Here is the extract portion of WideCap log (just before crash): [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Starting lookup from C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Something was found: C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Aha, found the base provider: %SystemRoot%\system32\mswsock.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32]WSASocket (tcp) = 62552 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Adding tcp socket to the hook table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Connecting to (61.152.108.49:10051)... [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Connecting #2 6FE341C4 0 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Socket in blocking mode, have to complete connection now [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Closing socket 60988 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Close socket [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Deletion [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [PROXY] [proxy32][62552] Removing socket from our table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Starting lookup from C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Something was found: C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Aha, found the base provider: %SystemRoot%\system32\mswsock.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32]WSASocket (tcp) = 60988 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Adding tcp socket to the hook table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Connecting to (61.152.108.49:10051)... [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Connecting #2 6FE341C4 0 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Socket in blocking mode, have to complete connection now [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Closing socket 64524 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Close socket [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Deletion [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [PROXY] [proxy32][60988] Removing socket from our table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Starting lookup from C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Something was found: C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Aha, found the base provider: %SystemRoot%\system32\mswsock.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32]WSASocket (tcp) = 64524 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Adding tcp socket to the hook table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Connecting to (61.152.108.49:10051)... [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Connecting #2 6FE341C4 0 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Socket in blocking mode, have to complete connection now [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Closing socket 62552 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Close socket [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Deletion [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [PROXY] [proxy32][64524] Removing socket from our table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Starting lookup from C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Something was found: C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Aha, found the base provider: %SystemRoot%\system32\mswsock.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32]WSASocket (tcp) = 62552 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Adding tcp socket to the hook table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Connecting to (61.152.108.49:10051)... [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Connecting #2 6FE341C4 0 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Socket in blocking mode, have to complete connection now [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Closing socket 60988 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Close socket [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Deletion [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [PROXY] [proxy32][62552] Removing socket from our table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Starting lookup from C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Something was found: C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Aha, found the base provider: %SystemRoot%\system32\mswsock.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32]WSASocket (tcp) = 60988 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Adding tcp socket to the hook table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Connecting to (61.152.108.49:10051)... [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Connecting #2 6FE341C4 0 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Socket in blocking mode, have to complete connection now [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Closing socket 64524 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Close socket [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Deletion [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [PROXY] [proxy32][60988] Removing socket from our table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Starting lookup from C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Something was found: C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Aha, found the base provider: %SystemRoot%\system32\mswsock.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32]WSASocket (tcp) = 64524 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Adding tcp socket to the hook table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Connecting to (61.152.108.49:10051)... [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Connecting #2 6FE341C4 0 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Socket in blocking mode, have to complete connection now [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Closing socket 62552 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Close socket [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][64524] Deletion [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [PROXY] [proxy32][64524] Removing socket from our table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Starting lookup from C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Something was found: C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Aha, found the base provider: %SystemRoot%\system32\mswsock.