none
Windows 7 General Memory Leak after long term usage.

    Question

  • My setup is q6600 cpu, asus p5k, 8gb ram, nvidea 8800 gt, two optical dvd drives, one 500gb harddrive, windows 7 64bit RC os.

    When i boot into windows 7 it initially uses about 1gb of ram. I usually leave my computer running for several days at a time. After using it for a few days, my ram usage is now triple what it was. I have no open applications, no processes running in the background and yet windows 7 is now using 3gb of ram. I've tried deleting all of the temporary internet files. Closing as many non essential processes that i can find in task manager helps a little but the ram usage is still excessive.

    My guess is that either some application is allocating memory but failing to deallocate memory, or there is some kind of cache which is suppose to speed up my applications but is just wasting my ram.

    This is day 3. Im going to continue to leave my computer on and sees if the ram usage worsens. If someone has some suggestions i'd be happy to try them, but i would prefer they not involve restarting my computer just yet.
    Sunday, June 07, 2009 5:26 PM

Answers

  • Hi Shroots,

    What's the point of having the RAM, if Windows will not use it?  Windows will use RAM for various things, such as system cache.  If there is demand for the memory at some point, Windows will use the memory being used for cache, for applications.

    If you truly suspect some kind of leak, add the "Memory (Private Working Set)" column to Task Manager's Processes tab, and sort it in descending order.  What processes are at the top, and what is the value of the referenced column?
    Monday, June 08, 2009 12:01 AM
  • It sounds like a healthy amount of RAM is being used for system cache - that is to be expected.

    The only abnormal process in Process explorer is one of the svchost.exe. Its currently at 85000K in private bytes
    That is not uncommon, from my experience.
    but before my major crash it was around 250000K.
    As in, 250 MB? That sounds slightly concerning, but occasionally I can certainly imagine that the private bytes could vary substantially. Watch the value over time (perhaps, check out PE's Private Bytes History graph).
    If it helps dwm.exe is attached to the svchost in process explorer as below:
    That confirms the specific svchost.exe instance is the one I am thinking about. :-)
    • Marked as answer by axfelix Thursday, June 18, 2009 8:29 PM
    Tuesday, June 16, 2009 11:01 PM
  • The commit charge is ~2.8 GB; phys mem use is 2.6 GB.

    Also - watch the paged pool values over time - see if it continues to grow seemingly unbounded (what are the values in another three days, provided you don't reboot)?

    Add the Private Bytes column to Process Explorer and sort it in descending order.  Can you post a screenshot of that (at least, the top 10 or so processes)?
    Monday, August 24, 2009 5:12 PM
  • Another hoop, if you don't mind - add the Working Set column, and sort it in descending order, and please post a screen shot (as well as another of the SI dialog, taken at the same time).
    Wednesday, August 26, 2009 9:32 AM

All replies

  • Have you tried ProcessExplorer and ProcessMonitor (both from sysinternals.com)? Both show more details of the running processes, what they do and which resources they are consuming, than Task Manager.
    Mobile AMD64 3000+, VIA Apollo K8T800 chipset, 1 G RAM, ATIRadeonMobility 9700, 20x DVDRW, C:XPSP3 (55G),D:WIN7 (25G),F:DATA (250G)
    Monday, June 08, 2009 12:00 AM
  • Hi Shroots,

    What's the point of having the RAM, if Windows will not use it?  Windows will use RAM for various things, such as system cache.  If there is demand for the memory at some point, Windows will use the memory being used for cache, for applications.

    If you truly suspect some kind of leak, add the "Memory (Private Working Set)" column to Task Manager's Processes tab, and sort it in descending order.  What processes are at the top, and what is the value of the referenced column?
    Monday, June 08, 2009 12:01 AM
  • The process which was taking the most ram was one of the numerous svchost's. I didn't have time to look up which particular one it was as my computer crashed, becoming completely unbootable and i have just now managed to get it working, tentatively at least. However, now the ram usage is down to the usual 1gb. I will leave my computer on and see what happens.

    But i see your point No.Compromise, i just like to see my ram mostly unused, it gives me the feeling that my computer has that much more "potential". I know, its stupid.
    • Edited by Shroots Monday, June 08, 2009 4:01 AM
    Monday, June 08, 2009 3:57 AM
  • The real test, I think, will be to actively use around 6GB of your RAM and see what happens. If a memory leak is actually consuming that phantom 2GB, then performance should go down as your memory usage approaches the full 8GB. If it's just Superfetch, Windows should start to juggle memory around to make room for your programs and everything will be just fine.
    Monday, June 08, 2009 5:35 AM
  • I didn't have time to look up which particular one it was as my computer crashed, becoming completely unbootable and i have just now managed to get it working, tentatively at least.
    Can you elaborate on this crash?  Was it a bluescreen? What was the stop code (if you can't recall, it should be in the event viewer)?  What made the system unbootable - what troubles did you have?
    Monday, June 08, 2009 10:33 AM
  • It was a blue screen.The problem after the blue screen was that i couldn't start my computer, i would get no display at, not even the bios info would show up. First i suspected the graphics card, but then confirmed that that was fine. Next i checked the ram, I tried multiple configurations with different types of ram. I got mixed results, sometimes a boot, sometimes not. I narrowed down the problem to one of three things. Either my one of the motherboard's ram slots isnt' working, the ram that was plugged into that slot isnt working or, both.

    PS. I checked the event viewer but there are so many errors in every category and i have no idea where to look. If you could be more specific, perhaps a certain category to look under.
    Monday, June 08, 2009 5:47 PM
  • Check the Windows Logs\System log for warnings / errors that occurred at about the time you experienced the blue screen.

    there are so many errors in every category
    Well, that's not really a good thing, I suppose.  Let's look at them, after we get some bugcheck details...
    Monday, June 08, 2009 5:52 PM
  • I checked under the  Windows Logs\System category and there i think that there is no log at the time of the crash. The closest one is at 8:12:18:

    The previous system shutdown at 7:02:26 PM on ‎07/‎06/‎2009 was unexpected.

    but this is well after the major crash. Also I believe I completely narrowed down the problem to one particular stick of ram. My computer will not boot when it is installed regardless of where and with what. However almost any config of ram not containing that one stick allows the computer to boot.

    I don't know if the ram caused the crash or the crash killed the ram, but either way im out a 2gb stick of ram.

    Monday, June 08, 2009 8:33 PM
  • Sure sounds like hardware, perhaps inducing a spontaneous reboot such that the OS didn't really bugcheck...?

    Any file in %systemroot%\minidump with a timestamp that matches the crash?
    Monday, June 08, 2009 8:46 PM
  • If you mean C:\Windows\Minidump then no. There is only one and the timestamp is much after the crash.

    The crash was probably the stick of ram failing and the system losing a massive amount of data all at once, but at this point I dont think that there is any way to tell. I am still open to suggestions though.

    Tuesday, June 09, 2009 10:04 PM
  • If there is no minidump and no indication in the event viewer, than it is not likely that there will be any recoverable details about the crash.

    What are some other errors / warnings in Windows Logs\System and Windows Logs\Application?
    Wednesday, June 10, 2009 3:22 AM
  • Well I'll start with system.
    These 2 occur quite often:


    A timeout was reached (30000 milliseconds) while waiting for the lxduCATSCustConnectService service to connect.
    The lxduCATSCustConnectService service failed to start due to the following error:
    The service did not respond to the start or control request in a timely fashion.


    Heres some more that appear often:


    -The Server service hung on starting.
    -The Diagnostic Service Host service hung on starting.
    -The Computer Browser service depends on the Server service which failed to start because of the following error: After starting, the service hung in a start-pending state.


    The previous three usually follow this warning:


    The following service is taking more than 4 minutes to start and may have stopped responding: Server
    Contact your system administrator or service vendor for approximate startup times for this service.
    If you think this service might be slowing system response or logon time, talk to your system administrator about whether the service should be disabled until the problem is identified.
    You may have to restart the computer in safe mode before you can disable the service.



    This one happened many times in a row, but only on one occasion:


    The server was unable to allocate from the system nonpaged pool because the server reached the configured limit for nonpaged pool allocations.


    Here are a few that happened only once soon after the crash:


    -Unexpected failure. Error code: 490@01010004

    -The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xffffffffc0000005, 0xfffff8000cf7f3e7, 0xfffff880009a8d68, 0xfffff880009a85c0). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060709-24336-01.


    These happened several times after the crash but not in the days following:


    -The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
    -The previous system shutdown at x:xx:xx PM on ‎07/‎06/‎2009 was unexpected.


    This is the first error after the crash:


    The previous system shutdown at 7:02:26 PM on ‎07/‎06/‎2009 was unexpected.




    Here's application:
    This warning happens alot. the stuff in the DETAIL section changes in every warning but the top part is always the same:


    Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

    DETAIL -
    1 user registry handles leaked from \Registry\User\S-1-5-21-550045810-2366745011-1784327116-1001:
    Process 1184 (\Device\HarddiskVolume1\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-550045810-2366745011-1784327116-1001


    This error occurs several times with different information in each one:


    Faulting application name: sdclt.exe, version: 6.1.7100.0, time stamp: 0x49ee923c
    Faulting module name: ntdll.dll, version: 6.1.7100.0, time stamp: 0x49eeab11
    Exception code: 0xc0000005
    Fault offset: 0x000000000005056e
    Faulting process id: 0x80
    Faulting application start time: 0x01c9e7edefeb7587
    Faulting application path: C:\Windows\system32\sdclt.exe
    Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
    Report Id: 438c114f-53e1-11de-9b60-001fc61bbcb3


    This warning happens a few times too, with different numbers each time:


    The content source <csc://{S-1-5-21-550045810-2366745011-1784327116-1001}/> cannot be accessed.

    Context: Application, SystemIndex Catalog

    Details:
    The URL was already processed during this update. If you received this message while processing alerts, then the alerts are redundant, or else Modify should be used instead of Add. (HRESULT : 0x80040d0d) (0x80040d0d)



    That about does it. I think I've got all the different types of errors in each category.
    • Edited by Shroots Wednesday, June 10, 2009 5:06 PM
    Wednesday, June 10, 2009 5:00 PM
  • lxduCATSCustConnectService - Related to Lexmark driver.  Not really important right now.

    Do you have a lot of shares set up on the system? Or a lot of files / printers being accessed by clients?

    It does sound like some kernel component had some sort of NP memory leak, at least at one point.  Configure symbols in Process Explorer, note the NP limit on the System Information window, and the NP value.  Keep an eye on it over time; if it grows unbounded, consider using poolmon to explore further.

    Regarding the registry handle leak - is the process always the same (spoolsv.exe), or does it vary?

    The sdclt.exe crash is also mentioned here (http://social.technet.microsoft.com/Forums/en-US/w7itproappcompat/thread/13e2bedf-7ef1-4bf5-ab01-6de65cd651bd); the crash details are the same, so it appears you are not alone.  (Some consolation, of course...)

    Do you use offline files?
    Thursday, June 11, 2009 2:55 AM
  • I do have several file shares set up as well as the printer. Its mostly just me accessing the files on different computers although I do use it quite often, and the printer is only used remotely sometimes. I also use remote desktop every once in a while, (accessing windows 7 from an XP laptop).

    The majority of the time, the registry handle leak is svchost.exe (\Device\HarddiskVolume1\Windows\System32\svchost.exe). There are very few other cases where it is something else. The one above would be one of those.

    I don't know exactly what you mean by offline files. Offline webpages? Or just files that are not on a remote system?
    Thursday, June 11, 2009 8:12 PM
  • I wonder if the entries referring to the Server service may be related to the file shares...

    Offline files = client side caching.  Type offline files in the start menu...
    Friday, June 12, 2009 9:34 AM
  • As for the offline file, it was enabled but i've never used it before. I disabled it.

