includes the FS minifilter device... That's out of the questions because it is on 1000+ computers...
Basically, their official uninstaller does an API callback to one of their servers and verifies the machines eligibility to uninstall:
Does the MAC address of the primary network adapter exist in their
database?
Does the password you entered for uninstallation match
what is set in their database?
If you are eligible, it runs an MSI uninstallation and disables the FS filter, removes the driver file, service files, configuration, and restarts... The bug that is keeping us from doing a normal bulk removal (their way) is that the MSI freezes during the removal process (after checking eligibility) and requires us to restart a client computer up to 3 times to finish the uninstall.
I have been able to successfully remove the software and device/driver by externally mounting the Windows file system and manually removing the driver file under System32/Drivers and also removing all of the actual program files/services. I have not been able to do this booted onto the same partition where the minifilter is loaded. The minifilter driver that is running is protecting those program files, a registry key, and the actual .sys file under System32...
I've done some basic reverse engineering of their MSI... They are using custom actions to perform the removal... First step is the removal of the service, second step is the removal of the minifilter. Both actions are done via an executable that is packaged in the MSI... I've extracted that and attempted to use it by running the same commands that they do during the MSI... I haven't had any luck. The minifilter just doesn't want to die.
They have some other custom actions that are loaded via DLL. Initial investigation makes me think its all of their custom uninstall eligibility craziness.
It looks like their minifilter doesn't have an unload routine built in. Using FLTMC I get this error attempting to detach and/or unload:
0x801f0010 Do not detach the filter from the volume at this time.
0x801f0014 Do not detach the filter from the volume at this time.
Does anyone know of a good way to unload a minifilter that is throwing those errors?
Try to kick out FltMgr.sys of the kernel by:
Renaming %SystemRoot%\sytem32\drivers\FltMgr.sys
Or changing HKLM\SYSTEM\CurrentControlSet\Services\FltMgr\Type to 0x4 (Disabled)
Reboot
Minifilters can't work without Filter Manager.
If you are desperate enough, look into Windows PE, available as part of the Windows Assessment and Deployment Kit.
A Windows PE image can be remotely installed onto a machine's hard disk and configured to perform whatever task you need done and then automatically reboot back into the original operating system. Doing it this way gives you the same access as externally mounting the infected file system, but can be automated. I've used this approach in the past to automate offline maintenance tasks on several hundred machines (e.g., changing a registry setting that Symantec Endpoint Protection was "protecting") and while getting it working is fiddly, once it is working it works well.
My email address is in my profile, you're welcome to contact me if you decide on this approach and have questions about implementing it.
Alternatively, depending on your jurisdiction and circumstances, you might want to consider threatening the vendor with a lawsuit if they refuse to provide a proper solution. They broke your computers, it should be their job to fix it. From the sounds of it, they wouldn't even need to do any work, just let you have the upgraded version for a few weeks free of charge.

Unable to start applications from network "0xc0000006"

I can't start applications from a network share or drive. An error Appears saying that the application was unable to start 0xc0000006. If I copy the .exe on my desktop it works fine.
I tried to start Windows in safe mode and it works too.
My machine run on an HP laptop core i5 with Windows 7 SP1.
Any idea?
EDIT:
I found my problem: It's a bug that append sometimes with Kaspersky endpoint Security v.10. I just uninstall this version and install an older version (v.8). I hate Kaspersky...
Hope it will help someone!
0xc0000006 is an NTSTATUS code. Specifically it is STATUS_IN_PAGE_ERROR.
It is not uncommon to see these errors when you attempt to run an executable from a network volume. For whatever reason, if there is any even intermittent problem accessing the network volume, then you may see this error. When a module is loaded, the code is not physically loaded until it is needed. A memory mapped file is created, and when a particular page is needed, it is brought into physical memory on demand. If your network fails to meet this demand, your application stops with STATUS_IN_PAGE_ERROR.
The common ways to deal with this include:
Getting a more robust connection to your network volumes.
Copying the executable file to a local drive and running it from there.
Adding the IMAGE_FILE_NET_RUN_FROM_SWAP flag to your PE file options.
Thank you for your replies.
I solved the problem by uninstalling Kaspersky end point 10.
My colleges have the version 10 of kasperky and it works but not for me.
I will install an older version waiting for kaspersky v 11.

Resources