Sign in
 

none
Memory leaks - high commit charge

 > 

    Question

  • Question
    Sign in to vote
    1
    Sign in to vote

    Hi,

    I'm having memory leaks, I think,  in Windows 8. 

    After some time it accumulates commit charge to the max.

    Right now, it is 150h of running (by the idle CPU) and it has 16G in commit charges. Physical stays at ~4-5G at all times. With time commit charge goes to ~32G and suystem starts to be sluggish more and more in the process. Here's the RAMMap:

    https://skydrive.live.com/redir?resid=3C9E3E945C64AB9!442&authkey=!AHvrqx1W0HHVLVs&v=3

    and here's the top memory users.. 

    https://skydrive.live.com/redir?resid=3C9E3E945C64AB9!441&authkey=!AK6T9KHUaG0eJb0&v=3

    I'm using Windows 8 on Samsung Series 7 Laptop

    CPU: i7-3635QM

    RAM: 8G + 16G Express cache 

    Video: Nvidia GT640M + Intel HD 4000

    I have tied to disable Express cache without effect

    I updated the video drivers and it seemed to improve a bit, but still has similar effect.

    Every time I reboot it starts almost normal with 3-4G of physical use and a bit more commit, and then grows. 



    • Edited by RomSocial Wednesday, October 16, 2013 1:23 PM
    Wednesday, October 16, 2013 1:12 PM
    |

Answers

  • Question
    Sign in to vote
    1
    Sign in to vote

    the nonpaged pool is too high. Use poolmon.exe from the WDK to trace which pooltag is the cause. Now use findstr to see which driver uses the tag.

    Microsoft explained this here in detail:

    Troubleshooting Pool Leaks Part 2 – Poolmon
    http://blogs.msdn.com/b/ntdebugging/archive/2012/08/30/troubleshooting-pool-leaks-part-2-poolmon.aspx

    I looked at some of those issues and new Samsung devices have a software Intellimem installed which uses the Pool tag ECMC in the driver intmsd.sys. Look if you also have this issue.

    "A programmer is just a tool which converts caffeine into code"

    Wednesday, October 16, 2013 6:49 PM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    the screenshots are not helpful. I have no idea how to do a long term memory tracing because I never had such an issue.

    Play a bit with the startup tools until you may find out which programs leak the memory

    https://support.microsoft.com/kb/929135/en-us

    "A programmer is just a tool which converts caffeine into code"

    • Proposed as answer by Andre.ZieglerEditor Wednesday, October 23, 2013 6:04 AM
    • Marked as answer by RomSocial Wednesday, October 23, 2013 11:37 AM
    Tuesday, October 22, 2013 5:20 AM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks, Andre,

    Well, I can give it as much as 1/2 of the free space on my drive to keep it up with it's appetite. :)

    I already tried disabling stuff, but trying for couple of days without Wifi, for example might be complicated..

    I enabled all the RAM related columns in process explorer. What kind of draw my attention is Norton Onine Backup Service with 488M+ pagefaults. Not sure what these mean, but it sounds like not a good thing...

    • Proposed as answer by Andre.ZieglerEditor Wednesday, October 23, 2013 6:04 AM
    • Marked as answer by RomSocial Wednesday, October 23, 2013 11:37 AM
    Tuesday, October 22, 2013 5:42 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    That was it... I stopped and disabled this crappy service and after loong time, it disappeared from my task manager after long wait and suddenly, I saw that my commit is 3.6Gb with 2.4Gb physical...
    And I never even used this online backup.. it was supplied with the laptop. I uninstalled antivirus, but did not bother to remove this one.

    I started using computers with Norton commander... then Norton utilities... too bad Norton brand is loosing all my trust...



    • Edited by RomSocial Tuesday, October 22, 2013 6:03 AM
    • Proposed as answer by Andre.ZieglerEditor Wednesday, October 23, 2013 6:04 AM
    • Marked as answer by RomSocial Wednesday, October 23, 2013 11:37 AM
    Tuesday, October 22, 2013 6:02 AM
    |

All replies

  • Question
    Sign in to vote
    1
    Sign in to vote

    the nonpaged pool is too high. Use poolmon.exe from the WDK to trace which pooltag is the cause. Now use findstr to see which driver uses the tag.

    Microsoft explained this here in detail:

    Troubleshooting Pool Leaks Part 2 – Poolmon
    http://blogs.msdn.com/b/ntdebugging/archive/2012/08/30/troubleshooting-pool-leaks-part-2-poolmon.aspx

    I looked at some of those issues and new Samsung devices have a software Intellimem installed which uses the Pool tag ECMC in the driver intmsd.sys. Look if you also have this issue.

