Why is the total memory usage reported by Windows Task Manager much higher than the sum of all processes' memory usage?

By the way, you should try not to use the term "memory". It creates a lot of confusion. If you mean physical memory, say "physical memory", or "RAM". If you mean virtual memory, say so. If you mean backing store, say so.

Why is total used memory much higher than the memory used by all listed processes, no matter how I try to count them?

Because the operating system doesn't waste physical memory (RAM) unless it has no choice.

How could windows "know" that memory is used without knowing what program is using it?

Because no program is using it. Consider, for example, memory that contains the code for a program that just terminated. No program is using it. But that memory is used, since it is not free and contains data that might be useful (in case the program runs again).

What processes might possibly use up memory but now show up on the list?

It's not used by processes.

Is there any software out there that can give more information about used memory?

RAMMap can do this.

There are only two possibilities, RAM can be used or it can be wasted. Obviously, the first is better. Any free memory is forever wasted -- a 4GB machine can't use 2GB today in order to use 6GB tomorrow. If you're thinking "I want it free now so I can use it later", forget that. You can use it now and use it later.

How could killing one process that supposedly only used a few MB free up several GB?

You are running low on backing store, not physical memory. You have plenty of free physical memory but insufficient backing store for the OS to keep allocating virtual memory that might require backing.

The process was only using a few MB of physical memory, but the OS might have had to reserve several GB of backed virtual memory for it. For example, suppose a process creates a writable, private memory mapping of a 2GB file. The OS must reserve 2GB of backed virtual memory for the process, because it might write to every single byte of that mapping. Also, it might never write to any of them. This is why you need a good sized paging file.

Modern operating systems write lots of checks (promising backing store) that will never be cashed (require RAM). You can't keep writing checks (promising backing store) even if you have plenty of money in the bank (free RAM) if you've already written a bunch of big checks that might or might not get cashed (promised as much backing store as you have). Paging files add backing store, allowing the OS to keep writing checks.

David Schwartz

Posted 11 years ago

Reputation: 58 310

96-1 because after reading the answer and all the comments, it still isn't clear why total used memory is much higher than the memory used by all listed processes. – Bennett McElwee – 11 years ago

@BennettMcElwee "Consider, for example, memory that contains the code for a program that just terminated. No program is using it. But that memory is used, since it is not free and contains data that might be useful (in case the program runs again)." Basically, it holds information that might be useful in the future (should some program decide to use it) but can also be discarded if the memory is needed for some other purpose. – David Schwartz – 11 years ago

6That terminology, where memory is "used" even though no program is using it, is quite unlike the normal meaning of words like "used" and "free" -- perhaps it's Microsoft's terminology, not yours. Anyway, suppose for example that 50% of RAM is currently used by running programs, and 25% is not used by any running program but contains data that might be useful in the future but can also be discarded. Adding those together and displaying "Memory: 75%" conveys no useful information to the user. I think that's where the widespread confusion comes from. – Bennett McElwee – 11 years ago

2@BennettMcElwee There is no good way to reduce memory usage to one simple number, but users insist on it. This puts developers in an uncomfortable position -- they can provide a number that is not always helpful or provide no number. Most OS and GUI developers choose the first option -- they provide a number that leads to lots of confusion. If your question is "would more RAM make my system work better", the answer is -- it's very, very hard to tell, even for experts. – David Schwartz – 11 years ago

This entire answer seems to assume the opposite of what the question asks about; perhaps because of the confusion with multiple types of memory. The question states that when he looks at the Processes tab of task manager, the sum of the Memory (Private Working Set) is significantly less than when he looks at the Physical Memory Usage History graph under the Performance tab. I.E. the allocated physical memory is larger than the sum of the memory usage reported by the programs. – Chris Mueller – 10 years ago

1@ChrisMueller My answer explains why that is -- the OS won't waste memory unless it has no choice, regardless of what the processes are doing. Here is the key part again, "Consider, for example, memory that contains the code for a program that just terminated. No program is using it. But that memory is used, since it is not free and contains data that might be useful (in case the program runs again)." – David Schwartz – 10 years ago

I had a similar situation, minus Windows telling me that it was low on memory; I noticed that total RAM usage reported by Windows & OpenHardwareMonitor was much higher than it should be. Using RAMMap, looking at the Physical Pages tab, showed a lot of files I hadn't recently used (TV episodes, game installers, etc). Only thing that made sense was A/V scanner. My scheduled A/V scan had run earlier in the morning. To test the theory, I ran it again... sure enough, usage % went up and was not immediately released when the scan ended. – stylez – 10 years ago

While your information is good, this isn't answering the question. I'm currently having the same problem, and Task Manager displays "Physical Memory 94%" on my machine with 8GB of physical RAM. That is not normal usage for modern operating systems, and I believe what @Josh is referring to. – John Neuhaus – 10 years ago