    I don't really know what the exact function of the server service is but if its related to file shares than that might be the problem. Sometimes when i try to access the files shown in the network section in explorer, computers that are not currently connected to the network show up. If i dont realize that theyre off and then try to open them, it hangs for a long time and usually i just try to end it. (which doesnt always work and leads to explorer crashing) But the only problem is that that doesnt happen nearly enough to account for all the errors, unless there are errors that it doesn't tell me about or that i dont notice.
    Saturday, June 13, 2009 8:37 PM
  • If Explorer is "busy" doing something and you try to "End Task", ultimately explorer will be terminated and it will appear as a "crash" (albeit one requested by the user).

    You only had the one occurrence of the crash?  Nothing since?
    Sunday, June 14, 2009 5:58 PM
  • i've had explorer crash a few times, but ive only had the huge system crash once so far.
    Monday, June 15, 2009 1:52 AM
  • Any further indications of a memory leak (most likely this would be exhibited by poor performance, bugchecks [poorly written drivers], or applications that fail to allocate memory)?
    Monday, June 15, 2009 9:38 AM
  • i dont know about allocating memory, but i still have the same problem as i did at the beginning of this thread. My ram is slowly filling up which leads me to believe that some applications are not deallocating memory. I havent noticed any change in performance but  i think that thats because i have so much ram that at this point it doesn't matter. Do you have any suggestions that would allow me to test my theory about the ram. Is there something that i can run that will do all the tests for me? or is this something that i would have to do manually?
    Tuesday, June 16, 2009 8:32 PM
  • What does Task Manager indicate the cache is?

    Are you receiving Out Of Memory-type errors from applications or the system in general?  If not, there is likely no leak and Windows is probably using the RAM until something more important (an app, e.g.) needs it.

    Else, grab Process Explorer and look at the paged and nonpaged pool usage.  Add the Private Bytes column and sort it in descending order.  Does anything look out of place?
    Tuesday, June 16, 2009 8:51 PM
  • task manager says the cache is 2600 +- 50 (MB)

    i dont think that im recieving any out of memory errors. at least there they dont pop up. I checked the event logs and there doenst appear to be memory related errors.

    The only abnormal process in Process explorer is one of the svchost.exe. Its currently at 85000K in private bytes, but before my major crash it was around 250000K. If it helps dwm.exe is attached to the svchost in process explorer as below:

    (otherstuff)

    -svchost.exe
          dwm.exe

    (otherstuff)
    Tuesday, June 16, 2009 10:52 PM
  • It sounds like a healthy amount of RAM is being used for system cache - that is to be expected.

    The only abnormal process in Process explorer is one of the svchost.exe. Its currently at 85000K in private bytes
    That is not uncommon, from my experience.
    but before my major crash it was around 250000K.
    As in, 250 MB? That sounds slightly concerning, but occasionally I can certainly imagine that the private bytes could vary substantially. Watch the value over time (perhaps, check out PE's Private Bytes History graph).
    If it helps dwm.exe is attached to the svchost in process explorer as below:
    That confirms the specific svchost.exe instance is the one I am thinking about. :-)
    • Marked as answer by axfelix Thursday, June 18, 2009 8:29 PM
    Tuesday, June 16, 2009 11:01 PM
  • I checked the private bytes history graph, but as far as i can tell it only is a history starting from when you accessed the graph. I'll try leaving the graph on overnight to see what happens. However, the svchost has dropped slightly since yesterday, 80000K.

    If I have the time to do so, I will try to use my computer alot tomorrow. Having various programs running and opening and closing things and other stuff like that.

    My current uptime is 6 days, 8 hours.

    Thursday, June 18, 2009 3:59 AM
  • I have no solution for your crashes, but about the memory use (as said before) Windows will use it for every purpose it can find. Every application you open will use RAM, and Windows will often not free it until it needs it for other applications.

    If you would like to know more about it, do a search for "unused RAM is wasted RAM", and you will find enough explanations and discussions about the topic.
    Thursday, June 18, 2009 5:21 AM
  • it only is a history starting from when you accessed the graph
    What are you looking at - the Private Bytes History column, or the graph on the Performance Graph tab of the process' properties?  Anyway, the data displayed is for a certain amount of time - the last x minutes (data is not kept indefinitely).
    Thursday, June 18, 2009 9:20 AM
  • I was looking at the Performance Graph tab of the process' properties and it doesnt start recording anything until you open it.
    Well i left it on all night and it seems that there was a steady increase in the private bytes up to 92000K until a few seconds before writing this post when it suddenly dropped to 80000K again.
    • Edited by Shroots Thursday, June 18, 2009 2:03 PM
    Thursday, June 18, 2009 1:58 PM
  • I was looking at the Performance Graph tab of the process' properties and it doesnt start recording anything until you open it.
    Are you closing and opening Process Explorer? It can only display data it has observed... Regarding the PB change - seems normal for the value to change like that, in response to activity that may be taking place in the process...
    Thursday, June 18, 2009 2:03 PM
  • Well last night I left process explorer on all night, but the timestamp on the graph places it 10 hours ago. Is this just a bad timestamp, or am I actually looking at the data from then, because it seems to match what the current values are.

    Also what does this particular process do, would it be doing anything spontaneously, or would it require me to be active on my computer?


    Edit: a few changes in the values right now match perfectly whats on the graph so I think is a bad timestamp.

    Edit: Since my last edit, PB has jumped to 100000K. I was in the other room watching tv, I guess that anwers my question.
    • Edited by Shroots Thursday, June 18, 2009 3:01 PM
    Thursday, June 18, 2009 2:06 PM
  • The tooltip timestamp in v11.33 of Process Explorer has issues, yes.

    would it be doing anything spontaneously, or would it require me to be active on my computer?
    The services hosted in the process will react to certain events or triggers.  They may wait for system inactivity to do work, etc...
    Thursday, June 18, 2009 3:56 PM
  • Well, thank you alot No.Compromise you have been extremely helpful. I will continue to moniter this issue, although at this point its not much of an issue anymore. At the very least I can always restart my computer to refresh the ram.

    I am not sure how to leave off at this point, should I mark a post as answer? I have asked so many questions and you've helped with all of them. I'd like to do as much as I can in return. If you want a post marked as answer, would you like to pick the most appropiate one, or shall I?
    Thursday, June 18, 2009 5:23 PM
  • You're very welcome, Shroots. :-)  It is never a bad idea to be aware of what's going on with your system, and knowing  what a baseline is so that any deviation can be further explored...

    If you're inclined, pick the post that you consider to hold the most useful or pertinent details, and mark it as an answer.  Or  not - it is entirely up to you.  :-)
    Friday, June 19, 2009 2:05 AM
  • Well thanks for the info. I usually leave my computer on a week at a time and I do use utorrent but the tracker that i use updates in near realtime (ILT btw) so losing the records of my uploads are not really a concern, but my harddrive is. So this will wear out my harddrive huh? I guess thats reason enough to turn it off a little more often.

    Right now its using 2.4 gigs of RAM and has been on for 3 days.
    Monday, August 24, 2009 12:45 AM
  • Physical mem usage is at 2.4 GB?  Uptime likely has relatively little to do with RAM usage, other than the correlation between more time up = more things done with the system.  A peek at Process Explorer's System Information dialog could prove interesting...
    Monday, August 24, 2009 12:50 AM
  • I took a screenshot I'll try to include here but if it doesnt work i'll post a link to it as well.

    [URL=http://img252.imageshack.us/i/58683137.png/][IMG]http://img252.imageshack.us/img252/1471/58683137.th.png[/IMG][/URL]

    This link opens in current window. So i suggest ctrl-clicking it.

    http://img252.imageshack.us/img252/1471/58683137.png

    Im not sure if this forum allows direct links, I hope so.
    Monday, August 24, 2009 4:30 PM
  • The commit charge is ~2.8 GB; phys mem use is 2.6 GB.

    Also - watch the paged pool values over time - see if it continues to grow seemingly unbounded (what are the values in another three days, provided you don't reboot)?

    Add the Private Bytes column to Process Explorer and sort it in descending order.  Can you post a screenshot of that (at least, the top 10 or so processes)?
    Monday, August 24, 2009 5:12 PM
  • http://img507.imageshack.us/img507/3973/250809g.png

    Here is the whole list. I figured it would be just as useful.
    Tuesday, August 25, 2009 4:31 PM
  • Is there a System Information dialog that corresponds to that?  You've got 8 GB RAM, the previous SI screenshot indicated 2.6 GB was in use, but the physical memory toolbar graph is far less than 1/4 of the way high...
    Tuesday, August 25, 2009 4:45 PM

  • http://img295.imageshack.us/img295/204/36561853.png
    http://img193.imageshack.us/img193/57/76894662.png

    Here's a SI and a the corresponding list.
    Uptime is 5 days.

    Also when I mouse over the graphs at the top of the list (which I assume is what you were referring to) the tooltip says 2.4 or whatever it happens to be at the time, even though the graph doesnt appear to represent that.
    • Edited by Shroots Wednesday, August 26, 2009 4:28 AM
    Wednesday, August 26, 2009 4:26 AM
  • Another hoop, if you don't mind - add the Working Set column, and sort it in descending order, and please post a screen shot (as well as another of the SI dialog, taken at the same time).
    Wednesday, August 26, 2009 9:32 AM
  • Out of curiosity, what version of Process Explorer are you using?

    Your RAM consumption seems reasonable to me, given the values on the System Information dialog (paged pool use, np pool, system cache) and the results of adding the working set column.

    If RAM use increases over time, note which values on the SI dialog are increasing; some values may increase under normal use, while an uncapped increase in others may be indicative of a problem.
    Thursday, August 27, 2009 11:54 AM
  • Its version 11.33

    By the way do you thinks there is merit to Oskamunda's post:

    "I used to run my PC for days at a time, until the motors started crapping out on my HD's due to excessive use. [...] Long story short, just reboot your PC once every day or two.  You wouldn't let your car drive for 48 hours solid, would you?  Give that box a rest...even if it's only a ten-second one."

    I would really rather not ruin my harddrive, but if what he says wont actually happen then I'll just continue to leave it on.

    Uptime is now 9 days and ram usage is at 2.6 gigs.
    Saturday, August 29, 2009 5:29 AM
  • I asked about the version because the label on my system, where yours says "Paged Virtual", is simply "Paged".  However, that was due to the setting on my system of having the display size set to 125%.

    The attitude of the referenced individual and the statements made by the individual are such that it did not take long for me to discount anything that that individual said.  In general, hardware has an "intended" usage pattern.  You usage pattern of the hard drive may or may not match that pattern.  Components are designed around the intended usage pattern.  It may make sense to try to bend your use to the intended usage pattern, or it may not.  I have consumer-grade HDs that have been running for > 5 years.  That means, they have been powered on constantly and spinning for > 5 years - no power management, no "turn off at night".  No problems with them.  However, I expect them to fail, just like any other HDs may, so I back them up regularly, or use them as convenience storage for items that are archived offline.  Not leaving the drives on may extend their life.  But how much faith would you put into a disk that was that old, anyways...  It would be more of a pain for me to have the drives off, than it is to leave them on, knowing that each hour is  a POH that contributes to the MTBF.  Long rant short, I would venture that there is dubious benefit to powering the HD off.  Others may have experiences that cause them to offer different suggestions.  :-)


    Seems like things are leveling off...
    Saturday, August 29, 2009 12:49 PM
  • Seems like things are leveling off...

    I think you might be right about this.

    Thanks for the advice regarding harddrives as well.




    Saturday, August 29, 2009 8:29 PM
  • I am experiencing this exact same problem.  When booted up the committed bytes is about 1.8 G.  After playing some games, and then shutting all programs down, the committed bytes is now 2.8 G.  No way to release the extra memory.  Some of it is a svchost that is increasing, though I don't think it accounts for all of the 1G.

