6

I noticed today that I had extremely high memory usage on windows 10 and couldn't find any process that uses a lot of memory.

Here is a screenshot of my memory usage:

enter image description here

And here is a screenshot of poolmon.exe

enter image description here

Can someone please tell me what is causing such high memory usage? Thanks!

Jonathan Beaudoin
  • 379
  • 1
  • 4
  • 19
  • Windows 10 is correct about the total memory used, but the processes/details page is almost always completely wrong. Generally, programs use a lot more then reported by windows, so closing some open programs free up some memory. To point out exactly whats taking so much memory, please take a screenshot of the "Details" tab after pressing the "Memory" once. This orders all the processes by memory use. – Matthew Dec 17 '15 at 20:48
  • As I said it provides no useful information at all, hence why I posted the poolmon screenshot. – Jonathan Beaudoin Dec 17 '15 at 23:26
  • Can I see what this useless information is please? – Matthew Dec 18 '15 at 00:42
  • the PRC, TOKE tags are too high. You need to run a xperf trace of the memory usage GROW after installing the WPT, which is part of the Windwos 10 SDK: https://dev.windows.com/en-us/downloads/windows-10-sdk: xperf -on BASE+Pool+ReferenceSet -stackwalk PoolAlloc+PoolFree -buffersize 2048 -MaxFile 2048 -FileMode Circular && timeout -1 && xperf -d C:\trace_pool_alloc.etl. Capture 1-2 minutes of te grow, zip the ETL file (to dramatically reduce the file size), upload the zip to OneDrive, create a share link and post the link here. – magicandre1981 Dec 18 '15 at 05:35
  • Just ran that since the issues happened again today. I uploaded it to my personal Dropbox. Direct link here: https://dl.dropboxusercontent.com/u/91292881/ShareX/2015/12/kernel.zip – Jonathan Beaudoin Dec 19 '15 at 22:35
  • were you able to find which process caused the high page table usage by disabling 3rd party tools? – magicandre1981 Dec 24 '15 at 08:00

1 Answers1

2

ok, there are several pool tags that are too high.

The PROC usage comes from wscsvc.dll!SetDefenderStatus calls from the security center service in Windows.

The toke usage MpCmdRun.exe (Microsoft Malware Protection Command Line Utility), which is also Windows Defender.

The io tag usage comes from the tool Agent.exe which calls the driver EuPipe.dll. Those files are part of EaseUS Todo Backup ("C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe")

the SeTd tag is also used by MpCmdRun.exe.

1 large part of the memory usage is the PageTable. But I can't see which process caused it. We had such issues already here and some 3rd party tool caused it. Disable all 3rd party tools/drivers until you found the program that causes the high page table usage.

Community
  • 1
magicandre1981
  • 98,168
  • 30
  • 181
  • 248