1

I found this question, the answer to which explains how to determine which driver is causing a memory leak in Windows 10. I cannot figure out the problem on my system, however, so I'm looking for additional assistance.

Here's the result of running poolmon -b, then p, then b:

poolmon result

Running findstr on Cont returns a file with 3,500 instances of "Cont", so that's not helpful. The same with smNp only shows a problem with rdyboost.sys, which I'm sure wouldn't be causing problems.

I ran the given xperf command, but the result in WPA.exe is complete gibberish to me:

WPA.exe result

It seems that the AIFO section only accounts for 0.666MB of the memory, whereas System is currently using ~700MB.

How can I properly troubleshoot the driver that's causing the problem?

As requested, here is a screenshot of Task Manager right now.

Task Manager

vaindil
  • 1,229
  • 12
  • 22
  • 45
  • What build of Windows 10? I asked because in the new build of Windows 10 memory usage will be reported higher the it really is. I have to ask what makes you think there is a memory leak, unused memory is useless, so Windows will use for other uses but immediately provide it to any application that needs it. – Ramhound Sep 16 '15 at 17:56
  • Agree with Ramhound. You sort of jumped ahead from an assertion that you have a memory usage problem to an analysis method that's specific to one type of memory problem, a leak of nonpaged pool. What we can see here does not show any sort of problem; those usage levels are completely normal. You need to show screen snaps of e.g. Task manager and RAMmap. – Jamie Hanrahan Sep 16 '15 at 18:48
  • @JamieHanrahan - In particular snaps that clearly indicate that system memory usage is extremely high, and the usage of a single file or process uses, is different by a large amount between two snaps. – Ramhound Sep 16 '15 at 18:51
  • @Ramhound You're right, I should have clarified. The System process is using a very high amount of RAM; my memory usage is typically 90-95%. My computer has run _very_ slowly since the upgrade, and a colleague on the same hardware as me is experiencing the same problem. I've put an image of Task Manager in the OP. At this moment I have 83% usage--System is using 753MB and the next highest process, an instance of Chrome, is using 98.7MB. RAMMap has not been updated yet for Windows 10; it's not supported. I'm on build 10240, W10 Enterprise. – vaindil Sep 16 '15 at 19:10
  • Alright; Simplest way to determine if a device driver is responsible. Boot into Safe Mode and/or use Autoruns, in both cases, only load what absolutely has to be loaded for the system to boot. Determine if the problem still happens, if it does not, then you have narrowed down the possible cause to what normally is loaded but wasn't loaded. – Ramhound Sep 16 '15 at 19:16
  • 3
    possible duplicate of [Windows 10, 'System' process taking massive amounts of RAM](http://superuser.com/questions/952141/windows-10-system-process-taking-massive-amounts-of-ram) – magicandre1981 Sep 17 '15 at 04:21

1 Answers1

1

It is not a memory leak but a new feature.

In Windows 10, Microsoft has added a new concept in the Memory Manager called a compression store, which is an in-memory collection of compressed pages. This means that when Memory Manager feels memory pressure, it will compress unused pages instead of writing them to disk. This reduces the amount of memory used per process, allowing Windows 10 to maintain more applications in physical memory at a time. This also helps provide better responsiveness across Windows 10. The compression store lives in the System process’s working set. Since the system process holds the store in memory, its working set grows larger exactly when memory is being made available for other processes. This is visible in Task Manager and the reason the System process appears to be causing a memory leak.

Anant Malik
  • 19
  • 1
  • 1
    This answer would be wonderful, if and only if, the author indicates they are part of the Insider Preview program. Otherwise you were quick on the gun to assume the feature you describe is at fault, and said feature, is not in build 10240 by the way. So you should find out if that is the case then post this as the answer. – Ramhound Sep 16 '15 at 18:47
  • @Ramhound this feature is PART of Windows 10 Build 10240: http://superuser.com/a/952142/174557 – magicandre1981 Sep 17 '15 at 04:21
  • @magicandre1981 - The answer points to a blog post that talks about build 10525, which the author of the question is not using. While I was under the strong and educated believe that Windows MM was not using compression until after build 10525, I maintain, the answer as written does not apply to this question. Both of your own links in that answer are about 10525 not 10240, the channel 9 video, I suspect is the same. Considering there Windows 10 RTM isn't official within Microsoft, infact they indicate Windows 10 RTM does not actually exist, I suspect the video's is about 10525 also. – Ramhound Sep 17 '15 at 11:24
  • @Ramhound Microsoft created the blog because I asked them to to this. the user who posted this question is using Build 10240. RTM = 10240 – magicandre1981 Sep 17 '15 at 14:51
  • As I point out. The blog isn't about 10240. We can discuss this in the chat room at some other time. As I indicate I don't believe the MM changes are even in build 10240 because everything I read indicates those changes happen with 10525 and are not present in 10240. – Ramhound Sep 17 '15 at 14:54
  • @Ramhound I gve it up. It makes no sense to discuss with you. I see the compression calls in a xperf traces of Build 10240. *tactical facepalm*: http://images-cdn.9gag.com/photo/210543_700b_v1.jpg – magicandre1981 Sep 18 '15 at 04:25
  • @Ramhound here a picture which shows it: http://i.stack.imgur.com/6dW6V.png. Hope you now understand that this is part of the RM version of Win10. – magicandre1981 Sep 18 '15 at 17:12