[ProcMon][3.53] High memory usage with Drop Filtered Events enabled RRS feed

  • Question

  • Windows 2012 R2

    Server has 32 core and 512GB.

    Was running a long capture for a specific file path for a repro. drop filtered events and advanced output enabled.  Backing was to a file instead of memory. The backing pml file was only 4 MB, yet Procmon ended up consuming over 172 GB, which is obviously a problem if this asset didnt have 512 GB. 

    Bug that so much memory was consumed given drop filtered events is enabled?

    Thursday, February 6, 2020 8:20 PM

All replies

  • I don't think that is a bug.. I think that being the system equipped with so much memory ProcMon used it in order to delay as much as possible the write to the disk which obviously is the thing that most impact system's performance..

    If you try the same on a system with 4 or 8 GB of ram it will start write almost immediately to the disk.. as you expect..


    Friday, February 7, 2020 7:41 AM