    This is not that the free memory is going down because I already understand that free memory should always hover around 0 because Win 7 is using unused memory for caching.  I'm talking about committed bytes which is no cache.

    BTW, the svhost that is suspect is for these services:

    Desktop Window Manager Session Manager
    Diagnostic System Host
    Network Connections
    Offline Files
    Portable Device Enumerator Service
    Program Compatiblity Assistant Service
    Superfetch
    Windows Audio Endpoint Builder
    Windows Driver Foundation - User-mode Driver Framework
    WLAN AutoConfig
    Friday, November 27, 2009 5:50 PM
  • Hi sthubbar,

    Add the Commit size column to the Processes tab in Task Manager, and sort it in descending order.  What processes are at the top of the list, and what is the value of the Commit size?  Also, can you provide a screenshot of the Performance tab of Task Manager?
    Friday, November 27, 2009 11:39 PM
  • Sure, here is the taskman info.  I don't think even adding up the commit size column does not equi 2.8G or so. 

    http://img682.imageshack.us/g/taskmanperformance.jpg/
    Saturday, November 28, 2009 2:10 AM
  • BTW, here is the system after a reboot.  No big difference in processes, just over 1.5G of memory eaten up by a mystery process.

    http://img177.imageshack.us/g/taskmanperformancereboo.jpg/
    Saturday, November 28, 2009 5:35 AM
  • Hi,

    I'm having the exact same problem. At the moment I using Ulead Burn.now to burn an .ISO file to a 50 Gb blu-ray disc and of my 6 Gb RAM 99% is used. Looking at the resources there is no application or service that takes up more than 20 Mb of physical RAM. How do I free up some Ram? I can't for example run the XP mode because it won't start with no available RAM at hand?

    Regards,

    Toby
    Saturday, November 28, 2009 12:04 PM
  • The problem may have been caused by Rivatuner.  I uninstalled this software and the problem does not exist right now.

    Is there any way to monitor how much memory device drivers are using?  Since they don't show up in Task Manager, I don't know how to monitor them.

    Edit.  Nope.  The problem has returned.
    Saturday, November 28, 2009 2:06 PM
  • Nonpaged memory usage is high (~1.7 GB).  Seems like some driver is leaking pool memory.  One way to deal with this is to break out poolmon.  Get the Windows 7 WDK, and then run poolmon.  Press 'b' to sort by bytes.  Note the tag at the top of the list.

    Alternatively, run Driver Verifier (verifier.exe) and enable pool tracking on all non-Microsoft drivers.
    Sunday, November 29, 2009 3:35 AM
  • No.Compromise,  thank you.  That is just the type of advise I was looking for.  I was not aware of the Windows Driver Kit or the two tools you mentioned.  Now that you mention about the Nonpaged memory being high, that exactly sounds like where the problem is.

    I am downloading the 600MB ISO, and will get those two tools and report back the results.

    I have high hopes of success.
    Sunday, November 29, 2009 3:55 AM
  • Verifier is in-the-box with Windows - just run verifier.exe and work your way through the wizard using the guidelines provided.  If something is unclear, post back.

    Poolmon (from the WDK) will give a 4-character tag that indicates what "chunk" of memory is the largest (drivers can specify a tag when allocating memory; the tag should be an indication as to what the memory is used for).  The hope is that this tag can be readily used to determine what driver is making the allocations.  Depending on the tag, this can be obvious or elusive.
    Sunday, November 29, 2009 4:14 AM
  • Took a quick look at verifier and it was less than straightforward for me to understand.  If you can provide some more step-by-step instructions as to what to do and look for, would be great.

    [Edit: I think I understand Verfier.  Haven't played with poolmon as of yet.  Still would like to know if it's possible to just install poolmon.]

    BTW, is it possible to only install poolmon from the WDK?  If I don't need all the other tools, I would prefer to not install of it.

    Thanks.
    Sunday, November 29, 2009 7:55 AM
  • AFAIAA, you need the whole WDK to get poolmon.  (As I understand it it's more of a troubleshooting / monitoring tool for driver developers, than for users.  There's a GUI version of that type of tool on OSR's site, but it requires registration.)

    As Verifier goes...
    start->verifier.exe->create custom settings (for code developers)->next->select individual settings from a full list->next->check "Pool tracking"->next->select driver names from a list->next->sort by Provider, check all non-Microsoft drivers->Finish, reboot.

    If for some reason you are unable to reboot after enabling verifier, boot into safe mode, run verifier.exe, and choose to Delete existing settings.  Then reboot again.   Indicate if this turns out to be the case...

    Sunday, November 29, 2009 2:10 PM
  • Aaargh!  Trying to get this darned poolmon.exe is turning out to be as frustrating as the darned memory leak.  Let's see these are just some of the things I've tried:

    1) Follow the link provided above.  Waited several hours to download some file GRMWDK_EN_7600.ISO.  Ok, try and unzip the file to a directory and tons of errors.  Wow, that's odd.  Maybe there is some copy protection or something.  Tried to mount the image and got a BSOD from ElbyCDIO.sys.  Darned, that ISO must have gotten corrupted somehow

    2)  Started the download again.

    3)  Frustrated with the download, in parallel doing many Google searches.  Hey what do you know the Server 2003 Admin tools have this tool and that download is only a few MB.

    4)  Downloaded at least 3 versions of admin tools.  Both x86 and x64, plus the Windows XP admin tools.  All of these files said they were not valid Win32 programs or something.

    5)  Even tried to peer-to-peer download poolmon.exe and it was also some invalid file

    6)  The GRMWDK_EN_7600.ISO file finally finished downloading the second time.  Tried unzipping, again tons of "File is Broken" erros.

    7)  Tried to mount the ISO and this time it does mount and I got a nice splash screen asking me to install and it even has "Window 7" as the top item and I'm just getting excited when I get this message:

    http://img163.imageshack.us/img163/6748/kitsetuperror.jpg

    No.Compromise, can you provide me a link that you can personally verify works on Windows 7 x64 Enterprise?  Or better yet, can someone just send me the poolmon.exe.  My email is same as my name and it is a Gmail address.

