Memory leak

[mara-]

Hi,

It seems that I have a memory leak in my Vista Sp2 (fully updated). I had the same problem in Windows 7, but I'm back on Vista since not all applications I use are 7 ready. Anyway, back to the problem. Memory leak is very strange. It lasts very long. After maybe 6-8 hours it will eat 1 or 1,2 GB of RAM and it will continue to eat it. The strange thing is that in Task Manger there is no anything using that amount of RAM. There is only some svchost.exe which is using 60MB and all others are under. For troubleshooting purpose I disabled SuperFetch, but problem is still there. I did a full scan with Eset Smart Security, Malwarebytes' Anti-Malware and Super Antispyware. System is clean. I have all latest drivers installed. Yesterday I left my computer on for all day, and I went out. When I was back I sow blue screen with message "IRQL Not LESS Or Equal", but unfortunately I did not wrote down other details and I can't find anything in Event Viewer. So I suspect that maybe some driver is causing this but I can't figure which. It also strange because I had same problem on Seven, so it's probably driver from same manufacturer. Also, when computer is down to 900MB free of RAM I can notice degradation in performance, and only way to restore RAM is to reboot, where everything starts again. My systems configuration is in my signature.

Now, I would need help to discover what is causing this leak. Thanks in advance.

Cheers

[Mr Snrub]

Where exactly are you seeing the evidence of this "leak"?

If you look in Task Manager on the Performance tab, under Physical Memory you are interested in the Available (not Free) figure - is this particularly low, caompred to Total?

[mara-]

Hm, there is no Available on the Performance tab. There is only Total, Cached, Free. Anyway here are screen shoots:

I see evidence of leak in Everest. Currently Everest is showing me that I have 760MB free and it's continuing slowly to leak. Also, look on the screen shots. Compare processes with Performance tab. There is no anything to take 2.25GB in total and to leave me with 760MB which will be less in few hours. Don't forget that SuperFetch is disabled, so I don't understand where all of that memory is going.

Cheers

[Mr Snrub]

Ah, sorry I was looking at my Win7 Task Manager and forgot it had the value Vista doesn't show.

Your memory is being used for the system file cache, this is normal - Superfetch is only PRE-populating the system cache based on usage patterns, so disabling it doesn't do anything except make load times longer for frequently-used apps following a reboot.

Having memory used for cache is a positive thing (I never disable Superfetch except in VMs for test environments).

Mark Russinovich wrote about the Vista kernel changes here:

http://technet.microsoft.com/en-us/magazin...istakernel.aspx

The trend that Superfetch shows is a gradual decrease in "Free" memory over time shortly after the system boots, but even with it disabled the memory manager still populates the system cache with large file copies, etc.

[mara-]

I still don't think this is normal. I have now only 200MB free. Even if it's SuperFetch I think it's to much. Any other suggestions? Is there some tool or something which will help me to trace this leak, and I'm 100% sure it's leak. I was Googling and I sow few people having the same problem but nobody got solution.

Cheers

Edited September 18, 2009 by mara-

[cluberti]

Well, then we'll need to see some perfmon data, as Task Manager isn't exactly accurate and doesn't show you what you'll need to know. Start > Perfmon to run perfmon, and then right-click on the "Performance Monitor" option in the left-hand pane and select "New > Data Collector Set".

Give the set a name, click Next twice, and then click Finish. Then, expand the "Data Collector Sets" node in the left-hand pane, expand "User Defined", click on the collector set name you created, then right-click the "System Monitor Log" entry in the right-hand pane and select "Properties". Click "Remove" to remove the default processor counter, then click "Add". Scroll up to and click on "Memory" under the "Available counters" listing, and then click the "Add >>" button. This should add the "Memory" object with a "*" underneath, to let you know that it is adding all counters. Click OK twice to save.

Reboot, log back in, and then re-open perfmon. Now, right-click the data collector set name in the left-hand pane (again, under "User Defined"), and click "Start" to start the data collector. Let it run until you see memory usage climb to unacceptable levels, then come back into perfmon and right-click the data collector set name and choose "Stop" to stop the log.

By default, the log will be stored in "%systemdrive%\PerfLogs\<user>\<data collector set name>\<filename>.blg". You can open the file with perfmon to look, or you can compress it and upload it somewhere and we can have a look (or, obviously, both).

[mara-]

OK, thanks for the help. I did everything in Perfmon and I'll start monitoring tomorrow, since it's late now, and it needs a couple of hours so leak takes almost all of my memory. I'm currently down to 160MB. Thanks again.

Cheers

[cluberti]

Great .

[Mr Snrub]

I noticed you have uTorrent running in the background - is this pretty much always the case?

And do you transfer large files, or maybe many smaller files at the same time?

It might be that the activity of torrent programs will cause file sections to be cached even when only tiny portions have been touched (Windows caches on logical file blocks, not disk blocks) - then if sections are scanned and/or used for seeding, they will remain in the cache.

Just a theory, but it might explain why the memory used isn't directly attributed to a process' virtual size.

[mara-]

Well, I'm downloading something, and uTorrent is always running. But I did not have this problem before, and I always used uTorrent on Vista. I'm also downloading some files using IDM. But, I still suspect on some driver. But to be sure, I'll upload the log of memory when I'm done with monitoring. I'm currently down to 600 MB. So, maybe in 2-3 hours I'll finish monitoring and upload the log.

Cheers

[mara-]

OK, I stopped monitoring when I was down to 350MB, but I'm afraid that I don't know what to look in the log. I uploaded the log file, so cluberti, please take a look, and if you discover what the problem could be please explain me how you discovered it. Thanks.

http://www.mediafire.com/?jxzmmzgeqth

Cheers

[Mr Snrub]

Look at Pool Nonpaged Bytes - it goes up linearly through the log, starting at 66,752,512 bytes (10:20:10) and ending at 1,243,217,920 bytes (18:27:49).

Take a look here for cluberti's instructions for creating a memory dump of the entire system:

http://www.msfn.org/board/creating-memory-dumps-t130004.html

Crash the system when the system performance drops.

Zip and upload the MEMORY.DMP somewhere and we can take a look at the pooltags to see what the nonpaged pool memory was being allocated for.

[mara-]

When you say to crash it you mean to try to force it to show blue screen or something else?

Cheers

[Mr Snrub]

Yup - the CTRL+SCROLL LOCK combination mentioned in the details in cluberti's post - basically you manually trigger a bugcheck (blue screen) in order to produce a memory dump of the system, then we can take a look in there with a debugger to find out where the nonpaged pool memory was being spent.

Once you've made the necessary registry changes and rebooted, it's best to test that it works as expected before you need it.

[mara-]

OK, thanks for the info. I'll do like you said, and I'll upload dump.

Cheers