Question Lots of RAM caching, without the use of applications

[HarimMZ]

Good afternoon, I noticed that for 2 hours of work in the cache 8 gb, although I did not use only the browser(Chrome) and Telegram, no other applications that could take up this space.
I learned about RamMap application in the discussion of another issue and decided to install it to see what is in the cache, I installed it from here ( https://learn.microsoft.com/ru-ru/sysinternals/downloads/rammap )
In the end it doesn't show what is in it, although on the main page in the item "Mapped File" it seems to show the real volume.
Can you somehow help me to see what is in the cache?
I will be very grateful for the answer
Screenshots attached
1
2
3

 

[JayBird99]

Looks like Windows prefetch keeping the 8GB RAM full of what it’s learned you usually use. That’s how even on lower spec'd systems things still open snappy. Throw them something you don’t often do and it will probably take forever to open.

 

[HarimMZ]

Looks like Windows prefetch keeping the 8GB RAM full of what it’s learned you usually use. That’s how even on lower spec'd systems things still open snappy. Throw them something you don’t often do and it will probably take forever to open.

Impossible, I only use browser and telegram, no games or third party apps that would cause so much data to be cached.
Also for your information I have 32gb of memory.

 

[rgd1101]

windows OS use memory too, not just your app, anti virus/malware, everything.
if you have 32GB why worry about it using 8GB cache

 

[HarimMZ]

windows OS use memory too, not just your app, anti virus/malware, everything.
if you have 32GB why worry about it using 8GB cache

I forgot to point out that this behavior is not always the case.
It happens every other day, i.e. one day I have 4gb cache, the next day 6-8gb, and so on and so forth. Although I repeat I do not use any new applications, every day applications are the same, but the cached memory is very different and I want to understand what happens to the system (some error can) or the action of a virus (computer checked by many anti-virus applications Kaspersky, Eset, Malwarbytes) as well as the Windows Defender itself and its Offline Microsoft Defender.

 

[JayBird99]

I forgot to point out that this behavior is not always the case.
It happens every other day, i.e. one day I have 4gb cache, the next day 6-8gb, and so on and so forth. Although I repeat I do not use any new applications, every day applications are the same, but the cached memory is very different and I want to understand what happens to the system (some error can) or the action of a virus (computer checked by many anti-virus applications Kaspersky, Eset, Malwarbytes) as well as the Windows Defender itself and its Offline Microsoft Defender.

If you have 32GB of RAM, I see nothing out of the ordinary that Windows is doing. Ask Microsoft about the caching behaviors of Windows 11. It knows you have ample room to keep things in RAM and it does so to keep things snappy. I don’t see the issue.

If you want lower RAM usage try a Linux distro. They are extremely conservative on usage. I have ~20 Chrome tabs, Celluloid, and several other background tasks going and I’m using 3.6GB of 32GB with 4.0GB static cache size and a 2GB swap for the 2GB SSD RAM cache size to keep everything smooth. That’s my personal setup.

 

[hotaru.hino]

Unless you're running out of physical RAM to the point where the system comes to a crawl due to memory swapping, there's no problem here.

Cached data will also be evicted as needed. For all intents and purposes, it does not count as "used" RAM.

 

[HarimMZ]

windows OS use memory too, not just your app, anti virus/malware, everything.
if you have 32GB why worry about it using 8GB cache

Let me try to explain what's weird about this to me.
For example, the caching is different every day as I wrote above I use only Chrome and Telegram, I do not play games and do not use any complex applications, but still the cache on one day can be 4gb and on another day 8gb.
I would understand if it was always the same, but it varies every day from one value to another and I can't understand why.
The assumption fell on viruses, but none of the antivirus programs could find anything.
But I still can't find an explanation for this behavior of my system

 

[HarimMZ]

Unless you're running out of physical RAM to the point where the system comes to a crawl due to memory swapping, there's no problem here.

Cached data will also be evicted as needed. For all intents and purposes, it does not count as "used" RAM.

I understand that sir, the problem is that I want to understand what exactly the system caches there and why, because I don't even use half of what it caches. And if I want to look at what it's putting in there through the RamMap program, I can't see it.

 

[hotaru.hino]

I understand that sir, the problem is that I want to understand what exactly the system caches there and why, because I don't even use half of what it caches. And if I want to look at what it's putting in there through the RamMap program, I can't see it.

It's likely that whatever programs that are running free up memory, Windows doesn't actually evict it from memory. It keeps it in RAM because it's much faster to flip a switch that reactivates it than it is to re-allocate memory for it.

Memory allocation is an expensive operation because the OS has to figure out:

• If there's enough memory for it
• If something else has to drop off or be moved to the page file
• If there's contiguous space for it, because it's much easier to keep track of memory when it's just "N + M" than "N, M, X, Y, Z, etc.", and if there isn't enough contiguous space, put it around in as few pieces as possible.
• And after all that, maybe perform a memory "defrag" operation because of the previous point

So the philosophy for most OSes with regards to memory management is to avoid allocation as much as possible. It can do this by caching because it was already allocated memory.

