![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
172 questions
Hello
Thank you for posting in Microsoft Community.
Event ID 906 is an error related to LSASS (Local Security Authority Subsystem Service). It usually indicates that part of the system cached data is written to the paging file, which may affect system performance. This is usually caused by insufficient memory or stress on the system when processing large amounts of data.
Analysis of key points of errors:
Part of the database buffer cache has been written out to the system paging file: This indicates that the system's memory pressure is very high, and the cached data must be written to the paging file on the hard disk to free up memory. This situation can lead to reduced system performance and even delays in applications or services.
Cache Residency Status: This is a report on the memory usage of the cache, showing the residency ratio of the system cache. You can see that previously 64% of the cache resided in memory, but now only 15% is retained in memory, indicating that most of the data is written to the hard drive rather than residing in physical memory. This can cause significant performance degradation.
Physical memory/RAM size: The system only has 8GB of physical memory. If the system load is high, or there are many applications running at the same time, the memory may not be enough, causing the system to swap memory data to the hard disk.
Possible causes and solutions:
Out of memory:
If the system has insufficient memory, especially if the physical memory is small (such as 8GB), it may cause cache data to be written to the paging file. This can significantly impact performance. You can consider increasing physical memory or optimizing the system's memory usage.
Memory leaks or high memory consumption processes:
Check if there are some processes or services that are consuming a lot of memory, causing the system to run out of memory. You can use Task Manager or Performance Monitor (perfmon) to see which processes are consuming a lot of memory.
The LSASS process itself is abnormal:
LSASS is a core system process related to security and authentication. If the process encounters problems during execution (such as memory leaks, frequent database operations, etc.), it may cause a large amount of data to be cached. Check the logs for exceptions related to LSASS, or view further error details in Event Viewer.
Paging file settings problem:
If the paging file is not the right size, it may prevent the system from writing data to the hard drive efficiently when more virtual memory is needed. You can check and adjust the paging file settings to make sure it has enough space to handle memory requirements. It is recommended to set a system-managed size or manually adjust the size of the paging file.
Hardware issues:
If the server or workstation's hardware fails (such as a damaged memory module, disk I/O issues, etc.), it may result in insufficient memory or failed cache writes. Consider running hardware diagnostic tools to troubleshoot hardware problems.
I hope the above information is helpful to you.
Best regards
Runjie Zhai