    Thanks.
    Sunday, November 29, 2009 4:59 PM
  • SUCCESS!  :)

    Even though the ISO was corrupt, I only needed to file "generaltools_x86fre.msi" under the \WDK directory.  Well, maybe the .cab files as well. Whatever I was able to run the program while I was experiencing the memory leak and after pressing 'b' as requested this is the output......

    Now what does it mean?

     Memory: 4193528K Avail: 1544652K  PageFlts:   319   InRam Krnl:15940K P:255096K
     Commit:2598884K Limit:4191632K Peak:3393920K            Pool N:806260K P:260664
     System pool information
     Tag  Type     Allocs            Frees            Diff   Bytes       Per Alloc

     NV   Nonp     147504 (  35)    140563 (  46)     6941 698785568 ( -1440) 100675
     CM31 Paged     21936 (   0)      9327 (   0)    12609 59174912 (     0)   4693
     MmSt Paged     75907 (   0)     61116 (   0)    14791 50590176 (     0)   3420
     smNp Nonp      14724 (   0)      7852 (   0)     6872 28147712 (     0)   4096
     CM25 Paged      3557 (   0)         0 (   0)     3557 17027072 (     0)   4786
     smBt Nonp       4821 (   0)      1285 (   0)     3536 14483456 (     0)   4096
     NtfF Paged     27383 (   0)     18141 (   0)     9242 13012736 (     0)   1408
     Int2 Nonp    6408399 (1502)   6407916 (1502)      483 11934864 (     0)  24709
     FMfn Paged    917711 (   2)    892746 (   2)    24965 10654752 (     0)    426
     MmRe Paged      3216 (   0)      2152 (   0)     1064 7780768 (     0)   7312
     Ntff Paged     55626 (   0)     49349 (   0)     6277 7733264 (     0)   1232
     CIcr Paged     97828 (   0)     95680 (   0)     2148 7039568 (     0)   3277
     File Nonp    6403581 (  34)   6387777 (  34)    15804 5293568 (     0)    334
     Ntfx Nonp      86265 (   0)     70551 (   0)    15714 4601184 (     0)    292
     Toke Paged    741622 (  43)    739578 (  43)     2044 3420384 (     0)   1673
     MmCa Nonp      73259 (   0)     59864 (   0)    13395 3398688 (     0)    253
     smSt Nonp     122661 (   0)    122627 (   0)       34 3357440 (     0)  98748
     NtFs Paged    308029 (   0)    286412 (   0)    21617 3158080 (     0)    146
     FMsl Nonp      72623 (   0)     57106 (   0)    15517 2979264 (     0)    192
     FIcs Paged    195800 (   0)    180291 (   0)    15509 2977728 (     0)    192
     ClfI Paged        60 (   0)        32 (   0)       28 2802784 (     0) 100099
     VoSm Nonp       3750 (   0)      3718 (   0)       32 1908256 (     0)  59633
     SM56 Nonp         16 (   0)         3 (   0)       13 1820272 (     0) 140020

    Sunday, November 29, 2009 5:35 PM
  • As you mentioned above

     "The hope is that this tag can be readily used to determine what driver is making the allocations.  Depending on the tag, this can be obvious or elusive."

      If I'm reading poolmon output correctly, we are intersted in the Nonp lines, and the two largests ones are smNp and smBt.  So what do those mean?  I found this great site:  http://blogs.msdn.com/ntdebugging/archive/2006/12/18/Understanding-Pool-Consumption-and-Event-ID_3A00_--2020-or-2019.aspx  It tells me to look for a pooltag.txt file.  Well I searched under the WinDDK and didn't find it.  Darn.  Hey, what the heck let's do that search from the root directory.  Hey! What do you know, C:\Program Files (x86)\Windows Resource Kits\Tools has a copy of pooltag.txt.  When did I install the Resource Kit?  Well, no matter let's search for smNp in there.  Darn, nope.

      Hmm, keep searching.  Oh I am referred to this page: http://support.microsoft.com/kb/298102.  Ok, pretty straightforward, let's just do a text find of all the files under c:\windows\system32\drivers for "smNp".  Darn, no go even ignoring case.

      I'm at an impass.  How can we find out what process is smNp and smBt?

      BTW, I did NOT use the Verifier tool.  The only two unverified drivers are my TAPI for OpenVPN and VirtualClone driver.  I can't see how the can be it, though I guess it is possible.  I would more likely suspect the display driver's 3D functionality since I don't normally use that and it is when playing a 3D game that this happens, or maybe the audio.

      BTW, Video card is NVidia 8600 M GT running the 195.55 drivers.  I guess I can roll back the drivers and see what happens.

    Sunday, November 29, 2009 6:04 PM
  • Problem solved!  Thank you No.Compromise

    Turns out it was the video drivers.

    I rolled back the drivers and the Nonpaged Kernel memory immediately went down to normal levels of about 123.  Thank you Win 7 for allowing me to change video drivers without a reboot.  Even after I rolled back the drivers, the leak was still there so I let Win 7 look for drivers it likes and somehow it installed 186.78.  Sounds like such old drivers compared to 195.55, though I guess if they solve the memory leak, I think they are perfect.  :)

    Thanks again.

    BTW, do you know much about other topics?  I have proposed other questions and have gotten no response:

    http://social.microsoft.com/Forums/en-US/partnerwinclient7rc/thread/e92d3f09-d074-4604-9e48-5deb16cb272a
    http://social.microsoft.com/Forums/en-US/partnerwinclient7rc/thread/623f06a3-e219-40e1-bae3-d2c344889f6b
    http://social.microsoft.com/Forums/en-US/partnerwinclient7rc/thread/3e3e5a87-bbe2-45e3-a65e-0173aeb0d22c

    • Proposed as answer by sthubbar Sunday, November 29, 2009 6:28 PM
    Sunday, November 29, 2009 6:28 PM
  • Good to hear you identified the culprit and were able to fix the problem.
    Turns out it was the video drivers.
    Yes, I would have suggested that based off of the highest non-paged pool tag - NV. The tag had 666+ MB RAM attributed to it...
    Hey what do you know the Server 2003 Admin tools have this tool and that download is only a few MB.
    I guess I'd be a bit leery about using or relying on the results of such a version, on Win7...
    The only two unverified drivers are my TAPI for OpenVPN and VirtualClone driver.
    The idea is not to go after "unverified" drivers, but rather non-Microsoft drivers.


