5

I've had a memory leak issue with Windows 10 for about a year now, but I really want to fix this now as it is having a sizable impact on my work.

As you can see from the picture below, I have 8GB of RAM. 92% of it is in use, even though the applications don't exceed 1GB.

I upgraded from Windows 7 Pro 64-bit to Windows 10 last year.

Ask for more details, I don't know what else to provide. I'm at a loss as to what could be causing this.

Details

5
  • have you tried my steps to see what causes your memory usage? Jan 12 '17 at 21:35
  • Sorry, not yet. I had to wait until I could download the necessary software since my data is restricted. I'll mark yours as the correct answer, as I'm confident it'll work well.
    – Shyy Guy
    Jan 12 '17 at 22:40
  • Possible duplicate of Windows 10 memory leaking
    – DanHolli
    Jan 15 '17 at 0:40
  • I've updated my answer to trace the pool usage Jan 19 '17 at 16:49
  • any update? have you extended the stack of the 4 tags? do you see anything useful? if not, zip the ETL and share (onedrive share link) the zip Feb 5 '17 at 8:14
11

1 large part of your high memory usage (2GB) comes from a high Page table usage.

enter image description here

To see which processes use it, install the Windows Performance Toolkit which is part of the Windows 10 SDK, open a command prompt as admin and run this command:

wpr.exe -start ReferenceSet -filemode && timeout 5 && wpr.exe -stop C:\MemUsage.etl

Open the MemUsage.etl with Windows Performance Analyzer (WPA.exe), expand the memory entry

enter image description here

drag and drop the graph ResidentSet from the left graph list to the analysis pane:

enter image description here

Now move the Page Category column to the left side and expand the Page Table entry:

enter image description here

Here you see the processes which have the high pagetable usage. On the right site (after the blue line), you see page table memory usage in MB for each process.

Also the combined (non-)paged pool usage is nearly 2GB.

Install the WDK, Run poolmon (C:\Program Files (x86)\Windows Kits\10\Tools\x64\poolmon.exe), sort the data via P after pool type so that non paged/next time paged is on top and via B after bytes to see the tag which uses most memory.

Now look which pooltag uses most memory as shown here:

enter image description here

Now open a cmd prompt and run the findstr command. To do this, open cmd prompt and type "cd C:\Windows\System32\drivers", without quotes. Then type "findstr /s __ .", where __ is the tag (left-most name in poolmon). Do this to see which driver uses this tag:

enter image description here

Now, go to the drivers folder (C:\Windows\System32\drivers) and right-click the driver in question (intmsd.sys in the above image example). Click Properties, go to the details tab to find the Product Name. Look for an update for that product.

Fixing both issues could get nearly 4GB back.

Based on your screenshot on stackoverflow, 4 tags (VoSM, FILE, Ntfx and Proc) which belong to Windows functions.

Copy/paste this text to a new txt file and rename it to PoolTagLeak.wprp

<?xml version="1.0" encoding="utf-8"?>
<WindowsPerformanceRecorder Version="1.0" Author="MagicAndre1981" Copyright="MagicAndre1981" Company="MagicAndre1981">
  <Profiles>
    <SystemCollector Id="SystemCollector" Name="NT Kernel Logger">
      <BufferSize Value="1024" />
      <Buffers Value="1024" />
    </SystemCollector>
    <SystemProvider Id="SystemProvider">
      <Keywords>
        <Keyword Value="Pool" />
      </Keywords>
      <Stacks>
        <Stack Value="PoolAllocation" />
        <Stack Value="PoolAllocationSession" />
      </Stacks>
      <PoolTags>
        <PoolTag Value="VoSM"/>
        <PoolTag Value="File"/>
        <PoolTag Value="Ntfx"/>
        <PoolTag Value="Proc"/>
      </PoolTags>
    </SystemProvider>
    <Profile Id="PoolUsage.Verbose.File" Name="PoolUsage" Description="Pool usage Tag 'Leak' " LoggingMode="File" DetailLevel="Verbose">
      <Collectors>
        <SystemCollectorId Value="SystemCollector">
          <SystemProviderId Value="SystemProvider" />
        </SystemCollectorId>
      </Collectors>
    </Profile>
    <Profile Id="PoolUsage.Verbose.Memory" Name="PoolUsage" Description="Pool usage Tag 'Leak'" Base="PoolUsage.Verbose.File" LoggingMode="Memory" DetailLevel="Verbose" />
  </Profiles>
</WindowsPerformanceRecorder>

Now run wpr.exe -start C:\PoolTagLeak.wprp && timeout 600 && wpr.exe -stop C:\PoolusageUsage.etl and try to repro the usage grow.

Drag & Drop the Pool Graph to the analyze pane, order the columns to Type, Pooltag, Stack.

enter image description here

Now go to AIFO (allocated inside, freed outside, so this is a possible leak), find your 4 tags and expand the stack to see which functions do this tag use. Based on the names of the functions you can see the "cause". In my demo, the Thre tag (Thread) is used by AVKCl.exe from G-Data because it starts a lot of threads. Look for driver/program updates to fix it.

11
  • @ShyyGuy in win10, ReferenceSet works, you used an old WPT version Jan 19 '17 at 5:41
  • @magicandre1983, did it. The highest values are EtwB at 1023MB, File at 79MB, VoSm at 36MB, Proc at 12MB, etc. For EtwB, it's giving me an N/A under the stack column. I tried searching for it in the drivers folder, but no results.
    – Shyy Guy
    Jan 19 '17 at 19:00
  • ignore this ETWb one, this is used to capture the trace by wpr Jan 19 '17 at 19:13
  • My Page Table is now 12GB big and in ResidentSet I can see it's all taken by process "Unknown" (-1). Any ideas how to identify the real source? The poolmon didn't find anything big.
    – icl7126
    Feb 5 '17 at 12:55
  • 1
    @icl7126 do some trial & error to see which program causes it. I know that Lenovo "RapidBoot Shield" causes it. Feb 5 '17 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.