0

I am trying to track down cause of a memory leak on Windows 10 PC. Something uses up memory, until system will start swapping to SDD, and when that runs out system will eventually crash. (Limit is 16 GB of RAM, and 84 GB swap file, for total of 100 GB)

I haven't found a program that causes this. If PC is being used for a few days and I close all programs I have used I only get a few gigabytes back, which matches the numbers in task manager.

Doing Windows restart will "flush" the memory. However, I noticed that doing shutdown and startup does not. I know Windows does somekind of kernel memory backup to disk on shutdown to speed up next startup.

Does this mean that leak in user programs can be ruled out? Is this kernel or driver leak?

Improve this question
3
  • There’s no need to guess this indirectly. You can check various figures in Windows to see what’s using the memory. Maybe ask a new question about finding where the leak is and provide screenshots of RamMap and Task Manager’s Memory performance view.
    – Daniel B
    Commented Oct 11, 2023 at 13:31
  • @DanielB Problem is that figures in simple tools like task manager don't add up. Listed programs and processes do not show abnormal memory use, but total memory usage is huge. That is why I suspect that this is not an issue in user space programs. And if so, then I probably need more sophisticated tools, which have access to kernel and driver memory stats.
    – user694733
    Commented Oct 11, 2023 at 14:23
  • I’m not referring to the process list. I’m referring to the memory performance view, which contains many useful figures. Before attempting to dive into one location or another, you must first determine which is the one to check.
    – Daniel B
    Commented Oct 11, 2023 at 15:08

1 Answer 1

Reset to default
3

Doing Windows restart will "flush" the memory. However, I noticed that doing shutdown and startup does not. I know Windows does somekind of kernel memory backup to disk on shutdown to speed up next startup.

As far as I know – When 'Fast Startup' is enabled, choosing "shutdown" actually does a logout followed by hibernation (which is then similar to the separate 'Hibernate' option).

This means memory belonging to user processes will be released (they all exit on logout), but memory allocated by kernel drivers – and potentially even by system service processes – may still remain.

(System services are still technically "user-space" as they are not part of the OS kernel. Most drivers are part of the kernel, with some exceptions.)

Improve this answer
1
  • If I understand your answer correctly, user programs and services get killed, but kernel, system services and drivers live. This would mean that leak is either in Windows, or more likely in third party driver, correct?
    – user694733
    Commented Oct 11, 2023 at 12:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .