locked
Pagefile keeps growing until I run out of memory RRS feed

  • Question

  • I am running Windows 7 Ultimate 32 bit on a new laptop with 4G RAM. If I leave my computer running without any open applications (there are still plenty of services running I'm sure) the pagefile just keeps growing and growing. I left my computer on overnight and in the morning my pagefile was almost 10G and most of my RAM was marked as "Modified". I did not have any available memory to run applications and I had to reboot. My computer then got stuck on "Logging Off" for about 2 hours until I manually killed it. It seems that there is something running that is leaking memory but how do I find it? I went to the Resource Monitor but there were not any processes with an abnormally high memory usage. Actually, my "Used Physical Memory" was normal (around 40-50%) but the "Commit Charge"was 100%.
    Saturday, August 14, 2010 6:59 PM

All replies

  • Please post a screenshot of the performance monitor and download RAMMap [1] and run it. Now save the data as a RMP file. Zip the RMP file and upload the zip to your SkyDrive [2] and post a link here.

    André

    [1] http://technet.microsoft.com/en-us/sysinternals/ff700229.aspx
    [2] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Saturday, August 14, 2010 8:22 PM
  • It took a while but I started getting the "low memory" warnings again. I saved a screenshot of the performance monitor but I couldn't get a RAMMap file. Every time I tried to save it the program crashed. I am assuming it crashed due to lack of memory.

    http://cid-7755a8d8e27dad72.skydrive.live.com/redir.aspx?page=play&resid=7755A8D8E27DAD72!105&Bpub=SDX.Photos&Bsrc=GetSharingLink

    Sunday, August 15, 2010 3:15 AM
  • Start RAMMap and click in "Empty" on the entry "Empty modified list", now the modified pages are written to page file to free memory.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Sunday, August 15, 2010 12:34 PM
  • Here is another screen shot of the Resource Monitor with the Task Manager on top of it:

    http://cid-7755a8d8e27dad72.photos.live.com/self.aspx/Shared/ResourceMonitor^_8-15-10.png

    I will try as you suggested with RAMMap but I don't think it will be able to move the modified pages to the page file. It seems that the page file can only grow to about 10GB and that's when I start to get major problems and a physical memory dump if I don't reboot. As you can see in the above screenshot the commit charge is 12GB/12GB at the time.

    Sunday, August 15, 2010 3:08 PM
  • Can you create a complete dmp file:

    http://www.msfn.org/board/topic/130005-creating-memory-dumps/

    open it in WnDbg and run the command from this topic:

    http://www.msfn.org/board/topic/138036-memory-leak/page__view__findpost__p__883749

    and post the WinDbg output here.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Sunday, August 15, 2010 7:52 PM
  • Sorry, I am having a little difficulty with this dmp file. First, in step 1 it says to set a registry value that does not exist in my system:

    Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
    Value: CrashOnCtrlScroll
    Type: REG_DWORD
    Data: 1

    I did the rest of the steps and rebooted as required. Second, it says to create the dmp file "hold down the RIGHT CTRL key and press the SCROLL LOCK key twice to cause the machine to bugcheck and create a memory dump". I do not have a SCROLL LOCK key. This is probably why I do not have the above registry key. I guess I will just need to wait until it crashes on its own! It should not take a while since the instructions said to restrict the page file size to memory + 50MB.

    I have the Debugging Tools installed so as soon as my memory fills up again and I crash I will post the results.

    I am sorry if I sound like I don't know what I'm talking about- I am not an IT guy.

    Sunday, August 15, 2010 9:34 PM
  • My system crashed and I think I followed all the instructions correctly. The output was too much to post directly, so here is a link to the text file:

    http://cid-7755a8d8e27dad72.skydrive.live.com/redir.aspx?resid=7755A8D8E27DAD72!113&Bpub=SDX.Docs&Bsrc=GetSharingLink

    Thanks for all your help. Let me know what else you need.

    Sunday, August 15, 2010 11:53 PM
  • Does the issue occurs in Clean Boot Mode?

    Perform a clean startup to determine whether background programs are interfering with your game or program

    If the issue occurs in Clean Boot Mode, please let us know the model of the laptop. You may need to download the Windows 7 compatible driver updates for your laptop.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    Wednesday, August 18, 2010 2:43 AM
  • Some process is leaking pagefile-backed sections:

    > Shared Commit:       1404618 (   5618472 Kb)

    (You can ignore the warning about excessive nonpaged pool usage - this is a known problem with !vm in the current debugger release).

    These leaks can be hard to debug. You can check for processes with abnormally high handle counts in task manager, and try stopping/killing them while keeping an eye on the commit charge. If that doesn't work, can you compress the dump file, upload it to skydrive and send me a link (pavel at microsoft.com)?

    As a temporary workaround you can increase the maximum size of the pagefile, or create additional pagefiles if you have more than one disk. This won't stop the leak, but it should allow the system to remain responsive longer.

    Wednesday, August 18, 2010 10:51 AM
  • Pavel- Thank you for the information. I will try to watch the handle counts but what would be considered high? Right now I have explorer.exe with 1,428 and outlook.exe with 1,344 as my highest.

    As far as uploading the dump file skydrive has a 50MB limit and the file is 455MB even compressed. This was a complete memory dump.

    Wednesday, August 18, 2010 4:33 PM
  • Look for handle counts that just grow constantly.  Add Handles as a column in Task Manager and then sort by it.  Check it over the course of the day and a pattern should emerge.  Right now my copy Outlook 2010 is using about 5,000 handles.  The only reason that does not really alarm me is it keeps going down a bit, and then back up a bit.  Usually when you see a handle leak some process will grow constantly over the course of time.  I've seen out of band processes use 15,000 handles and higher.   The part that is deceiving is that the memory counters will not indicate that the process in question is using much memory.  The proof come when you kill the suspect process and your memory usage drops a ton. 
    • Proposed as answer by Doca Thursday, April 18, 2013 4:55 PM
    Wednesday, August 18, 2010 9:24 PM
  • I kept an eye on the handles as you guys have suggested. There was nothing out of the ordinary. Even when my commit charge climbed to 12G/12G and I started getting out of memory warnings the two processes listed above were still my highest handle count at about the same numbers as before.
    Thursday, August 19, 2010 1:51 AM
  • Can you capture a kernel dump? It should be much smaller.

    Alternatively, you can try stopping all services that can be stopped, and then killing remaining processes one by one from task manager (avoiding critical system stuff like csrss/smss/lsass/winlogon/services.exe). When the last process that has open handles or views to the leaked sections exits, you should immediately see commit charge and physical memory usage go down.

    Thursday, August 19, 2010 9:05 AM
  • I set my computer for kernel dump instead of full and waited for the inevitable. I zipped up the kernel dump file but it is still 138MB. I guess I am stuck with the process of manually killing things one by one until my commit charge is freed up. There are a lot of processes and services running so this is a daunting task for me.
    Thursday, August 19, 2010 5:19 PM
  • I set my computer for kernel dump instead of full and waited for the inevitable. I zipped up the kernel dump file but it is still 138MB.

    Split the archive. Set the maximum size of a part to 45MB. This can be done with almost every Zip Tool.

    Instal the OpenSource Tool here:

    http://www.7-zip.org/

    Now upload all parts to your SkyDrive.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Thursday, August 19, 2010 11:16 PM
  • Here is a link to the kernel dump file. I also still have a complete dump file that I created last week. I can post that as well but it is much larger so there will be many more parts.

    http://cid-7755a8d8e27dad72.skydrive.live.com/redir.aspx?resid=7755A8D8E27DAD72

    Friday, August 20, 2010 2:54 PM
  • Update: I was going through and killing processes one by one and I realized that not all processes were shown in the task manager. I clicked on show processes from all users and looked at the handle count again and immediately found the culprit: bcmwltry.exe.

    After killing that process my physical memory immediately dropped. I uninstalled the DW WLAN Wireless Utility and now I am downloading the wireless drivers again from Dell to re-install. Hopefully that gets rid of my problem.

    Friday, August 20, 2010 5:03 PM
  • The bcmwltry.exe should belong to Broadcom Corporation Wireless Network software, not to DLink.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, August 20, 2010 9:05 PM
  • I would set the pagefile to a custom size, instead of a system managed size. You can go into advanced system settings and navigate to advanced\virtual memory. You shouldn't need a gigantic pagefile with Windows 7 so you can lock it down at just above the recommended size for the mininum and the maximum-or you can use the standard 1.5 times the physical ram for the mininum and twice that amount for the max. Also, you can clear the pagefile at shutdown. TechNet can tell you how to change the registry entry (Clear Pagefile at Shutdown, TechNet). I noticed that XP needs to be rebooted for the entry to take effect, but Vista and 7 recognize the change immediately and clear it on the first shutdown. I do this every now and then and then set it back to the default because it slows the shutdown. Haven't had any problems with setting the min. and the max. to the same size, it will overwrite itself when it's full.

                                      Good Luck, Plan B PC

    Friday, February 11, 2011 5:14 AM
  • no, set tit to system managed, this is the BEST setting. Clearing thr pagefile SLOWS down the shutdown a lot. I have looked at so many xbootmgr shutdown traces where users clear the pagefile and have to wait 2minutes to shutdown.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, February 11, 2011 2:55 PM
  • Look for handle counts that just grow constantly.  Add Handles as a column in Task Manager and then sort by it.  Check it over the course of the day and a pattern should emerge.  Right now my copy Outlook 2010 is using about 5,000 handles.  The only reason that does not really alarm me is it keeps going down a bit, and then back up a bit.  Usually when you see a handle leak some process will grow constantly over the course of time.  I've seen out of band processes use 15,000 handles and higher.   The part that is deceiving is that the memory counters will not indicate that the process in question is using much memory.  The proof come when you kill the suspect process and your memory usage drops a ton. 
    Thank you for this tip! Since installing Windows 7 64-bit about a month ago, I've had an issue that forces me to reboot daily instead of leaving my machine run overnight. Some process was eating up my page file. In the course of two days the page file grew to about 150 GB ... I had to up the max page file size just to get work done. Anyway, I got Process Explorer but couldn't tell from the visible columns which process was the culprit. However, after displaying "handle count" I could see it was a useless wireless utility Dell threw on the laptop that was sucking up about 30 handles per second. It was up to 320,000 handles. I killed the process and uninstalled the application, and my page file dropped from 25 GB to 4 GB in about 30 seconds. Problem solved. THANKS!!! :)
    Wednesday, May 11, 2011 5:24 PM
  • Acrobat reader does something wierd when I print a pdf with a lot of graphics to a color printer (kyocera fs-c5300dn).  Let's say you make a pdf with 2 pictures copied 40 times.  It begins to use up all real physical memory, but it doesn't show up as memory for acrobat reader in task manager or process explorer.  Any idea which column that would show up in?  If you try this, you'll probably be forced to reboot, unless you can suspend the process.

    EDIT:

    Oh I see.  It's spoolsv.exe (acrobat is suspended):

    page faults - 2,614,732
    i/o read bytes - 1,853,438,356
    i/o write bytes - 3,350,039,596

     


    Wednesday, May 11, 2011 9:38 PM
  • Super tip! Same problem with BCMWLTRY.EXE for me. 8,56,000 handles and COUNTING!! WT$, is this utility doing? I had actually set the page file size to system managed, but I was still getting low memory alerts from the system and frequent crashes. Thanks a ton for this pointer!

    P.S: Somebody should tell the BroadCom guys...

    Thursday, October 18, 2012 9:28 AM
  • I know that's an old thread but I had the same until today. The exact same process. It's a Dell Precision M2400 laptop reinstalled using disk re-image guide from Dell and the latest wi-fi driver available there.

    Killed the process, and suddenly regained all my memory back. It has 110k threads. The closest process had 1.5-2k threads.

    Also, I was using Performance Monitor (perfmon.exe) to check how this was progressing and saw a constant number of cache faults/sec. Now it's stopped.

    Thanks for posting the problem and leading to a solution.


    Doca

    Thursday, April 18, 2013 4:54 PM