@JohnNeuhaus As my answer explains, that is normal usage for modern operating systems. You can't save RAM for later. Your only choices are to use it or waste it. – David Schwartz – 10 years ago

2@DavidSchwartz Your answer does not explain such, it simply states it. Can you provide any links to back that specific claim up? I am interpreting "Physical Memory XX%" to mean that XX% of the physically installed RAM is currently being used and is unavailable for other processes. I believe I am validated by the fact that above 90% the system becomes prone to lockups, and when applications attempt to allocate memory beyond 100%, they crash entirely. In my experience, this is not the standard regime where most systems operate. – John Neuhaus – 10 years ago

Furthermore, no one is talking about saving RAM for later. We are talking about RAM being reported as used when we expect it to be available, and the OS per-process reporting is not adding up to the reported total amount. This is not a problem of kernel memory management conceptualization. – John Neuhaus – 10 years ago

@JohnNeuhaus You have a very common, but very serious, misconception. RAM can, and usually is, both used and available. Modern operating systems manage memory primarily by switching it from one use to another, presumably more important, use. Free memory is not the only memory that's available. The percentage of RAM that is used is almost always very high, but if a system is not under memory pressure, most of that RAM is also available for other uses. – David Schwartz – 10 years ago

@JohnNeuhaus You really are thinking "I want RAM free now so I can use it later". That's nonsense -- you can use it now and use it later. – David Schwartz – 10 years ago

@DavidSchwartz ".. most of that RAM is also available for other uses." The problem is that in this case, no, it isn't. It's not that I don't have enough free RAM, it's that I have too much unavailable RAM, and my OS is telling me specifically that, not the inverse. I'll agree that by the stricter definition of 'free,' you are accurate. But this is not the definition this portion of the Windows Task Manager is reporting. Are you on Windows? Open the TM and tell me what the bottom of yours says for Physical Memory. If you're on Linux, tell me what the "Mem" line reads from the top command. – John Neuhaus – 10 years ago

@DavidSchwartz I am thinking "I need RAM and I don't have any. WTF happened to it?" I'm trying to write checks and they keep bouncing. When I call the bank, they say my balance is too low, but my online transaction history is telling me I should have plenty. – John Neuhaus – 10 years ago

@JohnNeuhaus Whatever problem you have, you haven't explained it. Having nearly all physical memory is use is perfectly normal on modern operating systems, even if they aren't under load. If some particular operation is failing, obviously, that's a problem. But without explaining clearly what operation is failing and what error it's getting, nobody will have any idea what your issue is. Everything you've actually described is normal, except some unspecified problem you haven't explained. I'm telling you what's happening to your RAM -- it's holding discardable data. – David Schwartz – 10 years ago

Please see this question and answer: http://superuser.com/questions/906161/why-do-resource-monitor-and-task-managers-total-ram-usage-not-even-remotely-add

The OP's screenshots there explain the problem further. Maybe by reading the answer you'll understand that this is not a normal situation. I don't know what more I can do to explain things to you, as you've clearly decided that I am wrong and you are right, and have made no attempt to actually address any of the points I've raised.

– John Neuhaus – 10 years ago

@JohnNeuhaus I'm not saying it's impossible to have a problem. I'm saying the description given doesn't describe a problem. It is very difficult to distinguish a memory leak from memory just being in use because the only difference between the two cases is that leak memory can't possibly be transitioned to another purpose. You cannot tell the difference unless the system is under memory pressure. – David Schwartz – 10 years ago

1And I'm saying you are incorrect and not listening. I'm telling you that the system is under memory pressure, and that it becomes unstable and unable to launch new applications. But that's not even the point, the point is that you are unwilling to consider my point of view. You simply repeat the same declarative sentences over and over again, as if I simply don't understand what you said previously. I'm trying to have a conversation and am receiving a lecture regarding a topic tangential to the issue at hand. – John Neuhaus – 10 years ago

@JohnNeuhaus If you refuse to listen, I'm not sure what I can do other than repeat myself. You claim you are "having the same problem", but everything you describe is normal other than your system becoming unstable or your being unable to launch new applications. But nothing you have said even gives any clue why you're having these problems. Your descriptions of perfectly normal memory behavior might be a useful clue, but they aren't symptoms. – David Schwartz – 10 years ago

I am telling you that Windows is reporting 90%+ physical memory in use, which is not accounted for by running processes. THAT IS NOT NORMAL. Normal memory usage is mostly accounted for by running processes, with a small amount held by the kernel. System instability is a SYMPTOM of lack of memory resources, which is my PROBLEM. Running processes not accounting for this is the CLUE. – John Neuhaus – 10 years ago

Maybe it would help if I share the answer. It was a process that was constantly starting/stopping, causing the kernel to continue to allocate memory for it but not release it. The kernel had over 6 GB memory in use by the Proc tag. I don't know where you get your definition of normal, but this isn't in mine. – John Neuhaus – 10 years ago

@JohnNeuhaus You are incorrect. Normal memory usage is not accounted for by running processes. It's very common for a machine to have 16GB of RAM and running processes that in total use less than 4GB. The rest of the RAM is commonly held by the kernel holding disk caches, NTFS metadata caches, and so on. That is normal. Really. The machine I'm on right now has 32GB of which 26GB is used by kernel-managed caches, 2GB is free. Processes account for about 3.5GB. There is nothing atypical about my system. – David Schwartz – 10 years ago

@DavidSchwartz Thank you for the numbers, that does sound like a normal system. Your terminology seems to be the atypical part. The majority of users and memory usage reports would not consider that 26 GB "used." In fact, your OS probably reports something like ~11% physical memory "in use." The breakdown of the 26 GB probably has a small portion that conforms to my definition of "in use," i.e. actively being used and not assignable, and the larger portion is available on request. In my situation, the majority of the kernel-held memory was not available for processes, which is unusual. – John Neuhaus – 10 years ago

@JohnNeuhaus There are two distinct reasons memory used by the kernel might be unavailable to processes. One is if the physical memory is actually needed by the kernel. This can be normal kernel memory use or due to a bug (usually a memory leak) in a driver. The other is if the kernel has insufficient backing store unreserved to allow any more process allocations. The former can only occur if there is very little free RAM. The latter can occur regardless of how much RAM is free. – David Schwartz – 10 years ago

@JohnNeuhaus What process was it? You are correct, 6 GB of pool in use under the "Proc" tag is decidedly not normal. – Jamie Hanrahan – 9 years ago

@JamieHanrahan Thank you for acknowledging that :p It was Razer Synapse that was the culprit. I don't recall if it was triggering itself to stop and restart, or if it was continually launching another process to do something. I verified it by seeing the PIDs change constantly and don't remember exactly how I caught it, but it was your answer on the other question was ultimately what led me to it. – John Neuhaus – 9 years ago

@JohnNeuhaus interesting! Thank you for the feedback. – Jamie Hanrahan – 9 years ago

Necro, but why does this post have only 6 votes? I thought it was quite good. – Dimpl – 8 years ago

Ok, so I have 8 GB of ram, and as you say - very few of them is used by processes. So what I have to kill to get more ram? My machine is working slowly when it shows memory 7.35 in task manager. When it shows 4 GB, it works much more smoothly. But its poitless to kill processees when they do not release much of ram. I want to kill that data which are used by non proceses. I know restarting computer does that, but I do not want to restart computer just to free my memory, – Darius.V – 8 years ago

It's too complicated to explain in an answer. Ask your own question and I'll post a full explanation. The short version is that both the RAM usage and the poor performance are symptoms of some problem that has nothing to do with how much RAM is free. You see them both at the same time, but one is not the cause of the other, they're both caused by something else. If you know what that something else is, you can fix it, but if you don't, you can't. So research your problem until you figure out what's causing it. – David Schwartz – 8 years ago

I have chekced with RamMap that nonPaged file uses 5 GB of ram. I got sick of this detecting nonsense, and decided I will try to close the programs until I get back my performance. And closed one program, too bad forgot which one and now in task manager memory usage is 2.8, while it was over 7 GB. ANd computer became much more responsive. So it means a program was causing a lag, but I could not see in task manager. I want a program who can exactly show which programs I should close ! Oh, actually I guess I remembered - it was combonator (poker app) I guess. – Darius.V – 8 years ago

@Darius.V Yep. The RAM usage was a symptom, but the problem was the poor performance. The cause was whatever combonator was doing. Think about it like a house fire. If you have a house fire, it will be warm in your house but also your still will be destroyed. You put the fire out, and it won't be warm in your house anymore. But it's perfectly normal for a house to be warm as long as there's no fire and no stuff being destroyed. Here, combonator was like a house fire and having low free RAM is like it being warm. The problem isn't that your house is warm, it's your stuff being destroyed. – David Schwartz – 8 years ago

1My version of this question is "why is my 7gb reported process usage different from 13gb reported memory usage" using RamMap (linked earlier) I found that my answer to this question was "2gb driver locked, 3gb paged+managed pool, 1gb sharable, 2gb 'mapped file' and finally 5gb Process private, for a total of 13gb "used physical". Other ways of reporting per process only pick up the 5+1 private+shared and don't account for these extra cases of used memory. – Andrew Hill – 7 years ago

