Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I already know what's causing this -- it's the driver for FancyCache, which I'd installed myself.

But as you can see, nothing in the screenshot tells me anything about this. I just happen to know.

So the question is, if I didn't know this, how would I figure out what's using up so much of my RAM?

(For reference: It's currently 1.7 GiB used, and the "missing" amount -- for FancyCache -- is 512 MiB. Clearly, that extra half-gigabyte not showing up anywhere I can see below.)

Screenshot

share|improve this question
    
What makes you think your memory is used up? –  Oliver Salzburg Jun 28 '12 at 0:37
1  
@OliverSalzburg: Uhm, feel free to substitute whatever word suits your fancy. Regardless of the terminology you like, though, I think the question is pretty clear. –  Mehrdad Jun 28 '12 at 0:38
    
I'm not arguing terminology. I just see 72% of your memory unused (that's what I assume, I'm not familiar with Process Hacker). I'm confused about what the problem is. –  Oliver Salzburg Jun 28 '12 at 0:40
    
@OliverSalzburg: Oh. The problem is that it's normally 1.2 GiB (i.e. when FancyCache is off), not 1.7 GiB. So I know the where the extra memory is going, but my question is, how would I figure this out if I didn't already know the answer? –  Mehrdad Jun 28 '12 at 0:41
1  
@OliverSalzburg: Why are you marking this as a duplicate when we already figured out RAMMap isn't helping us? –  Mehrdad Jun 30 '12 at 3:55
show 22 more comments

2 Answers

Actually, it looks as if I was wrong; there is a way to monitor memory allocations by device drivers, using Driver Verifier. This tool is built into all current versions of Windows. Although it was designed and documented for programmers to debug device driver problems, there seems to be no reason you couldn't use it to find which device driver is using the "missing" memory.

You can bring up the Driver Verifier Manager simply by typing "verifier" in the Start Menu or at a command prompt. You'll need to run it with elevated privilege, i.e., by pressing control-shift-ENTER at the Start Menu or by running it from an elevated command prompt. The "Create standard settings" option should be appropriate; you can then select the drivers to be monitored (basically, any that you are suspicious of; all non-Microsoft drivers would often be a sensible choice). Default verification options are applied, including pool tracking. Since the memory you're interested in is already allocated, you'll need to reboot.

Once you've rebooted, run the Driver Verifier Manager again and select "Display information about the currently verified drivers". Click Next until you get to the "Counters specific to each of the currently verified drivers" page and go through the drivers until you find one with lots of allocated memory. Hopefully, it will be the driver for FancyCache.

Because kernel mode is kernel mode, I don't think that Driver Verifier will always work; it relies on the drivers following the rules, at least approximately. There are probably various oddball methods a driver could use to allocate memory that will evade Driver Verifier's counters. But it should work most of the time.

share|improve this answer
    
I just tried that, rebooted, and got a BSOD with error 0x000000C4. :( –  Mehrdad Jun 29 '12 at 1:44
    
Ouch. Sorry about that. (In my defense, though, I'm fairly sure that means one of the selected drivers is buggy.) Hopefully you were able to boot to safe mode and run Driver Verifier Manager to turn verification back off again? –  Harry Johnston Jun 29 '12 at 2:11
    
Haha don't worry, that's what I did. It was just funny. :-) +1, I knew this tool existed but I'd never used it (or even thought to). Seems very handy! –  Mehrdad Jun 29 '12 at 2:13
    
It might work (i.e., not trigger a bugcheck!) even with slightly buggy drivers if you use the custom option and only turn on the pool tracking without any of the other checks. –  Harry Johnston Jun 30 '12 at 3:47
    
I'll give it a try when I get the chance, thanks. I'm gonna need a bit of time since I have no idea how much trial/error this is going to need. :) –  Mehrdad Jun 30 '12 at 3:56
add comment

After reading up on FancyCache, at a guess I'd say that because it's a driver rather than a process, it's not going to show up in the process list directly. It does however use RAM to cache disk access, so whatever you configure it with is what's going to disappear from available memory, and perhaps windows is reporting this backwards somehow. Again, the system drivers do require some memory to do what they do, and this may not directly show up in the process list (they're not directly processes remember - you don't see drivers for your network card or video adaptor show up in the process list either, remember...)

I also note that your screenshot above shows only the Working Set size. This is only one type of memory, which is useful to describe for most processes, but may not show the whole picture in some edge cases (such as this.)

Anyway, upshot is that memory management in modern OSs is terrifyingly complex, so when you throw in a system filter driver which uses half a gig as a cache and it doesn't show up in a third party process list utility as you might expect given how applications normally show up, don't be surprised or upset - it's just how it is :)

share|improve this answer
1  
Yes, we already determine all that in the comments above. The question is how to actually observe and measure the memory usage of a driver. –  Synetech Jun 28 '12 at 4:03
    
I don't know of any way you can; since the driver runs in the context of the kernel, all drivers probably share the same accounting/pool with mallocs etc. If you had something that could start at that drivers entry points and counted memory references and usage you could probably tell. I think if you force the OS to crashdump and use windbg to examine the dump file you can probably do a one off inspection, but I know nothing like task manager that would show you that info as the OS is running live. Looks like someone just answered above with a windows util that does this though, so... –  Jon Kloske Jul 4 '12 at 0:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.