locked
System PID 4 consumes all physical memory RRS feed

  • Question

  • Hello

    I have recently encountered an issue where the System process (PID) 4 consumes almost all of the 4GB of physical memory.

    About 3 months ago the workstation was upgraded with a PCI-e based SSD card and had Windows 7 Ultimate x64 installed. After a month, I noticed that within 15 minutes of booting the system process has a working set of 3GB. Task manager reports that, out of 4094MB, 205MB is cached, 192MB is available, and 1MB is fee. The "Working Set (Memory)" column in the process tab of the task manager shows PID 4 using 2.8GB of memory. This is coupled with fairly constant disk activity. The resource monitor shows that the pagefile is constantly being read from and written to. I moved the pagefile from the SSD to a 6x 400GB RAID 0+1 but made no difference. When I first started diagnosing the issue I turned off system protection on all drives and deleted any snapshots. For about 2 weeks after this memory usage returned to normal, then the system process started using all available memory again.

    Although no programs ever complain about the lack of memory, and the system doesn't respond poorly, but having such a low amount of cached and available memory left 15 minutes after log on without opening a single application couldn't be intentional?

    Is this normal activity? How can I review what the system process is doing with all that memory? Is the pagefile only active because the machine has no physical memory left?

    Any help would be appreciated.

    Thursday, January 20, 2011 12:07 PM

Answers

  • Thanks André, unfortunately the USB 3.0 drivers that I am using are the latest available from the vendor.

    Fortunately, the issue is not related to hardware.

    For anybody experiencing high system process memory usage (and subsequent pagefile thrashing,) I was able to correct the problem by deleting and recreating the partition of an external HDD used for backups. During pagefile trashing, the System Volume Information folder on this external HDD was also getting a lot of IO.

    This is what I found out during the investigation:

    1) I could copy files via Windows Explorer to and from the external drive and the issue would not occur.

    2) Using the command "vssadmin list shadowstorage" while the external drive was attached would cause the issue.

    3) Playing DVD files from the external drive (IFO/VOB) using Windows Media Player would cause the issue.

    4) Trying to delete the partition from the external HDD would cause the issue.

    5) Connecting the external HDD to another Windows 7 machine and doing 2, 3, or 4, would cause the issue on that machine.

    6) Removing the HDD from the external USB 3.0 case and connecting it to an on-board SATA controller and then attempting 2, 3, or 4, would cause the issue.

    7) Physically disconnecting the drive from the machine while the issue was occuring would result the INSTANT release of all memory used by the system process.

    8) Turning off the write cache (optimising for quick removal) for the external drive made no difference.

    9) A boot time check disk indicated the file system was ok.

    I resolved the issue by connecting the HDD to a Linux machine and using gparted to delete the partition. I then connected the drive back to the Windows 7 machine, created a new simple volume (with 64k cluster size, as was the case previously and also with the identical drive) and the problem has not occurred since.

    I have backed up both the SSD and RAID to both external drives using Windows 7 Backup and Restore and Nero BackItUp using both file backup and image backup methods, neither has caused the issue to come back.

    Looks like, in this case, it was corrupted information located in the System Volume Information folder.

    Thanks...


    B
    • Marked as answer by piscesbjf Wednesday, January 26, 2011 8:14 PM
    Wednesday, January 26, 2011 8:14 PM

All replies

  • Please download RAMMap [1][2] and run it when you have the high Memory usage. Now save the data as a RMP file. Zip the RMP file and upload the zip to your SkyDrive [3] and post a link here.

    André

    [1] http://technet.microsoft.com/en-us/sysinternals/ff700229.aspx
    [2] http://blogs.technet.com/b/askperf/archive/2010/08/13/introduction-to-the-new-sysinternals-tool-rammap.aspx
    [3] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Thursday, January 20, 2011 1:04 PM
  • Thanks for your response, André.

    I will test this out and have a reply within the next 6 hours.


    B
    Friday, January 21, 2011 1:24 AM
  • Hi André.

    I have uploaded the file as requested. http://cid-30e1fd16214acf16.office.live.com/self.aspx/.Public/RamMap%20Save.zip

    I took a brief look at the utility but couldn't really work out where the memory was going.

    Thanks again,

    Bryan


    B
    Friday, January 21, 2011 3:35 AM
  • Hi Bryan ,

    the shared Memory usage is too high:

    Shared Memory: Pages that have been marked as shared can be used by multiple processes.

    But I can't see the process which casues this.