     Those links don't appear to be working...
    Monday, November 30, 2009 10:33 AM
  • Thanks again.

      I guess the links only work when I'm signed in.  I don't know how to get a link that works for non-signed in users.  I even tried doing a seach for the title of the post when not logged in and it didn't work.

      Well, here are the titles if you can find them:

    disable prompt to format usb drive

    disable cursor-over shadow in explorer

    win7 x64 enterprise explorer auto-refresh does not work

    Monday, November 30, 2009 11:41 AM


  • What's the point of having the RAM, if Windows will not use it?  Windows will use RAM for various things, such as system cache.  If there is demand for the memory at some point, Windows will use the memory being used for cache, for applications.


    This is by far and above one of the most idiotic answers I have ever read on a forum. Windows is using the memory for windows.
    I'm having the same memory leak  problem q6600 cpu/4gb memory. Now this morning I log in to my computer, click an application that was minimised and it take a good 2 minutes to start. Loads of hard drive activity (remember windows 95?) until windows finally swaps it back into memory.

    So what you're saying is that windows is supposed to use as much memory as possible and leave as little as possible for your applications ? A computer is supposed to run windows and nothing else ?
    I have no background apps, torrent nonsens, shares, shared printers etc. It's a fresh install too.

    I used to run Windows NT Workstation 4.0 for 3/4 months at a time before I needed to reboot.
    Didn't have this issue with XP either, though the XP kernel isn't that different from NT 4.0.

    Average joe shuts down his computer every day, so I imagine MS didn't factor in long term uptime.
    Let's hope windows 2008 server isn't using this "design".

    Wednesday, December 16, 2009 9:07 AM
  • You're not providing enough details about your problem, to be able to offer any specific guidance.  What processes have the highest value for private bytes?  What is the state of the kernel memory pools at the time of the problem?  Over time?  What about system memory use - what's the system commit charge? Over time?  What's the physical memory usage at the time of the problem?  Over time?

    Do you have AV or other security software installed?  Is the system on a domain? Did you install a video or audio (or other) driver package, that includes various "utilities" in addition to the drivers?

    What arch are you running?

    I hope the above doesn't also prove to be "idiotic"... ;-)
    Wednesday, December 16, 2009 11:14 AM
  • this is to eveyone who will get memory faults

    no matter how much ram you have, it wont help, dont bother buying more, its a software problem, and make sure your windows is updated!

    step1 : uinstall your anti - virus, morzilla firefox, and your drivers, see if its fixed, if it is then reinstall them one by one and test if your memory works.

    step2 : check if you have a paged cache and it is running on about 10000 ( set it yourself ), btw this isnt usually the problem

    step3: if all else fails, save all you can and reinstall windows, save all you can!!! ( i lost 500gb of stuff )

    step4 : if all of the above fails, revert back to XP or Vista.

    thank you, hope it helps :)

    Tuesday, June 08, 2010 6:54 PM
  • Encountering a very similar situation, but it takes some time to get there (e.g. 2-3 weeks to slowly build up).  Have 8GB physical memory in the machine.

    Right now I'm looking at 5.23 GB of memory in use after 25 days uptime, with literally nothing open but my browser to make this post (~80 MB private).  40 processes total, all users.  If I add everything up in taskmgr or resource mon it obviously doesn't come anywhere near the > 5GB "In Use".  I mean seriously, it's < 1GB.

    I do some driver development as a trade so had quick access to poolmon.  Was hoping I had the same nvidia driver leak that sthubbar encountered, but no such luck.  I've tested my memory, it's fine.  System is stable as can be, I just want to know where the heck my memory is going!

    I'm kind of at a loss where to look from here.  Obviously I can reboot and the problem goes away, for awhile......

    Any recommendations on what path to go down next?

    Tuesday, August 31, 2010 4:06 AM
  • Please post a screenshot of the performance monitor and download RAMMap [1] and run it. Now save the data as a RMP file. Zip the RMP file and upload the zip to your SkyDrive [2] and post a link here.

    André

    [1] http://technet.microsoft.com/en-us/sysinternals/ff700229.aspx
    [2] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, August 31, 2010 1:45 PM
  • I too am experiencing massive loss of memory after long term usage (even after a full day). It starts with about 3GB free and at the end of the day it is about 100MB free.

     

    Maybe the question I should as is, "What do these fields mean?"

    Physical Memory

    - Total: Total Physical Memory installed.
    - Cached:
    - Availible:
    - Free: Memory not being used or assigned

    Kernel Memory (MB)

    - Paged:
    - Nonpaged:

    System

    - Handles:
    - Threads:
    - Processes:
    - Up Time: Total time the system has been operating without a reboot.
    - Commit (MB):

    This can help me determine if what I am experiencing is normal and expected.

    I will say, that if this is to be expected, then Windows 7 is a business class operating system. Can you imagine a Fighter Jet or Space shuttle running this OS and given the Excuse that the systems have to be rebooted every few days? NOT ACCEPTABLE.

     

    My system is a DELL Precision M2400, 6GB RAM, 500GB HDD, nVidia Quadro FX 370M

    Thursday, October 14, 2010 9:56 AM
  • Provide the RAMMap data, please.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Thursday, October 14, 2010 11:12 AM
  • FIXED THIS FOR MY PC

    I've had this problem since I built the PC ages ago and I've tried and tried to fix it, I've replaced my RAM and I've spent hours searching the internet and read multiple posts requiring people to post log files or just have people respond with the helpful "unused RAM is wasted RAM".

