Question High Memory Usage, Non-Paged Pool

[Sage of Souls]

Ok, so I've been battling this problem for months now and I'm getting to the point where I don't even remember all the things I've already done and I just can't figure out how to stop it.

Basically, I've been having to deal with my computer using upwards of half or more of my total available RAM, most of which seems to be going to the non-paged pool, and nothing I seem to do is fixing the problem.

I'd love to be able to tell you guys all of the steps I've done, but I've done so many things over the months that I can't remember what all I have an what I haven't done.

Anything you guys can tell me to try to combat this would be of help.


Thanks,
Sage

 

[jojesa]

Non-paged pool high memory usage usually indicates memory leak (system component or drivers).
It shouldn't even get to 1GB.
Try updating your drivers (Network, audio, GPU).
Most of the time is a network driver.

 

[Sage of Souls]

Non-paged pool high memory usage usually indicates memory leak (system component or drivers).
It shouldn't even get to 1GB.
Try updating your drivers (Network, audio, GPU).
Most of the time is a network driver.

That's one of the things I've tried already. All of my drivers are up-to-date, using both manual searching on manufacturers' websites, searching automatically online, and using third-party programs.

 

[jojesa]

When did the issue started?
Try removing the hardware and drivers from Device Manager, reboot and let Windows install the drivers again.
Start with the network adapters.

 

[Sage of Souls]

When did the issue started?
Try removing the hardware and drivers from Device Manager, reboot and let Windows install the drivers again.
Start with the network adapters.

This has ALWAYS been an issue. From the first installation of Windows to now, even when I do reinstallations. It's never gone away. I even installed more/new RAM and that didn't fix it.

 

[jojesa]

This has ALWAYS been an issue. From the first installation of Windows to now, even when I do reinstallations.

So let me get this straight, you get this Non-paged pool issue as soon you install Windows and before you make any changes or install any apps?
Which version of Windows 10 is installed on your system?

It's never gone away. I even installed more/new RAM and that didn't fix it.

Adding more RAM won't fix the issue, it will have the opposite effect by providing more space for the Non-paged pool to grow even higher.

 

[Sage of Souls]

So let me get this straight, you get this Non-paged pool issue as soon you install Windows and before you make any changes or install any apps?
Which version of Windows 10 is installed on your system?


Adding more RAM won't fix the issue, it will have the opposite effect by providing more space for the Non-paged pool to grow even higher.

Yes. I kid you not. I have Version 1909 (Build 18363.900). I avoid Windows Update if I have the choice to because every time I have to update Windows on either mine or my girlfriend's PC, it ALWAYS causes some of issue with the system, itself, to the point where nothing works. I've filed many a tickets with Microsoft about this issue and eventually just turned off Windows Update because they refused to help and just chalked it up to "your hardware can't handle it" bull s***, even though it's new and newer (as in newer type of products) hardware.

 

[Colif]

Try running ram map - https://docs.microsoft.com/en-us/sysinternals/downloads/rammap
looking on the fle summary might reveal culprit, especially how large the bulge in ram is.

Download Process explorer and run it as admin (it comes from Microsoft so its safe)

the default view is tree structure meaning like your task manager screen, it will show what processes are under each service, but unlike task manager, it shows the ram usage of each part so you can see what is eating your ram

Private bytes = Ram + page file usage
Working set = actual ram usage

This page shows what all the colours and headings mean, link at bottom of it shows how to use it to find problems. You can right click headers and run an av scan from within the program.

note - ram map uses about 1.5gb on my pc, which seems excessive. It might use less on PC that don't have 32gb of ram. I don't think it includes itself in calculations though.

 

[jojesa]

Yes. I kid you not. I have Version 1909 (Build 18363.900). I avoid Windows Update if I have the choice to because every time I have to update Windows on either mine or my girlfriend's PC, it ALWAYS causes some of issue with the system, itself, to the point where nothing works.

Windows version 1909 is very stable.
I think you should log every change, drivers and app you install , to see at which point you are getting the Non-paged pool issue.

I've filed many a tickets with Microsoft about this issue and eventually just turned off Windows Update because they refused to help and just chalked it up to "your hardware can't handle it" bull s***, even though it's new and newer (as in newer type of products) hardware.

Microsoft Windows comes with only one support event per license and expires after 30 days.
I have yet to encounter, Non-paged pool issues caused by faulty hardware.
It is usually cause by drivers and software.
And most of the times is the network drivers and used to happen a lot with Internet Explorer.

