Track ALL memory usage in Win7?

C

createcoms

Weaksauce
Joined
Mar 14, 2004
Messages
90
Hi guys, Trying to figure out where a memory leak is and lack of information is a problem. I understand that the memory usage is comprised of the processes shown in task manager and also there is the cached allocation to speed things up but something is using memory that cannot be accounted for between those two. The main task manager memory usage counter will slowly go up (takes several days to chomp it's way through 16GB of RAM) but running quick n dirty maths on all the processes leaves (after several days) a massive shortfall. The performance of the system gets quite bad once this leak reaches the point where the windows cache is all gone and there is nothing but what the applications had already taken plus this boogey monster allocation. Is there a program which could potentially shed more light on exactly where the ram is being held? Obviously it's possible to allocate memory in such a way that does not show in task manager and I guess I want to show those allocations in broad daylight. thnks! -cc
 
RAMMap is showing the full picture, but now I have to try to understand exactly what I'm seeing (doh). I will report back when more is known....
 
Process Explorer or Monitor don't seem to be showing me where the memory is being used evilsofa.

Example:

RAMMap shows 700MB nonpaged pool but those two programs don't attribute the listed processes (when looking at the nonpaged pool column, once enabling it) to anything even close to that usage.
 
Are you running Process Explorer with the "Show Details for All Processes" option on in the "File" menu?
 
Strange observation:

Task manager shows at time of writing this, 540MB of Paged Kernel memory in use and 81MB of Nonpaged Kernel memory in use.

However RAMMap says Nonpapged Pool is actually 715MB right now.

Using PoolMon off WinDDK, the figures reported by Poolmon are similar to Task Manager - there is nothing showing usage even remotely close to 700+MB worth of nonpaged usage.

So I guess the question now is, how can 700MB of RAM be used in such a way that RAMMap thinks it's nonpaged pool but task manager and PoolMon (and process explorer, etc) can't see it?
 
I realised that I could easily be looking at the wrong things at this stage because the leak was so slow and all the fiddling I've done in the past 24 hours has meant plenty of rebooting. I've applied a couple of hotfixes related to memory leaks and updated drivers so in the interests of not chasing my tail - I'll come back to this in a weeks time when the system uptime is several days old :)
 
If you're trying to trace down a memory leak in your program, try running app verifier on it.
 
AFAIK it's not a program that's doing it because the memory usage was not attributed to a process. It's got to be a driver or an AWOL kernel component.
 
IE9 seems to be one on my box both @ home and @ work. I can open a bunch of pages and it goes up quiet a bit even after closing those tabs then when I close IE I get a bunch of memory back but not everything!
 
Leak seems to be gone (Uptime is 5 days 23 hours) with memory usage looking very civil (cached allocation is at 10GB which is pretty sweet and system is feeling very smooooth).

What did I do? Well first step was to use driverview to go through every non-microsoft driver and firstly question it's existence (so if I have no need for it to be loading I nuked it), secondly I would update it where possible (several were updated). I updated both lots of drivers, those for hardware and those that simply enable a low level function (like disc burning for example).

I also applied a hotfix that specifically mentioned memory leaks, the post was actually a HardForum post a while back which google brought up in one of over a dozen searches I made when chasing this. http://hardforum.com/showthread.php?t=1494496

I hope this thread is useful to others chasing memory leaks (that task manager doesn't show). I'm sorry I was unable to change one thing and then test as this would have dragged it out for potentially weeks and weeks which TBH I didn't have the patience for so I just did everything I could and it seems to have worked.
 
You must log in or register to reply here.
Back
Top