8
2
Every few days of uptime the memory usage of my PC increases without any obvious reason. Here is a typical memory usage reading after 4 days of uptime:
However, I've tried to trace the offending application causing any potential memory leaks. Task Manager lists the highest app usage from Google Chrome (with only ~200MB usage):
Closing other apps still leaves 62% mysteriously in use:
Meanwhile, poolmon.exe shows CM16 and Proc tags are listed using high amounts of memory in the Paged and Nonpaged pools, respectively:
Strangely, restarting the PC clears up memory usage, but shutting down and starting up doesn't. I assume this is due to the "fast startup" feature, but I'm not sure why it would affect memory usage.
If it matters, I am also using CleanMem as I assumed it would help alleviate any memory leak problems.
Given these, how could I pinpoint what is causing high memory usage in my system?
UPDATE: I tried to run xperf to view stack traces on the pool tags, as suggested in a comment, but I am not sure what to make of what I have found:
InstilledBee
Posted 2017-11-18T06:32:30.983
Reputation: 91
I still get ~62% memory usage even without any apps open: Screenshot
– InstilledBee – 2017-11-18T07:43:47.937Antivirus shows more memory usage. It does need more RAM. – Biswapriyo – 2017-11-18T08:43:39.817
@Biswa I am not sure what you mean with needing more RAM? My PC has 8GB installed. – InstilledBee – 2017-11-18T08:53:40.200
1
use xperf/WPA to analyze the usage of CM16 and Proc tag
– magicandre1981 – 2017-11-18T17:28:03.917@magicandre1981 Thanks for the tip but I'm not sure what to make of the stack traces. I see ntdll.dll and N/A for some entries. – InstilledBee – 2017-11-24T15:54:30.120
Submit the information to pastebin or a similar service. Be sure you follow the steps Andre already provided in his linked answer – Ramhound – 2017-11-24T15:56:59.790
Is it safe to share the *.etl files publicly? I am concerned about personal information being included in the data. – InstilledBee – 2017-11-24T16:17:58.657
the file only includes the names, not the content, so you can share it. – magicandre1981 – 2017-11-25T11:31:14.463
Thank you. I updated the post with the link to the ETL file. – InstilledBee – 2017-11-25T11:43:29.590
2next time please notify me with @ myusername. the proc usage in this trace was done by synergyd.exe and syntool.exe. So maybe more commandline tools run all time in background (scheduled tasks). Toke usage comes from all programs doing user permission thinks (Tokens API like ntoskrnl.exe!SepDuplicateToken). Look if the issue is still relevant after updating to 1709, you use Win10 1703. – magicandre1981 – 2018-02-07T16:35:52.583
When you close all apps what does "cached" say in your performance tab of task manager? That is just cached disk space so isn't "really used" as it were, FWIW... (for followers "synergyd.exe and syntool.exe" come from the synergy keyboard sharing utility) – rogerdpack – 2019-07-08T05:07:02.267