 

[johnbl]

you need to find the pooltag for the driver that is using excessive pool.
to do this you need to run poolmon.exe from the windows ddk. This is often hard to find and install so you might want to use this tool poolmonx
here is a compiled version.
Download PoolMonX - MajorGeeks
you should sort by non paged pool (or sort by KBytes largest numbers first)
find the tag name and look at the source and description field to see what it is.
if it is a 3rd party driver then it might not be named and you have to search your drivers files to figure out what driver binary is using the tag.
google how to find out what driver is using a pooltag
here is a good example:An Introduction to Pool Tags - Microsoft Tech Community
of using the findstr command to find a driver tag by looking for the tag string inside of files in your driver directory

the tags should be 4 characters long but I just looked at mine and see a 3rd party driver that used a trailing space.
so you would scan for a 3 char string in that case.

after you find the pooltag, then find the driver name you need to google to find out what the driver does and look for a update. if it is a windows driver you might have to figure out what it is doing to see what is messed up. ie 3rd party drivers making calls that cause the windows driver to eat up all of the pool memory.

often it is good to run cmd.exe as an admin then running
sfc.exe /scannow
DISM.exe /Online /Cleanup-Image /Restorehealth
before looking for other problems. this will fix certain malware related problems.

 

[Sage of Souls]

Thank you, guys. I've already tried using PoolMon before, as it's one of the many things I used to try and figure this out in the past, but I'll set it up soon and get you guys a log of things so we can go from there.

 

[Colif]

this might help - https://github.com/zodiacon/PoolMonXv2/blob/master/PoolMonX/res/pooltag.txt - list of all the tags
poolmon is fun, I have watched a few videos on it and still trying to figure it out.

 

[Sage of Souls]

Hey, guys. Sorry I haven't been able to update this thread until now. Between the holidays and some other things, I haven't really had a chance to sit down and address this problem. However, that has also led to the problem getting worse, and simply restarting my computer doesn't seem to solve the problem anymore.

This is what PoolMon, RAMMap, and Process Explorer show and I don't really know what to do with it:

Obviously, 22 GB of RAM being taken up by the Non-Paged Pool should not be happening...

 

[Colif]

Poolmon
Since it shows paged and non paged, get to ignore half of it
IRP - IO Request Packets - https://en.wikipedia.org/wiki/I/O_request_packet -
FMic - Filter manager - https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/filter-manager-concepts

those 2 are always at top of the list
EtwB - ETW Provider tracker- i think its event tracing
NVRM - Nvidia drivers
File - file objects
NTfx - ntfs - file system
Pdca - PDC_ACTIVATION_TAG, ACTIVATOR_CLIENT_TAG (not a lot on this, maybe Primary Domain Controller)

in process explorer, right click the header and click Select columns
open the process memory tab
click the box next to non paged pool.
click ok
drag column across next to working set and now you can see which process is using most.

rammap always seems to eat a lot of ram just running.

 

[Sage of Souls]

drag column across next to working set and now you can see which process is using most.

What do you mean by "drag column"? I would assume there's supposed to be a hidden column by default? If so, I'm not seeing one. I followed the instructions for Process Explorer and I'm not seeing anything that's using obscenely high amounts of memory.

As for PoolMon, here's another screenshot that just shows the highest (I think) Non-Paged processes:

Are you saying that Irp and FMic are just going to constantly be constantly eating 8 GB of memory and there's nothing that can be done about that?

 

[jojesa]

You could end the process that it is taking the RAM in Task Manager, to provide temporary relief.
Under the Details tab, you could add the Paged pool and NP pool columns.
Just right-click over any of the columns name, choose Select columns and place a check on both Paged pool and NP pool columns...then click OK
You could sort by just clicking the column header.

I have seen your issue many times and it will be hard to find and fix, since the program or driver that is causing it is not shown with any of these tools. Digging layers upon layers until the culprit is found is required.

The latest system I encounter with a memory leak issue was caused by Razer Cortex and the Killer network drivers, which were eating 7GB of RAM.
I started by using Diagnostic startup...which load basic Windows drivers and services without any third-party apps.

I was able to regain the memory by removing Razer Cortex and the network drivers.

Another system I could not find the issue, I started to upgrade to different versions from 1903. I found that version 20H2 did not had the issue.

 

[Colif]

What do you mean by "drag column"? I would assume there's supposed to be a hidden column by default? If so, I'm not seeing one. I followed the instructions for Process Explorer and I'm not seeing anything that's using obscenely high amounts of memory.

when you add a column in process explorer, it adds it to the far right end of the app so if you want to have it next working set, you drag the header across. Otherwise to see it you have expand the window process explorer is showing in or you get scroll bars are the bottom. Below its still at far right.