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32]WSASocket (tcp) = 62552 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Adding tcp socket to the hook table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Connecting to (61.152.108.49:10051)... [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Connecting #2 6FE341C4 0 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Socket in blocking mode, have to complete connection now [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Closing socket 60988 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Close socket [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][62552] Deletion [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [PROXY] [proxy32][62552] Removing socket from our table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Starting lookup from C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Something was found: C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Aha, found the base provider: %SystemRoot%\system32\mswsock.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32]WSASocket (tcp) = 60988 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Adding tcp socket to the hook table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Connecting to (61.152.108.49:10051)... [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Connecting #2 6FE341C4 0 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Socket in blocking mode, have to complete connection now [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] Closing socket 64524 [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Close socket [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [CONN] [proxy32][60988] Deletion [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:19 [PROXY] [proxy32][60988] Removing socket from our table [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:20 [CONN] Starting lookup from C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:20 [CONN] Something was found: C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:20 [CONN] Aha, found the base provider: %SystemRoot%\system32\mswsock.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:20 [ERROR] Unknown location Out of memory [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:20 [ERROR] Unknown location Out of memory [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:20 [CONN] Starting lookup from C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:20 [CONN] Something was found: C:\Program Files (x86)\WideCap\widecapdrv.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:20 [CONN] Aha, found the base provider: %SystemRoot%\system32\mswsock.dll [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:20 [ERROR] Unknown location Out of memory [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:20 [ERROR] Unknown location Out of memory [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:21 [ERROR] Unknown location Out of memory [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:21 [ERROR] Unknown location Out of memory An exception was occured: Out of memory[zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:21 [ERROR] Unknown location Out of memory [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:21 [ERROR] Unknown location Out of memory [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:21 [ERROR] Unknown location Out of memory [zabbix_agentd.exe] (10944) 11-Aug-2012 20:52:21 [ERROR] Unknown location Out of memory Here is the extract portion of zabbix agent log (just before crash): 5692:20120811:204429.623 Active check [db_data_file_size] is not supported. Disabled. 5692:20120811:204429.623 Active check [db_log_file_size] is not supported. Disabled. 5692:20120811:204429.623 Active check [net.if.collisions[0.0.0.0,bytes]] is not supported. Disabled. 5692:20120811:204429.639 Active check [net.if.in[0.0.0.0,bytes]] is not supported. Disabled. 5692:20120811:204429.655 Active check [net.if.out[0.0.0.0,bytes]] is not supported. Disabled. 5692:20120811:204429.655 Active check [net.if.tota[0.0.0.0,bytes]] is not supported. Disabled. 5692:20120811:204429.655 Active check [NetAllInt0] is not supported. Disabled. 5692:20120811:204429.670 Active check [NetOutInt0] is not supported. Disabled. 5692:20120811:204429.670 Active check [perf_counter["\ASP.NET Applications(__Total__)\Errors Total"]] is not supported. Disabled. 5692:20120811:204429.670 Active check [perf_counter["\ASP.NET Applications(__Total__)\Pipeline Instance Count"]] is not supported. Disabled. 5692:20120811:204429.670 Active check [perf_counter["\ASP.NET Applications(__Total__)\Requests/Sec"]] is not supported. Disabled. 5692:20120811:204429.670 Active check [perf_counter["\ASP.NET\Application Restarts"]] is not supported. Disabled. 5692:20120811:204429.670 Active check [perf_counter["\ASP.NET\Request Execution Time"]] is not supported. Disabled. 5692:20120811:204429.686 Active check [perf_counter["\ASP.NET\Requests Queued"]] is not supported. Disabled. 5692:20120811:204429.686 Active check [perf_counter["\ASP.NET\Worker Process Restarts"]] is not supported. Disabled. 5692:20120811:204429.686 Active check [perf_counter["\PhysicalDisk(Total)\Avg. Disk Queue Length"]] is not supported. Disabled. 5692:20120811:204429.686 Active check [perf_counter["\PhysicalDisk(_Total)\Avg. DiskQueue Length"]] is not supported. Disabled. 5692:20120811:204630.804 Active check [perf_counter["\SQLServer:Cache Manager(Total)\Cache Hit Ratio"]] is not supported. Disabled. 5692:20120811:204630.804 Active check [perf_counter["\SQLServer:Locks(Total)\Average Wait Time (ms)"]] is not supported. Disabled. 5692:20120811:204630.804 Active check [perf_counter["\SQLServer:Locks(Total)\Lock Requests/sec"]] is not supported. Disabled. 5692:20120811:204630.804 Active check [perf_counter["\SQLServer:Locks(Total)\Lock Wait Time (ms)"]] is not supported. Disabled. 5692:20120811:204630.820 Active check [perf_counter["\Web Service(_Total)\Current Connections"]] is not supported. Disabled. 5692:20120811:204630.820 Active check [proc_cnt[httpd]] is not supported. Disabled. 5692:20120811:204630.820 Active check [status] is not supported. Disabled. 5692:20120811:204630.820 Active check [system.cpu.intr] is not supported. Disabled. 5692:20120811:204630.820 Active check [system.cpu.util[,iowait,avg1]] is not supported. Disabled. 5692:20120811:204630.820 Active check [system.cpu.util[,user,avg1]] is not supported. Disabled. 5692:20120811:204630.820 Active check [system.cpu.util[ <,type> <,mode>]] is not supported. Disabled. 5692:20120811:204630.820 Active check [system[procrunning]] is not supported. Disabled. 5692:20120811:204630.836 Active check [vfs.file.cksum[c:\autoexec.bat]] is not supported. Disabled. 5692:20120811:204630.836 Active check [vfs.file.cksum[c:\config.sys]] is not supported. Disabled. 5692:20120811:204630.836 Active check [vfs.file.size[c:\msdos.sys]] is not supported. Disabled. 5692:20120811:204630.836 Active check [web.page.regexp[host,,,,]] is not supported. Disabled.