    "A programmer is just a tool which converts caffeine into code"

    Wednesday, October 16, 2013 6:49 PM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks Andre,

    I already went this route earlier, based on the other threads. 

    I have uninstalled Intellimem long time before, still ECMC is present and uses 1G or RAM. According to the search it is used by the Condusiv Technology Express Cache driver excsd.sys. I have made a screenshot of the Poolmon during one of the peaks of commit charge - see the link below.  

    https://skydrive.live.com/redir?resid=3C9E3E945C64AB9!443&authkey=!AP1LMOgLGUGnCPA&v=3

    Still, this driver is always using only 1Gb, while as you see from the screenshot it is 32G that I'm concerned with, and it is cache related, so it makes sense to use some RAM for this purpose, and I tried to disable the ExpressCache and it still had the same problem. 

    Where would you suggest to dig for it?

    I'm really suspicious that I have couple of processes on the top that combined have virtual size of 7Gb (two top are for nsi services and one for windowscommunicationsapps), right from the boot. When commit and physical ram is ~3.4Gb. I find it really strange.. my other systems (XP, Win7), initial (and consequent) RAM use is much lower.

    Wednesday, October 16, 2013 8:03 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    so the tag is also used by the driver for the Express cache.

    So you have 4 options:

    update the software and hope that new software has a fix, disable the SSD cache, replace the HDD with a real SSD or accept the issue and ignore it.

    About the commit, post real RMP data of RAMMap so that I can open them here on my PC and look at them.

    "A programmer is just a tool which converts caffeine into code"


    Thursday, October 17, 2013 5:18 AM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Andre,

    Thanks for your answer.

    I will disable the expresscache and make sure the tag is not appearing any more.

    Maybe it was a compound issue of Video driver AND Express cache.

    The driver is only supplied by Samsung and is outdated. Drivers from other brands laptops, such as Sony or SanDisk do not work instead of Samsung's version (tried that), while versioning is consistent.

    Will report back.

    I still wonder if those 7Gb of virtual memory is normal for Windows 8 services....

    Thursday, October 17, 2013 12:08 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    please export the data from RAMMap so that I can take a look at them.

    "A programmer is just a tool which converts caffeine into code"

    Thursday, October 17, 2013 6:51 PM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    If you mean this big file that I get by pressing save.. I'm not sure what goes into the file, so, if I share it, I would like to share it with you, not the whole world. Is there a way to send a private message to you or share it only with you on skydrive?

    I tried to make it smaller by exiting all the programs, still ended up 60Mb uncompressed.
    I switched off the Express Cache ( the ECMC tag was still there, so I also needed to manually disable the Express Cache service, which I did not do before). I got less RAM use (maybe ~1.6G after boot, a bit different distribution of the ram too). But it's too early to say, as it comes with time. Commit charge is at ~2.6G right now.

    I'll make sure to make an export when/if I get the commit bloat again.



    • Edited by RomSocial Friday, October 18, 2013 1:34 AM
    Thursday, October 17, 2013 9:31 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    ok, I got the data and the memory usage is better now.

    the nonpaged is still 400 which is a bit to high. paged pol usage of 400 is more common. The rest is fine now.

    "A programmer is just a tool which converts caffeine into code"



    Friday, October 18, 2013 5:42 AM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    The more I look at it, the more I think that now, that ExpressCache is disabled maybe it is normal.

    Before I was not switching Express Cache service and NVidia Video Driver was adding something as well.

    I even get commit charge go down when I close some programs... now it shows 40h of idle CPU time (guess it counts each core as 100% of time, cause I rebooted less than 12 earlier..) and commit is only 3.7Gb

    Friday, October 18, 2013 5:57 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    I made an edit. yeah RAM usage is better now.

    "A programmer is just a tool which converts caffeine into code"

    Friday, October 18, 2013 6:16 AM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    Ok, thanks a lot.

    I'll monitor it and see if it will start climbing again...

    So far 5G Commit with 2.2G Physical, after 60h which is not bad..

    Friday, October 18, 2013 5:38 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello Andre,

    So, after some time, my Commit slowly but surely went up to 20Gb, while Physical kept at ~2-3Gb.

    Poolmon does not show any changed.. And overall performance sometimes is really low...

    I've shared the RAMMap file, and would appreciate if could take a look at it, if you have some time.