Killer internet drivers are a known memory leak, what motherboard do you have?
you want to find the tag with the biggest difference between Allocs and frees as it shows what isn't releasing memory after being given it, that isn't part of windows.

 

[Sage of Souls]

You could end the process that it is taking the RAM in Task Manager, to provide temporary relief.
Under the Details tab, you could add the Paged pool and NP pool columns.
Just right-click over any of the columns name, choose Select columns and place a check on both Paged pool and NP pool columns...then click OK
You could sort by just clicking the column header.

I have seen your issue many times and it will be hard to find and fix, since the program or driver that is causing it is not shown with any of these tools. Digging layers upon layers until the culprit is found is required.

The latest system I encounter with a memory leak issue was caused by Razer Cortex and the Killer network drivers, which were eating 7GB of RAM.
I started by using Diagnostic startup...which load basic Windows drivers and services without any third-party apps.

I was able to regain the memory by removing Razer Cortex and the network drivers.

Another system I could not find the issue, I started to upgrade to different versions from 1903. I found that version 20H2 did not had the issue.

Ok, this got me decent results. I didn't know you could show the non-paged pool in Task Manager. I ended a program called RzKLService.exe, which had one of Razer's many icons, so I'm guessing that was it. Once I ended that, the memory being used by the non-paged pool went down from 23.8 GB to 3.3 GB. Still more than I'd like for it to have, but that was a significant impact. I guess I'll have to figure out how to disable Razer Cortex entirely, which is a shame because I like having the custom lighting on my mouse and keyboard, but I can certainly live without if it means not having my computer run at 90% memory usage with the grand majority of that unusable by me.

 

[Sage of Souls]

Killer internet drivers are a known memory leak, what motherboard do you have?
you want to find the tag with the biggest difference between Allocs and frees as it shows what isn't releasing memory after being given it, that isn't part of windows.

Well, I should've taken a screenshot of Process Explorer before killing that Razer program that I mentioned in the post above, but I didn't, so I can't really show you Process Explorer as it was before I did that.

As for my motherboard, I'm using a MSI x470 Gaming Plus motherboard. Nothing really high-end.

And here's the latest screenshot of PoolMon. I have it sorted by "Diff", which I'm guessing is the difference between Allocs and Frees.

 

[Colif]

tried updating Synapse? I assume its what you use for the razer device.

razer game booster or Cortex.
rzklservice.exe is usually located in the 'c:\program files (x86)\razer\razer game booster\' folder.

 

[jojesa]

As you can see poor written apps and drivers are usually the cause of memory leaks.

Which version of Razer Synapse do you have?

Enable back the RzKLService.exe and check if another Razer service is the one causing the leak.
See if you have running the Razer NetworkMonitor service.
I think that service might be causing the memory leak and using more CPU than required.

To disable the service, click the Windows + R keys on your keyboard, type services.msc and hit Enter.
Scroll down to the NetworkMonitor service, double-click the service and on the pop-up window, under Startup type: select Disabled...then click OK and reboot.

 

[BackBencher]

you need to find the pooltag for the driver that is using excessive pool.
to do this you need to run poolmon.exe from the windows ddk. This is often hard to find and install so you might want to use this tool poolmonx
here is a compiled version.
Download PoolMonX - MajorGeeks
you should sort by non paged pool (or sort by KBytes largest numbers first)
find the tag name and look at the source and description field to see what it is.
if it is a 3rd party driver then it might not be named and you have to search your drivers files to figure out what driver binary is using the tag.
google how to find out what driver is using a pooltag
here is a good example:An Introduction to Pool Tags - Microsoft Tech Community
of using the findstr command to find a driver tag by looking for the tag string inside of files in your driver directory

the tags should be 4 characters long but I just looked at mine and see a 3rd party driver that used a trailing space.
so you would scan for a 3 char string in that case.

after you find the pooltag, then find the driver name you need to google to find out what the driver does and look for a update. if it is a windows driver you might have to figure out what it is doing to see what is messed up. ie 3rd party drivers making calls that cause the windows driver to eat up all of the pool memory.

often it is good to run cmd.exe as an admin then running
sfc.exe /scannow
DISM.exe /Online /Cleanup-Image /Restorehealth
before looking for other problems. this will fix certain malware related problems.

the same problem is happening with me. I also tried using PoolMon, I used to try this one and figure this out but no progress.

 

[jojesa]

the same problem is happening with me. I also tried using PoolMon, I used to try this one and figure this out but no progress.

You should start you own thread about your issue.
It might look like the same issue but it might not be.