Win 7 64bit unusually high ram usage (7GB at idle)

Question

I have a brand new machine with 128GB ram and only Win 7 64 bit OS installed along with relevant hardware drivers etc. There is no other software installed. it has a Samsung 850 Pro EVO SSD as the primary Hard Drive and dual GTX980 in SLI. When I start the computer up it is using 7GB ram leaving me with only 121GB available. All my other machines only use about 2-2.5gb ram at idle.

I need this ram for processing large (120GB) datasets using photogrammetry software and not for making other software start faster (for which none are installed)????!!

I checked all the running process in task manager and it does not add up to 7GB. there simply cant be 7GB of software that need to be loaded in RAM. How do I see what's using this ram and more importantly stop it from using the ram?

Added screen shot of rammap - large nonpaged pooled allocation. how do I get rid of this

Poolmon shows nothing greater than 30MB using nonpool pages. There isn't 5GB of nonpool pages in poolmon. I presume there is no memory leak.

Any other Ideas?

Answer 1

You have a memory leak caused by a driver. Look at the high value of nonpaged kernel memory. In your case this is over 5.6 GB. You can use poolmon to see which driver is causing the high usage.

Install the Windows WDK, run poolmon, sort it via P after pool type so that non paged is on top and via B after bytes to see the tag which uses most memory. Run poolmon by going to the folder where WDK is installed, go to Tools (or C:\Program Files (x86)\Windows Kits\8.1\Tools\x64) and click poolmon.exe.

Now look which pooltag uses most memory as shown here:

Now open a cmd prompt and run the findstr command. To do this, open cmd prompt and type "cd C:\Windows\System32\drivers" to go to the drivers directory, without quotes. Then type findstr /s __ *.*, where __ is the tag that you see in poolmon.

After doing this to see which driver uses this tag:

Now, go to the drivers folder (C:\Windows\System32\drivers) and right-click the driver in question (intmsd.sys in the above image example). Click Properties, go to the details tab to find the Product Name. Look for an update for that product.

If you can't find a driver to the pooltag, look in the pooltag.txt if the tag is used by a Windows driver.

Here you need to capture a grow of the pool usage with xperf. First, you have to install the Windows Performance Toolkit. Next open a cmd prompt (cmd.exe) as admin and run this:

xperf -on BASE+Pool -stackwalk PoolAlloc+PoolFree -buffersize 2048 -MaxFile 1024 -FileMode Circular && timeout -1 && xperf -d C:\trace_pool_alloc.etl

Now open it in WPA.exe, load the debug symbols and look for the tag that you saw in poomon under AIFO (allocated insde freed outside) and expend the stack. From the function names you may have any idea what is going on.

In this example the FILE tag usage comes from a tool called locate32 which scans the HDD to build up its search index.