    Sunday, October 20, 2013 5:05 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    I can't see the virtual memory usage from the log.

    Try to disable 3rd party tools until you find the tool which causes it.

    "A programmer is just a tool which converts caffeine into code"

    Sunday, October 20, 2013 7:25 PM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    Not sure what tools do you mean... I run Throttle Stop (to force my laptop to run full power when needed), Process Explorer (to see what's the status of RAM, commit and CPU), Skype, Chrome, sometimes Firefox / IE, Illustrator, Total Commander, FileZilla, Notepag ++ and accidentally some other apps.

    What would be the tools to view the virtual use? 

    I have tried to tally up the Virtual column in the Process explorer. It had 26,000,000Kb with commit 24Gb, then I closed almost all programs and I got 16,000,000Kb while Commit stayed at 20Gb. I can share the lists from Proc Explorer, if you think you could see something there.

    Sunday, October 20, 2013 9:52 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    how long does it take to get such a high commit?

    "A programmer is just a tool which converts caffeine into code"

    Monday, October 21, 2013 5:57 AM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    Right now, I have ~190h in the timer of the task manager (it counts 4 cores, so it's actual ~50h of active use)

    And I got 30.4Gb Commit right now - 2.5 physical RAM use.

    Of course the laptop was sleeping couple of times, so 3-4 days have passed.

    Monday, October 21, 2013 2:39 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    My commit charge went up to 36Gb (I had pagefile limit of 30Gb ) and at this moment Windows informs me that there's not enough RAM available, and actual Physical Ram goes up to the max. Eventually programs start to fail.. So, for now I increased my page file to 60Gb... well, I'll see where it goes...

    Is there any way to see what exactly is in the page file? 

    Are there any means to clean any occupied but maybe unclaimed commit charges?

    Tuesday, October 22, 2013 2:13 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Andre,

    What is the name of that program?

    Renee

    "MODERN PROGRAMMING is deficient in elementary ways BECAUSE of problems INTRODUCED by MODERN PROGRAMMING." Me

    Tuesday, October 22, 2013 3:25 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Andre,

    What is the name of that program?


    which program?

    "A programmer is just a tool which converts caffeine into code"

    Tuesday, October 22, 2013 4:47 AM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    post a picture of the ResourceMonitor when you have the issue.

    btw, do you use a Broadcom WIfi device?

    "A programmer is just a tool which converts caffeine into code"

    Tuesday, October 22, 2013 4:49 AM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Andre,

    Not broadcom, it seems, mine is:

    Intel Centrino Advanced N 6325

    Will upload and share the screenshot of processes..

    Tuesday, October 22, 2013 4:55 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    By the way, I summed up the total of my Virtual column for all processes and it still comes only to 23Gb, while my commit is a ~37Gb

    It does not really seem to correspond to commit charge, as right after boot, it is already much higher than my RAM, while commit is still close to actual RAM use of ~2Gb

    Tuesday, October 22, 2013 5:04 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    the screenshots are not helpful. I have no idea how to do a long term memory tracing because I never had such an issue.

    Play a bit with the startup tools until you may find out which programs leak the memory

    https://support.microsoft.com/kb/929135/en-us

    "A programmer is just a tool which converts caffeine into code"

    • Proposed as answer by Andre.ZieglerEditor Wednesday, October 23, 2013 6:04 AM
    • Marked as answer by RomSocial Wednesday, October 23, 2013 11:37 AM
    Tuesday, October 22, 2013 5:20 AM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks, Andre,

    Well, I can give it as much as 1/2 of the free space on my drive to keep it up with it's appetite. :)

    I already tried disabling stuff, but trying for couple of days without Wifi, for example might be complicated..

    I enabled all the RAM related columns in process explorer. What kind of draw my attention is Norton Onine Backup Service with 488M+ pagefaults. Not sure what these mean, but it sounds like not a good thing...

    • Proposed as answer by Andre.ZieglerEditor Wednesday, October 23, 2013 6:04 AM
    • Marked as answer by RomSocial Wednesday, October 23, 2013 11:37 AM
    Tuesday, October 22, 2013 5:42 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    That was it... I stopped and disabled this crappy service and after loong time, it disappeared from my task manager after long wait and suddenly, I saw that my commit is 3.6Gb with 2.4Gb physical...
    And I never even used this online backup.. it was supplied with the laptop. I uninstalled antivirus, but did not bother to remove this one.

