Jump to content
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble

MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, register and become a site sponsor/subscriber and ads will be disabled automatically. 


Sign in to follow this  
UCyborg

Memory leaks

Recommended Posts

Posted (edited)

If I don't fully shut down Windows every day, I notice in Task Manager that the Paged pool under Memory on Performance tab increases by approximately 10 MB every day. It was similar on Windows 8.1 (a bit worse actually) and just logging off didn't clear it up. I don't know about Windows 7 and earlier because I haven't kept them up for more than a day.

PC is hibernated at night (and most of the day actually, I mostly use it in the evening).

I got some results from poolmon.exe - was following the instructions I found on superuser. So I don't find CM16 tag in any of the driver files, so it must be Windows (ntoskrnl.exe? - findstr did pick it up when scanning System32 folder).

tKwB3sm.png

Ntfx tag scores the top place when it comes to non-paged memory, this one belongs ntfs.sys - MS driver dealing with NTFS file system I suppose. Non-paged memory pool is increasing over time as well, just at the slower pace.

Is the thing just buggy or could there be something else causing the issue?

Edited by UCyborg
Typo

Share this post


Link to post
Share on other sites

In this other, but similar, thread on superuser, there is a screenshot of xperf analysis screen showing where CM31 tag can be seen. Perhaps if you could get to that screen you could find out more about what is using that tag.

https://superuser.com/questions/1269549/memory-usage-doesnt-add-up-in-windows-10

In that is a post linked by our old friend magicandre, who posts the full instructions for those wanting to play at home:

https://superuser.com/questions/949244/windows-10-high-memory-usage-unknown-reason/949246#949246

Share this post


Link to post
Share on other sites
Posted (edited)

WPA doesn't show any stack under CM16 tag, just n/a.

10 MB per day may not be the most exact number though. Paged pool at 807 MB now after 97 days. If I remember correctly, non-paged pool starts at about 110 MB - 130 MB (now at about 260 MB).

Edited by UCyborg
Forgot about current non-paged pool

Share this post


Link to post
Share on other sites

I wonder how exactly the program works. As I know that Explorer can have little information about things the were originally executed before it, and such "ghosts" can be seen with other programs like Process Explorer. Is it also possible that Session isolation is being a problem? Is whatever is running with CM16 in Session 0 and that is the reason why you can't see anything beyond that it exists?

Share this post


Link to post
Share on other sites

Oh well, I guess a reboot might inevitable, even though it's just a workaround. I found this text:

Quote

Private Bytes refers to the amount of Page file space that is allocated to the process (not necessarily used) in the event that the process's private memory footprint is completely paged out to swap. most of the time, the process is not entirely (or at all) page-file resident, so that's why private bytes appears to have "room" for further allocation. It is not however the case.

Private bytes however only refers to the processes private memory, so this value may not reflect shared resources (even if the shared resource is only used by this process at present).

If I sort processes by Private bytes value in Process Hacker, when it comes to background processes, Windows Update service scores the top place with 148,45 MB. Now that's a waste considering my group policy setting for keeping automatic updates disabled. I suspect that can't be all.

Share this post


Link to post
Share on other sites

I have a desktop board that can use both non ecc and ecc ram i'm wondering if there would be an improvement in leakage with ECC ram

Share this post


Link to post
Share on other sites

From my understanding, I don't think ECC has anything to do with it. A memory leak is a software fault.

Share this post


Link to post
Share on other sites
Posted (edited)

So a reboot back then also helped with another minor issue that occurred; the network status icon didn't always update to reflect the actual internet connectivity status.

Another thing worth mentioning, there is significant difference between Task Manager's Paged pool and Process Hacker's Usage column as shown if you open Tools->Pagefiles. The value in Process Hacker is much lower (right now it's 250 MB vs 58,8 MB). Maybe Task Manager takes some variable into account that Process Hacker doesn't. Any ideas?

I wasn't observing the Paged pool in the past, but pagefile usage as shown in Process Hacker stays much lower with regular usage than it did with Windows 7 and 8.1. The difference is some hundred megabytes. And it shows when running things that need more memory. Windows 10 doesn't seem to have the urge to immediately page out whatever data hasn't been accessed in a while.

Edited by UCyborg

Share this post


Link to post
Share on other sites

Is it possible that the tool with the lower value is being limited? Perhaps by session, such as only being able to see session >0 ?

Share this post


Link to post
Share on other sites

Paged pool is the total amount of kernel memory that may be swapped out when needed, so Process Hacker does show the actual amount of data that's in the page file.

You get the same numbers (rounded) if you type the following into PowerShell:

Get-CimInstance Win32_PageFileUsage | Select-Object Name,CurrentUsage,PeakUsage,AllocatedBaseSize

Pushing the Limits of Windows: Paged and Nonpaged Pool mentions the biggest consumer of the paged pool is registry. I did actually notice that with longer uptimes searching through registry using Windows' Registry Editor becomes impossible as it takes forever to find anything.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...