    Does it also occur when use the CleanBoot [1] approach to eliminate 3rd part drivers/tools?

    André

    [1] http://support.microsoft.com/kb/929135


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, January 21, 2011 2:02 PM
  • Hey André

    I may have had some luck in tracking down the fault in this case.

    Yesterday the machine was left for about 2 hours after a fresh boot and log in. The System process working set had only peaked at 12MB. I then tried to play a DVD file with Windows Media Player from an external USB 3.0 HDD. Windows Media Player becomes unresponsive and the System working set starts to rise until there is nothing left and then starts thrashing the pagefile. I rebooted. This time about 20 minutes after the reboot a Nero BackItUp 4 Autobackup started, which writes to another identical model USB 3.0 HDD on the same USB host controller. The backup completes successfully (it actually creates a snapshot according to vssadmin), but again when the external drive is accessed the System process working set goes through the roof. I have seen instances where it does release some memory, where the peak has been 3.2GB but the the current working set is only 800MB.

    So I have turned the drives off, suspended the backup, and 6 hours into a session the System process has a current working set of 304K.

    The question is, how do I isolate exactly what it is inside the System process that is requiring all this memory. If it is the USB host controller I can contact the vendor. The strange thing is that I can copy a file from a network location to the either external drive without setting the System process off. I just don't why know it only starts when a VSS-style backup runs or a DVD file is played through Media Player. Other media plays fine from the external drives.

    Can you suggest any other way that might help me pinpoint exactly what inside the System process is doing this?

    Thanks,

    Bryan


    B
    Saturday, January 22, 2011 12:18 AM
  • Can you suggest any other way that might help me pinpoint exactly what inside the System process is doing this?

    because it always happen when you use USB3.0 devices, update the USB3.0 driver.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Marked as answer by Magon Liu Wednesday, January 26, 2011 2:45 AM
    • Unmarked as answer by piscesbjf Wednesday, January 26, 2011 7:59 PM
    Saturday, January 22, 2011 12:16 PM
  • Hi,

     

    Thanks for posting in Microsoft TechNet forums.

    As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as ‘Answered’ as the previous steps should be helpful for many similar scenarios. If the issue still persists, please feel free to  reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish.

    BTW,  we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems. Thanks for your understanding and efforts.

     

    Best Regards

    Magon Liu

    TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    Monday, January 24, 2011 2:37 AM
  • Thanks André, unfortunately the USB 3.0 drivers that I am using are the latest available from the vendor.

    Fortunately, the issue is not related to hardware.

    For anybody experiencing high system process memory usage (and subsequent pagefile thrashing,) I was able to correct the problem by deleting and recreating the partition of an external HDD used for backups. During pagefile trashing, the System Volume Information folder on this external HDD was also getting a lot of IO.

    This is what I found out during the investigation:

    1) I could copy files via Windows Explorer to and from the external drive and the issue would not occur.

    2) Using the command "vssadmin list shadowstorage" while the external drive was attached would cause the issue.

    3) Playing DVD files from the external drive (IFO/VOB) using Windows Media Player would cause the issue.

    4) Trying to delete the partition from the external HDD would cause the issue.

    5) Connecting the external HDD to another Windows 7 machine and doing 2, 3, or 4, would cause the issue on that machine.

    6) Removing the HDD from the external USB 3.0 case and connecting it to an on-board SATA controller and then attempting 2, 3, or 4, would cause the issue.

    7) Physically disconnecting the drive from the machine while the issue was occuring would result the INSTANT release of all memory used by the system process.

    8) Turning off the write cache (optimising for quick removal) for the external drive made no difference.

    9) A boot time check disk indicated the file system was ok.

    I resolved the issue by connecting the HDD to a Linux machine and using gparted to delete the partition. I then connected the drive back to the Windows 7 machine, created a new simple volume (with 64k cluster size, as was the case previously and also with the identical drive) and the problem has not occurred since.

    I have backed up both the SSD and RAID to both external drives using Windows 7 Backup and Restore and Nero BackItUp using both file backup and image backup methods, neither has caused the issue to come back.

    Looks like, in this case, it was corrupted information located in the System Volume Information folder.

    Thanks...


    B
    • Marked as answer by piscesbjf Wednesday, January 26, 2011 8:14 PM
    Wednesday, January 26, 2011 8:14 PM
  • ok, thanks for the Feedback :) Nice to hear that you fixed it.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, January 26, 2011 10:24 PM