Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My system has a disease lately, where some process goes "red giant" for a short period of time. It allocates 4GB or so of memory which triggers windows 7 "low memory" warning, but finishes (or dies) too quickly for me to run taskmanager to see what it is.

This usually occurs when the machine ought to be idle.

I'd like to find a monitoring tool which can wait patiently for this to occur.

share|improve this question
Or ask easier questions. – ddyer Oct 18 '12 at 19:50
Use Process Explorer, from SysInternals, and sort by the Memory column. Sit back and watch. Once you've identified the culprit, use Process Monitor, also from SysInternals, and add a filter to watch for it to see what causes it. – user3463 Oct 18 '12 at 19:57
this usually occurs at 4am, and only once or twice a week. – ddyer Oct 18 '12 at 19:59
Use ProcDump from Sysinternals . See tutorials on using it starting at . – David Marshall Oct 18 '12 at 20:03
procdump looks promising, except that it needs to know what process to monitor, which is the primary question I want to answer. – ddyer Oct 18 '12 at 20:33

Once again Sysinternals Process Explorer to the rescue.

  1. Run process explorer (make sure to select "Show details for all processes" from the File menu).
  2. From the View menu select "Select Columns..."
  3. From the "Process Memory" tab, select "Peak Working Set"
  4. Sort the process list by "Peak Working Set" and wait. Once your memory hog does its thing, it should show up as the top item on the process list.


Two more things to try:

  1. Check your windows Application and System logs in the Event Viewer. Specifically look for Windows Error Reporting entries or others that may point to an memory issue.
  2. Process Monitor:
    1. start the monitor and set the filter up to include the operation "Process Exit". (You may also want to drop filtered events if its going to run for a while)
    2. Wait for the error, then check the log for any processes that exited with a status other than 0.
share|improve this answer
That's in the right direction, but the culprit is virtual size, not working set size, and this will only work if the process actually lives beyond it's bloat phase. – ddyer Oct 18 '12 at 20:25
@ddyer: Process Monitor, also from SysInternals, can keep a log for you to look at later. – martineau Oct 18 '12 at 20:46
process monitor doesn't seem to have memory filters – ddyer Oct 18 '12 at 21:05
@ddyer, see my updates – heavyd Oct 18 '12 at 22:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .