Memory is full, but by whom?

1

Today when I turned on my PC and logged in Windows (8.1), I noticed the HDD's LED is on persistently (without blinking) and the Windows is unbelievably slow and is lagging tortuously!

I opened the task manager (with like 30 seconds lag) to see what's going on...And this was it:*

enter image description here

Seeing 98% of the 8 GB memory being used, explained the slowness. But, what didn't add up was which process was taking it! Adding up all those numbers probably wouldn't even reach 100 MB, let alone ~7GB!

So, I also checked the process monitor and things got more confusing:*

enter image description here

Now, can someone explain to me

  • What that 6.7 GB "modified" memory is and why so much?
  • When does a thing like this happen?
  • What is the solution to freeing that amount of RAM to get Windows back to normal?

Hardware:

AMD FX 6350 | 8 GB RAM | 1 TB HDD


*Sorry about the quality of the pics. It was so slow, I had to use my phone!

Mahm00d

Posted 2015-10-25T17:42:03.513

Reputation: 259

1With a commit charge of what looks like 23GB I'd suggest that CoreTemp has a memory leak there. I'd kill and restart that process. – Mokubai – 2015-10-25T17:43:14.457

post some details of your hardware – magicandre1981 – 2015-10-25T18:06:43.170

which network card do you use? – magicandre1981 – 2015-10-25T18:20:10.693

@magicandre1981 I am not exactly sure...the motherboard is ASUS and I think the network chip is Realtek. Is it relevant? – Mahm00d – 2015-10-25T18:23:10.477

open device manager (devmgmt.msc) and look which network card you use. – magicandre1981 – 2015-10-25T18:24:00.143

@magicandre1981 It's Realtek LAN controller. Although, I mostly used WiFi via a D-Link dongle... – Mahm00d – 2015-10-25T18:37:19.427

and which D-Link dongle do you use? Does it use a broadcom chipset? Please post more details!! – magicandre1981 – 2015-10-26T04:56:03.503

@magicandre1981 It's a DWA-125 dongle. I don't know the rev, but according to Wikidevi, the chipset is either Ralink or Realtek. But, you could at least post your theory before asking about HW details... I still don't get how the WiFi dongle is relevant to all of this! – Mahm00d – 2015-10-26T14:30:56.003

broadcom chips cause "modified" memory leak, that's why I wanted to know this. – magicandre1981 – 2015-10-26T19:00:21.137

install the WPT ( http://social.technet.microsoft.com/wiki/contents/articles/4847.install-the-windows-performance-toolkit-wpt.aspx) and run this command to capture a bit of the modified usage: xperf -on PROC_THREAD+LOADER+CSWITCH+DISPATCHER+DISK_IO+DISK_IO_INIT+FILENAME+FILE_IO+FILE_IO_INIT+PROFILE+ResidentSet -stackwalk CSwitch+ReadyThread+FileCreate+FileCleanup+FileClose+FileRead+FileWrite+FileSetInformation+FileDelete+FileRename+DiskReadInit+DiskWriteInit+DiskFlushInit+Profile -buffersize 4096 -MaxFile 2048 -FileMode Circular && timeout -1 && xperf -d C:\modifiedMemory.etl

– magicandre1981 – 2015-10-26T19:25:03.240

zip and share the ETL file – magicandre1981 – 2015-10-26T19:25:18.170

have you captured the trace or is the issue now fixed? – magicandre1981 – 2015-11-03T18:13:54.487

Answers

1

Looking at the top of your second image it looks to me that it is quite probably CoreTemp that is the problem. While is only using some 20MB of working memory it has a severe virtual memory leak and is using up 24GB of virtual memory.

As a result it has probably absorbed all of the VM available to your system and so the memory manager is struggling to give any memory to new applications.

First task: kill CoreTemp.

The "modified" memory is usually memory pages that are waiting to be flushed to the swap file, this would be consistent with a program that has allocated an insane amount of virtual memory and the system is stuck paging it out.

To explain the commit charge we resort to Wikipedia:

In computing, commit charge is a term used in Microsoft Windows operating systems to describe the total amount of pageable virtual address space for which no backing store is assigned other than the pagefile. On systems with a pagefile, it may be thought of as the maximum potential pagefile usage. On systems with no pagefile, it is still counted, but all such virtual address space must remain in physical memory (RAM) at all times.

Essentially the maximum commit charge of a system is the total amount of memory that can be backed by the swap file. The commit charge of any process is the amount of memory then that program has requested access to.

The problem there though is that a program can request more memory than is physically installed in the system, or more than it actually needs, and essentially starve out other processes. I suspect that this is what has happened in this case. CoreTemp has requested every last piece of allocatable memory that your system has and so the memory manager is having difficulty forcing pages out to disk so that it can load new tasks in.

It's probably also having trouble allocating pages at all, at that kind of size I'd suspect that that is all of your physical and virtual (swapfile) memory allocated.

Mokubai

Posted 2015-10-25T17:42:03.513

Reputation: 64 434

OK. This also explains 100% disk usage. Also, It may sound noob, but doesn't Windows allocate RAM to programs before allocating VM? I mean, how can a program use that amount of VM with just using 20MB of RAM? – Mahm00d – 2015-10-25T18:33:45.420

@Mahm00d - Yes; It does; Your virtual memory settings might be preventing it from increasing the size of pagefile.sys to such a large value. In other words Windows appears like it was attempting to provide that much memory but was failing to do so. Also worth pointing out you have a high amount of page faults which goes back to your I/O disk usage. – Ramhound – 2015-10-26T11:26:28.950