Windows 10 high memory usage by tag "File"

2

1

In trying to determine what was causing the 'system' process to use up a large amount of RAM (which I found very unusual prior to updating to win10), I came across the post here: Windows 10 high memory usage (unknown reason)

Following those instructions, poolmon gives the following output: enter image description here

This is problematic, as most drivers seem to use File - the output from findstr /s File *.sys has many entries.

I believe the second tag, wcdl, is tied to Intel's RST, which may or may not be contributing to the problem.

What can I do to further investigate / solve the issue?

enigma

Posted 2015-10-25T17:48:57.347

Reputation: 957

Answers

2

A high "File" usage indicates that programs do a lot of FileIO operations. You have use xperf to trace what causes the usage. Install the Windows Performance Toolkit from the Windows 10 SDK, open a cmd.exe as admin and run this:

xperf -on PROC_THREAD+LOADER+POOL -stackwalk PoolAlloc+PoolFree+PoolAllocSession+PoolFreeSession -BufferSize 2048 -MaxFile 2048 -FileMode Circular && timeout -1 && xperf -d C:\poolusage.etl

capture 2-3 minutes of the pool memory usage grow. Open the ETL with WPA.exe, add the Pool graphs to the analysis pane.

Order the columns as you see them in the picture, load the symbols inside WPA.exe and expand the stack of the "File" tag that you saw in poolmon.

enter image description here

Here the File tag is used by locate32.exe which scans the file system to build in search index.

If you still need help, share the compresssed (7z/RAR) ETL file on OneDrive and post the link here in a comment.

magicandre1981

Posted 2015-10-25T17:48:57.347

Reputation: 86 560

Great help, thanks, seems to have been mostly due to FoxitReader in my case – enigma – 2015-10-25T19:27:21.873

To clarify: A "File" object represents the fact that a file (or a device) has been opened for access (it does not represent a read or a write operation to a file). The poolmon display here shows that almost a million file objects exist at one time. (Not necessarily that many files - a file can be opened several times at once, and a file object would exist for each.) This is likely indicates some truly sloppy programming by someone. It is usually possible to associate such usage with a process by adding the "Handles" column to Task Manager or Process Explorer's processes details display. – Jamie Hanrahan – 2015-10-27T23:14:45.810

Asked: 2015-10-25T17:48:57.347

Viewed: 1 347 times

Active: 2015-10-25T18:13:37.133