    I started using computers with Norton commander... then Norton utilities... too bad Norton brand is loosing all my trust...



    • Edited by RomSocial Tuesday, October 22, 2013 6:03 AM
    • Proposed as answer by Andre.ZieglerEditor Wednesday, October 23, 2013 6:04 AM
    • Marked as answer by RomSocial Wednesday, October 23, 2013 11:37 AM
    Tuesday, October 22, 2013 6:02 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    How many programs are shown in this thread?

    

    "MODERN PROGRAMMING is deficient in elementary ways BECAUSE of problems INTRODUCED by MODERN PROGRAMMING." Me

    Tuesday, October 22, 2013 11:59 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Renee, 

    If you are asking which software is on the screenshot - it is RAMMap.

    Otherwise, maybe you should clarify your question(s).

    Tuesday, October 22, 2013 12:07 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    Nice to hear that you finally found the causing tool. I also don't use Norton tools any longer because of such issues.

    "A programmer is just a tool which converts caffeine into code"

    Wednesday, October 23, 2013 6:05 AM
    |
    Answerer
  • Question
    Sign in to vote
    0
    Sign in to vote

    That was it... I stopped and disabled this crappy service and after loong time, it disappeared from my task manager after long wait and suddenly, I saw that my commit is 3.6Gb with 2.4Gb physical...
    And I never even used this online backup.. it was supplied with the laptop. I uninstalled antivirus, but did not bother to remove this one.

    I started using computers with Norton commander... then Norton utilities... too bad Norton brand is loosing all my trust...



    Hello,

    Sorry for the trouble. I am Vineeth and I am from the Norton Support team.

    Can you tell me the Norton products installed on your computer? Can you provide us the memory dump so we can check?

    Thanks!

    Vineeth

    Norton Support

    Wednesday, October 23, 2013 1:58 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Vineeth, 

    Thanks for getting in touch on the subject.

    The exact software was Norton Online Backup 2.2.3.45, that was bundled with my Samsung Series 7 Notebook.

    I had the problem, discussed in this thread, ever since I bought it more than 1/2 year ago.

    What kind of dump do you need? Can you describe the process? I'm not sure I want to enable it back, as I never really used it at all, it was just running this "service", but maybe I have that already and could share it with you in private message.

    Wednesday, October 23, 2013 8:17 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    I encounted same issue

    WD Black SSHD + WD Boost.

    I edit registory.reduce commit charge

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hiosd\Params\DisableDramCache set to 1

    express cahce does not use non-paged pool and then use of ram

    but,express cache return allcated non-paged-pool to system when free memory is low.

    http://forums.lenovo.com/t5/IdeaPad-Y-U-V-Z-and-P-series/Any-Documentation-of-ExpressCache/td-p/1040355

    *exprescache's driver is excsd.sys(please replace hiosd to excsd)

    • Proposed as answer by jbh03215 Saturday, October 11, 2014 4:17 PM
    Saturday, October 11, 2014 4:16 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    I would block Condusiv Technology Express Cache as a potentially unwanted program. Lots of installers of late are sneaking in some spyware and worse.

    Scream at samsung to cleanup their act.


    MSFT Signature

    Place your rig specifics into your signature like I have, makes it 100x easier!

    Hardcore Games Legendary is the Only Way to Play!
    Vegan Advocate How can you be an environmentalist and still eat meat?

    Saturday, October 11, 2014 4:21 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    In my case Condusiv and their ExpressCache had nothing to do with the problem. 

    So far the memory leak was connected Norton Online Backup and was solved once it was uninstalled.

    Saturday, October 11, 2014 4:26 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    I suggest maybe using Blackblaze which seems to be less problematic compared to Norton


    MSFT Signature

    Place your rig specifics into your signature like I have, makes it 100x easier!

    Hardcore Games Legendary is the Only Way to Play!
    Vegan Advocate How can you be an environmentalist and still eat meat?

    Saturday, October 11, 2014 4:50 PM
    |
  • Question
    Sign in to vote
    1
    Sign in to vote

    I'm running Windows 10, bu had the exact same issue. Lots of physical memory (16GB), most of which was free, but a huge committed memory (25GB) that eventually triggered Out Of Memory errors. To resolve it:

    • Grab Sysinternals Process Explorer
    • Run as Administrator
    • Add the column Page Faults and sort by that
    • In my case the top entry was RunSwUSB and it had something like 13 million entries!

    I stopped that service and you can see the results immediately in the graph below.

    Wednesday, April 12, 2017 4:18 AM
    |