How to find source of memory leak in Windows 7?

Question

I've got a Windows 7 machine that keeps running low in RAM. I can see the free RAM going down over a few hours until the point the machine becomes unresponsive. I've checked the process list and none of them takes that much RAM.

I've also checked the number of handles per process and various other indicators but still can't find why the machine runs out of RAM.

Is there any good way to check how the memory is used in Windows?

Edit

Here is the result of tasklist a few minutes before the machine becomes unresponsive:

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0         24 K
System                           4 Services                   0        300 K
smss.exe                       196 Services                   0      1,024 K
csrss.exe                      272 Services                   0      4,336 K
wininit.exe                    320 Services                   0      4,184 K
csrss.exe                      332 Console                    1      3,516 K
winlogon.exe                   372 Console                    1      6,316 K
services.exe                   416 Services                   0      8,112 K
lsass.exe                      432 Services                   0     10,088 K
lsm.exe                        440 Services                   0      3,664 K
svchost.exe                    548 Services                   0      8,152 K
svchost.exe                    620 Services                   0      6,564 K
svchost.exe                    660 Services                   0     15,764 K
LogonUI.exe                    724 Console                    1     18,428 K
svchost.exe                    768 Services                   0      7,992 K
svchost.exe                    828 Services                   0      9,724 K
svchost.exe                    852 Services                   0     28,092 K
svchost.exe                    176 Services                   0     13,096 K
spoolsv.exe                    824 Services                   0     10,608 K
svchost.exe                    952 Services                   0     11,632 K
svchost.exe                   1076 Services                   0      8,524 K
fshoster32.exe                1120 Services                   0      9,148 K
fsorsp.exe                    1200 Services                   0      8,036 K
fsgk32.exe                    1324 Services                   0      3,084 K
cygrunsrv.exe                 1552 Services                   0      5,852 K
conhost.exe                   1864 Services                   0      2,996 K
sshd.exe                      1896 Services                   0      7,804 K
FSMA32.EXE                    2024 Services                   0      1,628 K
svchost.exe                   1320 Services                   0      5,092 K
fssm32.exe                    1704 Services                   0      2,196 K
FSHDLL64.EXE                  2120 Services                   0        644 K
SearchIndexer.exe             3260 Services                   0     13,596 K
sshd.exe                    138920 Services                   0      8,696 K
sshd.exe                    138448 Services                   0      8,696 K
sshd.exe                    138660 Services                   0      8,696 K
bash.exe                    137924 Services                   0      5,380 K
bash.exe                    137820 Services                   0      3,832 K
SAV32CLI.EXE                136344 Services                   0    133,868 K
WmiPrvSE.exe                139444 Services                   0      7,168 K
sshd.exe                    139672 Services                   0      8,692 K
sshd.exe                    139876 Services                   0      8,684 K
bash.exe                    139992 Services                   0      5,432 K
bash.exe                    140040 Services                   0      3,996 K
bash.exe                    140200 Services                   0      5,400 K
bash.exe                    139424 Services                   0      4,048 K
typeperf.exe                139300 Services                   0      5,372 K
sleep.exe                   138268 Services                   0      2,272 K
sshd.exe                    139612 Services                   0      7,168 K
sshd.exe                    137720 Services                   0      5,700 K
bash.exe                    139524 Services                   0      5,304 K
bash.exe                    138952 Services                   0      3,756 K
tasklist.exe                137580 Services                   0      5,164 K
bash.exe                    139460 Services                   0      5,452 K
bash.exe                    139796 Services                   0        104 K

At that point, wmic OS get FreePhysicalMemory /Value reports about 400 MB of free memory out of 2GB.

RamMap:

Task Manager:

Answer 1

The high memory usgae comes from a high Page table usage. To see which processes use it, install the Windows Performance Toolkit, open a command prompt as admin and run this command:

xperf -on ReferenceSet -BufferSize 1024 -MaxFile 512 -FileMode Circular  && timeout 5 && xperf -d MemUsage.etl

Open the MemUsage.etl with Windows Performance Analyzer (WPA.exe), drag and drop the graph "ResidentSet" from the left graph list to the analysis pane:

Now move the "Page Category" column to the left side and expand the "Page Table" entry:

Here you see the processes which have the high pagetable usage. On the right site (after the blue line), you see page table memory usage in MB for each process.

Answer 2

the only "strange" things i can see here are these:

• you have a process called scan.exe which hogs away 98% cpu right now
• you have a process called fssm32.exe which has 9 millions page faults. fssm32.exe looks like a program from the f-secure virus scanner.
• you also have a process called SAV32CLI.EXE which hogs away another 130mb+ of memory. it looks like you feel better protected to run 2 virus-scanners: f-secure and sophos at the same time.

the rammap-screenshot looks ok for me: you have a pool of ~400mb cached files, 85mb of them in active use, 300mb+ in standby mode (meaning they are freed as soon as you need more ram). looking at your amount of sshd.exe and bash.exe processes this looks legit as well.

the best way to learn the inner workings of how windows manages memory is this talk here: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2011/WCL405 .. you are already using some of the tools the speaker developed.