    My problem was the same. Switch the PC on and slowly it would use more and more memory until evenually after less than 12 hours it crashed. I looked at the task manager, downloaded process explorer, and all the time I couldn't see what was using my RAM. Yet I could sit watching the pagefile increase by one every 5-10 seconds until it was 12000 and the PC could do nothing even with no applications open it was full RAM.

    The solution for me was simple

    1) Open Task Manager

    2) Goto the Process table

    3) From the menu bar select View > Select Collumns ...

    4) Add "Handles" ad then rank the handles column

    Right at the top of the list I had the culprit .exe and I googled that and got a very simple fix. Finding out how to identify the culprrit software was the hard part, which took hours of surfing. For me it was the audiodg.exe which was causing the problems, a piece of software that handles audio enchanements and it was a very simple fix in the audio settings. Here's the link just in case that's a common cause

    http://technicallyeasy.net/2009/03/fix-audiodgexe-high-cpu-usage/

    Saturday, November 06, 2010 11:41 AM
  • all of you have been brainwashed or something,

     

    IT IS NOT GOOD TO USE ALL THE RAM!

     

    windows should use as little ram as possible.

     

    i know THEORETICALLY it's a good idea, but in practice it sucks.

     

    how amny programs will ask windows to give it some ram?

     

    how many programs just grab there own ram?

     

    windows needs to be slimed up.

     

    windows neds to us 1/4th of the resources it requires now.

     

    windows has grown WAY to big, and is the buggiest thing INCLUDING WINDOWS 7, I HAVE EVER SEEN.

    Sunday, January 30, 2011 12:26 PM
  • Instead of your troll post provide the RAMMap data so that we can help you if you have any issues.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Sunday, January 30, 2011 12:39 PM
  • I too am having this issue and it is really starting to piss me off. I am a computer programmer I understand the ins and outs of computers... I have done everything I can to get my 2 week old laptop to stop crashing on me due to "Low Memory". It boots with 1gb utilized by windows services and then it has hardware reserved at 1gb so all in all my 4gb system is only 2gb. I have searched everywhere on the web for a solution to this there just isn't one windows 7 is a resource hog and there is nothing to do except revert back to xp, plain and simple. I called Dell multiple times and they refused to help me because this is a "software" issue, WTF.

    Sucky thing is that I have to run Visual Studio and in the process of coding or anything system heavy it craps out in the middle so I end up losing everything. Awesome!

    Thursday, February 03, 2011 11:15 PM
  • Also provide the RAMMap data. And if you have 1GB hardware reserved, you use the 32Bit Windows. Contact the OEM to get a 64Bit Windows DVD and reinstall the Windows.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, February 04, 2011 2:09 PM
  • Yeah my main machine has 12GB of triple channel memory in it with Windows 7 Ultimate x64 and there has to be a memory leak somewhere.  I leave my machine on for days to weeks and lately after just one to two days it creaps up to using 3GB of RAM until it gets to over 10GB of RAM being used and then it crashes blue screen.
    Wednesday, March 02, 2011 10:16 PM
  • again, run RAMMap at the start, when you have low memory usage, and later when you have higher memory usage and give me the data

    "A programmer is just a tool which converts caffeine into code"

    Want to install RSAT on Windows 7 Sp1? Check my HowTo: http://www.msfn.org/board/index.php?showtopic=150221
    Wednesday, March 02, 2011 10:24 PM
  • hello!

    im having a kind of a similar problem. Im using a Q6600 with 4Gb of RAM running on Windows 7 x64. My physical memory usage history is 1.75GB idle but my CPU usage looks good ~ 0%.

    In Windows Task Manager when i arranged the memory column, the process with the highest memory usge is svchost.exe with 116,572K. And i have 14 svchost.exe in my computer! I opened process exporer and check the legitimate of all those svchost.exe and they are all legit. When i look at the properties of the highest svchost.exe in process explorer, the services which is running under it is as follows

     

    AudioEndPointBuilder c:\Windows\System32\Audiosrv.dll

    CscService c:\Windows\System32\cscsvc.dll

    hidserv c:\Windows\System32\hidserv.dll

    Netman c:\Windows\System32\netman.dll

    PcaSvc c:\Windows\System32\pcasvc.dll

    SysMain c:\Windows\System32\sysmail.dll

    TrkWks c:\Windows\System32\trkwks.dll

    UxSms c:\Windows\System32\uxsms.dll

    wudfsvc c:\Windows\System32\WUDFSvc.dll

     

    All are legit DLLS.

     

    Is it normal to have 14 svchost.exe running at the same time(system, local service, network service in Task Manager)

    and how can i reduce the memory usage of the svchost.exe

    Wednesday, April 06, 2011 2:41 PM
  • I think that's normal Sysmain (Superfetch) operation.

     

    Wednesday, April 06, 2011 3:42 PM
  • Evening or morning all.

      The performance issue is probably cause by .net or something trying to check a signature. over in sysinternals.com There is a great video set and forum dedicated to performance issues. Searching for the case of the slow log on or program start up delay will illustrate how to trouble shoot the two minute delay. If there was not net connection would seem to confirm this. Mark R and sysinternals are a part of microsoft. So there is no concern about programs creating a hole or causing more problems. Not an employee of microsoft nor do I own stock there.

      Each installation is unique to a user. The memory patterns can change because of a outdated driver. A new program that has a leak not detected until you leave it running. Or a particular user keeping 5 programs or more that are open at once(Have to reference something in the military or write a review.) Like the bios you can do a hit and run. Or you can take the time to understand the computer is only as secure as the user /program(s)/driver(s) installed. Microsoft is making an effort to make sure drivers become more secure. But as another post I added. As a solution to %1 application is not a valid win32. It was my choice to add the program(7zip, 9.20) and not be able to install the more recent Nvidia drivers. Its not Microsoft's fault. 

      This is the reason for the installation, chip set, video driver order. At least my installation would have been up to date and avoided the frustration of not having the latest driver for a couple of weeks.

     

    1stknight 

    Keith

     

    Saturday, July 16, 2011 3:01 PM