1@DavidSchwartz Hi, I think your answer was misunderstood and thus highly downvoted (quite unjustly). I even downvoted it, but now in hindsight i want to upvote it after learning. I downvoted it back then because I needed a fast answer to how to fix the memory leak, I wanted to say, your solution worked for me, i was indeed running low on backing storage, because I had deactivated page file! i reactivated page file, now it works. – Santropedro – 6 years ago

Unfortunately, in the situations I describe above, the memory in question is clearly not from a recently terminated program. Windows shouldn't crash or display low-memory warnings simply because it doesn't feel like reallocating old, unused memory. I'm talking about situations where gigs of memory are apparently wired but unaccounted for. Situations where I can have 6 GB RAM plus 18 GB swap, but windows crashes because it's "out of memory" while task manager shows only 2 GB in use. – Josh – 11 years ago

(See updates to answer.) – David Schwartz – 11 years ago

David, by "backing store" do you mean the page file? The maximum size of the page file on windows seems to be 3 times the amount of RAM available. Mine is set to use that, so I've got a full 18 GB of page file. However, I don't think that's getting used up. Like I said, Task Manager says that I have 8 GB "memory" - its word, not mine, but obviously referring only to RAM. Task Manager also says that 90% of that 8 GB is currently used, and Windows warns me that this is a critical problem... and then crashes and logs me out if I ignore it. – Josh – 11 years ago

17PS: I'm using the word "memory" not because I don't know the difference between RAM and VM, but because my computer is only telling me that it's out of "memory" without giving me any info at all what it actually means. (I assume it means RAM, for the reasons I specify in the previous comment, but I'm not certain.) I'd rather you use the real vocab (which I can look up if necessary) than elaborate financial metaphors :) – Josh – 11 years ago

@Josh Ahh, then that's the confusion. It's not out of RAM, it's out of backing store due to commitments it has already made. The solution is to increase the backing store by increasing your paging file. – David Schwartz – 11 years ago

I still don't understand. If it's not out of RAM, why does it say that 5.5 GB of my 6 GB of "Memory" (not 8 GB as I mistyped in my previous comment, sorry) is in use? 6 GB is the amount of RAM I have, it's not the size of the backing store, which is much larger. If Windows has only promised to running apps 5.5 GB of the paging file, I shouldn't be having any problems at all! – Josh – 11 years ago

It says nearly all of your RAM is in use because that's the normal state for modern operating systems. RAM is only kept free, effectively wasting it, if the OS has no other choice. When you get a low memory error, it's due to exhaustion of backing store. If the system runs out of RAM, but has enough backing store, it just discards discardable pages, writes non-discardable pages to backing store (or wherever they go), and so on. – David Schwartz – 11 years ago

See Why do Resource Monitor and Task Manager's total RAM usage not even remotely add up to the total Physical Memory usage? for a more detailed and relevant answer. Voting to mark this as the duplicate instead.

3In my case it was "Driver Locked" memory, reserved by Hyper-V because of having enabled "Dynamic Memory". I had to stop all VM's, disable the setting, and restart them. Thanks for the RAMMap suggestion. – Dagelf – 8 years ago

'I think the question should be titled "Why am I running out of memory."' - Definitely not. There are many reasons someone might be running out of memory, and most of the time it's due to too many programs running. This is a very specific question about why the total used is more than the sum of the processes. This is not the same thing at all. (Also, why is this marked as a duplicate of a question that was asked after this instead of the other way around? ) – Synetech – 6 years ago

also kernel memory counts into usage. Post picture of RAMMAp: http://blogs.technet.com/b/askperf/archive/2010/08/13/introduction-to-the-new-sysinternals-tool-rammap.aspx

– magicandre1981 – 11 years ago

2I think the question should be titled "Why am I running out of memory." – surfasb – 11 years ago

This question is impossible to answer without specifics. List the programs installed. Or better yet, a dump of the running processes from Performance Monitor. – surfasb – 11 years ago

magicandre1981, I said in my question that RAMMap won't run while my computer is low on memory. It crashes as soon as I run it. Is there any other tool that can provide that information? – Josh – 11 years ago

If the kernel memory counts into usage, is there any tool besides RAMMap that will list kernel memory usage? I'm wondering if a bug in a driver (say, a network driver) could be leaking or otherwise allocating way too much memory. Killing the program that is calling the buggy kernel code (in my case, iexplore.exe) solves the problem, making it look like that program was at fault. Is this even possible? – Josh – 11 years ago

1Are you actually shutting down / restarting your computer completely or do you use hybrid shutdown (default in Windows 8)? After switching to Windows 8 I had a similar problem. I assume one driver took more and more of my physical RAM and didn't give it back, even after turning the computer off and on. In a few weeks it accumulated to several gigabytes. So now every few days I click on "restart" or hold shift while clicking on "shut down" to actually shut down the PC. – Robert – 11 years ago

Why is the total memory usage reported by Windows Task Manager much higher than the sum of all processes' memory usage?

Answers