10

I've got a Windows 7 machine that keeps running low in RAM. I can see the free RAM going down over a few hours until the point the machine becomes unresponsive. I've checked the process list and none of them takes that much RAM.

I've also checked the number of handles per process and various other indicators but still can't find why the machine runs out of RAM.

Is there any good way to check how the memory is used in Windows?

Edit

Here is the result of tasklist a few minutes before the machine becomes unresponsive:

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0         24 K
System                           4 Services                   0        300 K
smss.exe                       196 Services                   0      1,024 K
csrss.exe                      272 Services                   0      4,336 K
wininit.exe                    320 Services                   0      4,184 K
csrss.exe                      332 Console                    1      3,516 K
winlogon.exe                   372 Console                    1      6,316 K
services.exe                   416 Services                   0      8,112 K
lsass.exe                      432 Services                   0     10,088 K
lsm.exe                        440 Services                   0      3,664 K
svchost.exe                    548 Services                   0      8,152 K
svchost.exe                    620 Services                   0      6,564 K
svchost.exe                    660 Services                   0     15,764 K
LogonUI.exe                    724 Console                    1     18,428 K
svchost.exe                    768 Services                   0      7,992 K
svchost.exe                    828 Services                   0      9,724 K
svchost.exe                    852 Services                   0     28,092 K
svchost.exe                    176 Services                   0     13,096 K
spoolsv.exe                    824 Services                   0     10,608 K
svchost.exe                    952 Services                   0     11,632 K
svchost.exe                   1076 Services                   0      8,524 K
fshoster32.exe                1120 Services                   0      9,148 K
fsorsp.exe                    1200 Services                   0      8,036 K
fsgk32.exe                    1324 Services                   0      3,084 K
cygrunsrv.exe                 1552 Services                   0      5,852 K
conhost.exe                   1864 Services                   0      2,996 K
sshd.exe                      1896 Services                   0      7,804 K
FSMA32.EXE                    2024 Services                   0      1,628 K
svchost.exe                   1320 Services                   0      5,092 K
fssm32.exe                    1704 Services                   0      2,196 K
FSHDLL64.EXE                  2120 Services                   0        644 K
SearchIndexer.exe             3260 Services                   0     13,596 K
sshd.exe                    138920 Services                   0      8,696 K
sshd.exe                    138448 Services                   0      8,696 K
sshd.exe                    138660 Services                   0      8,696 K
bash.exe                    137924 Services                   0      5,380 K
bash.exe                    137820 Services                   0      3,832 K
SAV32CLI.EXE                136344 Services                   0    133,868 K
WmiPrvSE.exe                139444 Services                   0      7,168 K
sshd.exe                    139672 Services                   0      8,692 K
sshd.exe                    139876 Services                   0      8,684 K
bash.exe                    139992 Services                   0      5,432 K
bash.exe                    140040 Services                   0      3,996 K
bash.exe                    140200 Services                   0      5,400 K
bash.exe                    139424 Services                   0      4,048 K
typeperf.exe                139300 Services                   0      5,372 K
sleep.exe                   138268 Services                   0      2,272 K
sshd.exe                    139612 Services                   0      7,168 K
sshd.exe                    137720 Services                   0      5,700 K
bash.exe                    139524 Services                   0      5,304 K
bash.exe                    138952 Services                   0      3,756 K
tasklist.exe                137580 Services                   0      5,164 K
bash.exe                    139460 Services                   0      5,452 K
bash.exe                    139796 Services                   0        104 K

At that point, wmic OS get FreePhysicalMemory /Value reports about 400 MB of free memory out of 2GB.

RamMap:

enter image description here

Task Manager:

enter image description here

  • 1
    Can you restart your computer and post a screenshot of your Task Manager processes? And make sure to display processes from all users please. If you have more than 50-60 after a reboot then there are definitely things you can do but if nothing looks fishy then things could get tricky.. – MonkeyZeus Jun 4 '14 at 18:41
  • 1
    Are you running out of virtual memory or physical memory. The solution and cause are different. A low virtual memory warning is a configuration problem, being low on physical memory, means you have to many processes running. – Ramhound Jun 4 '14 at 18:41
  • 1
    Do you have any evidence that the cause is a memory leak? It sounds like you have good evidence that it's not a memory leak. (Though it could be a busted driver, I guess.) – David Schwartz Jun 4 '14 at 19:01
  • Thanks for the feedback. I've added some more info to the post, in particular the task list. It is the free physical memory that keeps going down over time. Is it possible to check how it is used? – laurent Jun 4 '14 at 19:15
  • 1
    post screenshots of RAMMAp: technet.microsoft.com/en-us/sysinternals/ff700229.aspx – magicandre1981 Jun 5 '14 at 4:07
8

The high memory usgae comes from a high Page table usage. To see which processes use it, install the Windows Performance Toolkit, open a command prompt as admin and run this command:

xperf -on ReferenceSet -BufferSize 1024 -MaxFile 512 -FileMode Circular  && timeout 5 && xperf -d MemUsage.etl

Open the MemUsage.etl with Windows Performance Analyzer (WPA.exe), drag and drop the graph "ResidentSet" from the left graph list to the analysis pane:

enter image description here

Now move the "Page Category" column to the left side and expand the "Page Table" entry:

enter image description here

Here you see the processes which have the high pagetable usage. On the right site (after the blue line), you see page table memory usage in MB for each process.

  • in windows8.1 i do not see 'residentset' as an available graph-option. how can i get it? a different xperf-flag? – akira Jun 19 '14 at 10:07
  • i answer my own comment: update xperf. – akira Jun 19 '14 at 10:29
  • This doesn't work for me in Windows 7 - the first call to xperf gives xperf: error: NT Kernel Logger: Invalid flags. (0x3ec). – benshepherd Jul 15 '14 at 7:42
  • @benshepherd for me it works. Make sure you use the latest WPT from the 8.1 SDK: dropbox.com/s/e5ol59a6n9g3ctb/Win7_xperf.png – magicandre1981 Jul 15 '14 at 17:54
  • 1
    I eventually discovered the problem, it was Lenovo "RapidBoot Shield" and removing it solved my problem: superuser.com/a/850346/79763 – sparrowt Dec 9 '14 at 10:09
0

the only "strange" things i can see here are these:

  • you have a process called scan.exe which hogs away 98% cpu right now
  • you have a process called fssm32.exe which has 9 millions page faults. fssm32.exe looks like a program from the f-secure virus scanner.
  • you also have a process called SAV32CLI.EXE which hogs away another 130mb+ of memory. it looks like you feel better protected to run 2 virus-scanners: f-secure and sophos at the same time.

the rammap-screenshot looks ok for me: you have a pool of ~400mb cached files, 85mb of them in active use, 300mb+ in standby mode (meaning they are freed as soon as you need more ram). looking at your amount of sshd.exe and bash.exe processes this looks legit as well.

the best way to learn the inner workings of how windows manages memory is this talk here: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2011/WCL405 .. you are already using some of the tools the speaker developed.

  • 1
    my Microsoft contacts (Microsoft Premier Field Engineers) also told me that several 100MB of page table are not normal for Windows. – magicandre1981 Jul 30 '14 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.