Memory exhaustion with apparently no process exhausting it

0

I am suffering memory exhaustions on a Windows 10 computer nearly every three days, with no pattern to reproduce (sometimes after PC is powered on for days, sometimes just after power on, sometimes under normal usage, sometimes under heavy load, sometimes while quiet...). The symptoms are recongnizable: the video driver crashes and the resolution goes to minimum, then sometimes some process like firefox or chrome closes...

When this happens, processes RAM consumption under task admin seems normal. Under system events I can always see a Memory Exhaustion Detector event which seem to fail to explain the crash, because it always shows the paging file to be enormous and about to explode, but it also shows no process eating that memory.

Is there any reasonable explanation? Am I failing to interpret the log entry?

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
        <Provider Name="Microsoft-Windows-Resource-Exhaustion-Detector" Guid="{9988748E-C2E8-4054-85F6-0C3E1CAD2470}"/>
        <EventID>2004</EventID>
        <Version>0</Version>
        <Level>3</Level>
        <Task>3</Task>
        <Opcode>33</Opcode>
        <Keywords>0x8000000020000000</Keywords>
        <TimeCreated SystemTime="2018-07-27T05:52:49.650494000Z"/>
        <EventRecordID>4397</EventRecordID>
        <Correlation ActivityID="{DF4591EC-5B5B-462E-A0ED-524A715DCCAE}"/>
        <Execution ProcessID="8852" ThreadID="2772"/>
        <Channel>System</Channel>
        <Computer>DESKTOP-2VIMT0M</Computer>
        <Security UserID="S-1-5-18"/>
    </System>
    <UserData>
        <MemoryExhaustionInfo xmlns="http://www.microsoft.com/Windows/Resource/Exhaustion/Detector/Events">
            <SystemInfo>
                <SystemCommitLimit>25643593728</SystemCommitLimit>
                <SystemCommitCharge>25574793216</SystemCommitCharge>
                <ProcessCommitCharge>1946886144</ProcessCommitCharge>
                <PagedPoolUsage>334127104</PagedPoolUsage>
                <PhysicalMemorySize>6316240896</PhysicalMemorySize>
                <PhysicalMemoryUsage>2814005248</PhysicalMemoryUsage>
                <NonPagedPoolUsage>381517824</NonPagedPoolUsage>
                <Processes>146</Processes>
            </SystemInfo>
            <PagedPoolInfo>
                <Tag_1>
                    <Name>MmSt</Name>
                    <PoolUsed>91655968</PoolUsed>
                </Tag_1>
                <Tag_2>
                    <Name>Sect</Name>
                    <PoolUsed>42178128</PoolUsed>
                </Tag_2>
                <Tag_3>
                    <Name>MmRe</Name>
                    <PoolUsed>29752368</PoolUsed>
                </Tag_3>
            </PagedPoolInfo>
            <NonPagedPoolInfo>
                <Tag_1>
                    <Name>smCB</Name>
                    <PoolUsed>66957312</PoolUsed>
                </Tag_1>
                <Tag_2>
                    <Name>MmCa</Name>
                    <PoolUsed>65829520</PoolUsed>
                </Tag_2>
                <Tag_3>
                    <Name>smNp</Name>
                    <PoolUsed>55021568</PoolUsed>
                </Tag_3>
            </NonPagedPoolInfo>
            <ProcessInfo>
                <Process_1>
                    <Name>MsMpEng.exe</Name>
                    <ID>3776</ID>
                    <CreationTime>2018-07-26T06:02:05.521842000Z</CreationTime>
                    <CommitCharge>152260608</CommitCharge>
                    <HandleCount>789</HandleCount>
                    <Version>0.0.0.0</Version>
                    <TypeInfo>65</TypeInfo>
                </Process_1>
                <Process_2>
                    <Name>chrome.exe</Name>
                    <ID>3204</ID>
                    <CreationTime>2018-07-26T14:04:58.020386800Z</CreationTime>
                    <CommitCharge>138813440</CommitCharge>
                    <HandleCount>1600</HandleCount>
                    <Version>67.0.3396.99</Version>
                    <TypeInfo>202</TypeInfo>
                </Process_2>
                <Process_3>
                    <Name>chrome.exe</Name>
                    <ID>4440</ID>
                    <CreationTime>2018-07-26T14:04:58.202091700Z</CreationTime>
                    <CommitCharge>108515328</CommitCharge>
                    <HandleCount>460</HandleCount>
                    <Version>67.0.3396.99</Version>
                    <TypeInfo>211</TypeInfo>
                </Process_3>
                <Process_4>
                    <Name>architect.exe</Name>
                    <ID>6304</ID>
                    <CreationTime>2018-07-26T07:55:20.567701400Z</CreationTime>
                    <CommitCharge>102588416</CommitCharge>
                    <HandleCount>768</HandleCount>
                    <Version>5.0.28.34044</Version>
                    <TypeInfo>152</TypeInfo>
                </Process_4>
                <Process_5>
                    <Name/>
                    <ID>0</ID>
                    <CreationTime>1601-01-01T00:00:00.000000000Z</CreationTime>
                    <CommitCharge>0</CommitCharge>
                    <HandleCount>0</HandleCount>
                    <Version>0.0.0.0</Version>
                    <TypeInfo>0</TypeInfo>
                </Process_5>
                <Process_6>
                    <Name/>
                    <ID>0</ID>
                    <CreationTime>1601-01-01T00:00:00.000000000Z</CreationTime>
                    <CommitCharge>0</CommitCharge>
                    <HandleCount>0</HandleCount>
                    <Version>0.0.0.0</Version>
                    <TypeInfo>0</TypeInfo>
                </Process_6>
            </ProcessInfo>
            <ExhaustionEventInfo>
                <Time>2018-07-27T05:52:48.613055400Z</Time>
            </ExhaustionEventInfo>
        </MemoryExhaustionInfo>
    </UserData>
</Event>

Áxel Costas Pena

Posted 2018-07-27T06:56:03.020

Reputation: 761

We are facing similar issues. Did you find any solution to your problem? The problem with this report is, that it gives a list with processes that take memory but it does not show the other parts of the operating system using memory -> ProcessCommitCharge is much smaller then SystemCommitCharge. You can try taking a look with Rammap (https://docs.microsoft.com/en-us/sysinternals/downloads/rammap) if you can identify the culprit. Even with this tool we have not found an explanation yet why we are facing this issue

– Bre – 2018-09-17T07:44:37.210

Not yet, it's hard since it sometimes happen dayly, then it stops happening for weeks. I have instructed the employees to open Sysinternal's Process Explorer as soon as the problem happens, sort by PF and PF delta and take photos, since any process causing that must have a very high PF rate. – Áxel Costas Pena – 2018-09-20T07:22:46.843

No answers