Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

SpeedCam · Post by **SpeedCam** » Tue Mar 31, 2020 7:04 am

Looking back in my event log it appears Blue Iris has been repeatedly crashing on me since about version 5.1.0.1
I don't have any memory dumps captured yet but can configure AeDebug to do so.

Relatedly BlueIris appears to have a memory leak as normally I expect my BI instance to take up ~2-3GB in RAM but here's it 18+ GB and it's about to hit my VM's memory limit and crash--

: 20200330 - Blue Iris memory leak.png (41.34 KiB) Viewed 11720 times

I have 9 cameras configured of various types. Host is a virtual machine running Windows 7 (7601, SP1). Aside from the memory leak and the crashing BI is otherwise running okay for me, triggering recordings on camera events, UI3 web access, etc.

I should probably open a support request but is anyone else seeing this?

balham · Post by **balham** » Tue Mar 31, 2020 3:44 pm

We posted more or less at the same time - see "console can’t connect to process error - v5.2.3.2" https://blueirissoftware.com/forum/view ... f=4&t=1108.

I have a problem with BI intermittently crashing and, in common with you, ntdll.dll seems to be the problem. However, I'm not seeing any memory leak problem.

I have six cameras with a dedicated Dell desktop Inspiron PC with 8GB memory.

In Windows Event Viewer, the message is:
Faulting application name: BlueIrisService.exe, version: 1.0.0.1, time stamp: 0x5e7d3b1b
Faulting module name: ntdll.dll, version: 10.0.18362.719, time stamp: 0x64d10ee0
Exception code: 0xc0000005
Fault offset: 0x0000000000028e86
Faulting process ID: 0x570
Faulting application start time: 0x01d607324f6c1208
Faulting application path: C:\Program Files\Blue Iris 5\BlueIrisService.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report ID: b0831cd7-c554-4e79-8b14-40c3d30f33c8
Faulting package full name:
Faulting package-relative application

SpeedCam · Post by **SpeedCam** » Wed Apr 01, 2020 7:06 pm

I've been accumulating dumps now with the following Windows Registry settings:

Code: Select all

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\blueiris.exe]
"DumpFolder"="C:\\crashDumps"
"DumpType"=dword:00000001
"DumpCount"=dword:00000010

My latest crash (which I do have a .dmp of) has a different failure now in vcruntime140.dll:

Code: Select all

Faulting application name: BlueIris.exe, version: 5.2.4.1, time stamp: 0x5e83f73b
Faulting module name: VCRUNTIME140.dll, version: 14.21.27702.2, time stamp: 0x5ccadaa9
Exception code: 0xc0000005
Fault offset: 0x0000000000001490
Faulting process id: 0x1310
Faulting application start time: 0x01d6080482500dda
Faulting application path: C:\Program Files\Blue Iris 5\BlueIris.exe
Faulting module path: C:\Windows\system32\VCRUNTIME140.dll
Report Id: f39e735b-742c-11ea-aa26-00155d001800

But a crash last night (which I don't have a .dmp of) involved ntdll.dll:

Code: Select all

Faulting application name: BlueIris.exe, version: 5.2.3.2, time stamp: 0x5e80ca52
Faulting module name: ntdll.dll, version: 6.1.7601.24545, time stamp: 0x5e0eb67f
Exception code: 0xc0000005
Fault offset: 0x0000000000032ad4
Faulting process id: 0x11cc
Faulting application start time: 0x01d60798a28ebfc1
Faulting application path: C:\Program Files\Blue Iris 5\BlueIris.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: b800f6fa-73d0-11ea-aa26-00155d001800

Without breaking open the dump the access violation exception code 0xc0000005 indicates some sort of memory read issue. Because my install still has the symptoms of a memory leak I'm assuming the two are related. I've had to get a PowerShell script monitoring and restarting the service as after it dies due to memory exhaustion it doesn't start back up again.

Serodgers · Post by **Serodgers** » Fri Apr 03, 2020 2:52 am

I had a similar problem of constant crashing in ntdll. Did not appear to be memory leak related but found when I shut down a old Ipad2 with ios 9.3.5 and BL ios app ver 1.63.00 all crashes stopped.

I had previously reloaded clean copy of win10 and BI 5 latest. Crashes only stopped when i shut down the 24/7 Ipad used as a monitor station.

Now I use UI3.

Sent from my iPad using Tapatalk

miles267 · Post by **miles267** » Sun May 31, 2020 11:08 pm

After much troubleshooting I’ve confirmed that Blue Iris x64 v5 is causing a memory leak with ntdll.dll in Windows Server 2012 R2. Am unable to complete a Windows Server Backup without the Block Level Backup Engine stopping consistently. With BI5 5.2.9.6 installed, wbengine.exe causes a fault in ntdll.dll. Immediately after uninstalling BI5 and the Visual C++ x86 package, the issue is resolved. I’ve spent a couple weeks troubleshooting until I was finally able to pinpoint the root cause.

Would be glad to provide any logs or help test any new app updates that address this ntdll.dll memory leak.

Sent from my iPhone using Tapatalk

Thixotropic · Post by **Thixotropic** » Mon Jun 01, 2020 2:52 am

miles267 wrote: ↑Sun May 31, 2020 11:08 pm Would be glad to provide any logs or help test any new app updates that address this ntdll.dll memory leak.

I think this is definitely a case where you'll want to contact the official support team. There's a button in the Settings - About tab labeled "Email Support". Copy the info it puts on the clipboard into an email and send it to the support address.

miles267 · Post by **miles267** » Mon Jun 01, 2020 2:59 am

Thanks for guidance. Apologies, this is my first support case.

Thixotropic · Post by **Thixotropic** » Mon Jun 01, 2020 11:18 pm

Glad to help. If you could share what support says or how this is resolved, that would be great.

Matts1984 · Post by **Matts1984** » Tue Jun 02, 2020 12:15 pm

I just posted in the other thread related to this but I'm wondering about the correlation of the older Windows editions and BI. This thread highlights Win7 and the other Server 2012 R2. While R2 is in "extended support", mainstream support has ended for both. I believe most users on this forum utilize Windows 10 and I myself am on Server 2019 and to my knowledge, aren't experiencing any memory leak issues.

Yes this probably can and should be mitigated through BI updates, as long as it's not to a detriment to the product, but it might be time to update the OS too.

miles267 · Post by **miles267** » Tue Jun 02, 2020 12:43 pm

I’m about to deploy a HPE Gen10 Plus box with a Xeon E-2224 without Intel Quicksync. It will run Windows Server 2019 Standard. Not sure how well BI5 will do without Intel integrates graphics on CPU but assuming it won’t be an issue, that will be my migration path.

Sent from my iPhone using Tapatalk

Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

Re: Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

Re: Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

Re: Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

Re: Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

Re: Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

Re: Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

Re: Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

Re: Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll

Re: Memory leak and 5.2.3.2 repeatedly crashing in ntdll.dll