 

[HarimMZ]

It's likely that whatever programs that are running free up memory, Windows doesn't actually evict it from memory. It keeps it in RAM because it's much faster to flip a switch that reactivates it than it is to re-allocate memory for it.

Memory allocation is an expensive operation because the OS has to figure out:

• If there's enough memory for it
• If something else has to drop off or be moved to the page file
• If there's contiguous space for it, because it's much easier to keep track of memory when it's just "N + M" than "N, M, X, Y, Z, etc.", and if there isn't enough contiguous space, put it around in as few pieces as possible.
• And after all that, maybe perform a memory "defrag" operation because of the previous point

So the philosophy for most OSes with regards to memory management is to avoid allocation as much as possible. It can do this by caching because it was already allocated memory.

Sorry, I don't really understand how this is supposed to help me in my situation.
Could you please explain it in a simpler way? The whole problem is that I can't understand what is in the cached memory and why it is different every day, although the applications used are always the same.
P.S Yesterday when I created this question on the forum in the cache was 8gb, today starting the computer and after half an hour I saw that in the cache is already 7.5gb, I was surprised and when trying to turn it off and on I noticed that was downloaded Windows update and to install it requires a reboot, so maybe yesterday was downloaded this update and this cache has grown, but it is strange that yesterday when I turned off the computer the system did not ask me to install it.
And after rebooting and installing the cache is now 3.7gb in 1.5 hours of computer work(Only Chrome browser and Telegram are used as always)

 

[rgd1101]

Sorry, I don't really understand how this is supposed to help me in my situation.

easy, if your pc is working. stop worrying and go do something.

 

[SkyNetRising]

Sorry, I don't really understand how this is supposed to help me in my situation.

What exactly is your perceived issue?

Could you please explain it in a simpler way? The whole problem is that I can't understand what is in the cached memory and why it is different every day, although the applications used are always the same.

Windows uses free ram for file system caching. This is normal operation.
If some process will require additional ram and there's no free ram available, then cached ram will be released for this process.

Unused ram = wasted ram. You want it all to be used.

 

[Bob.B]

Sorry, I don't really understand how this is supposed to help me in my situation.
Could you please explain it in a simpler way? The whole problem is that I can't understand what is in the cached memory and why it is different every day, although the applications used are always the same.
P.S Yesterday when I created this question on the forum in the cache was 8gb, today starting the computer and after half an hour I saw that in the cache is already 7.5gb, I was surprised and when trying to turn it off and on I noticed that was downloaded Windows update and to install it requires a reboot, so maybe yesterday was downloaded this update and this cache has grown, but it is strange that yesterday when I turned off the computer the system did not ask me to install it.
And after rebooting and installing the cache is now 3.7gb in 1.5 hours of computer work(Only Chrome browser and Telegram are used as always)

Just for yuks disable the sysmain service see if it makes a diff.

 

[HarimMZ]

What exactly is your perceived issue?

I don't know, at first I thought it was a virus, but none of the antivirus applications found anything (Kaspersky, Eset NOD 32, Windows Defender + standalone Windows Defender module)
Then it became a principle for me to understand what caused such behavior of the system, I tried to use RamMap, because I saw in the video that through it you can see what took memory, but I failed (as you can see on my screenshots in the first post of this topic)

Windows uses free ram for file system caching. This is normal operation.
If some process will require additional ram and there's no free ram available, then cached ram will be released for this process.

I understand it perfectly well, but if it is so, why using every day the same programs(exclusively the same) I get different cache values? That's why I'm paranoid about viruses.
It's just that I work with finances and I need to be sure that everything is fine with the system.
To justify my paranoia I would like to cancel that half a year ago a bunch of important information was stolen from a bunch of people who are not related to each other.
After that I completely cleaned all my disks and installed a new Windows from scratch and now I'm trying to sort out the cache.

 

[HarimMZ]

Just for yuks disable the sysmain service see if it makes a diff.

I've thought about it actually, but I don't know how to do it right

 

[JayBird99]

I tried.

Windows will cache what it is going to cache. There is nothing you can do to tell it how to do what it’s supposed to do.

Like I said above, there are alternatives, but that requires Linux. Windows has done this since Windows 7(?) I think. Since HDDs are being phased out of boot drive use, and shifted more to archival, it’s gonna cache what it’s gonna cache. 🤷

I can’t tell you what it’s going to cache as it does it itself. Any system component or service or file/app/dependencies and anything it thinks it may need to keep everything snappy. Like was stated above also, because it’s saying that doesn’t mean it’s actively being “used” so much as it’s showing you that the cache is doing what it’s supposed to be doing. This is completely normal behavior for Windows and many other OSes. macOS does it as well, but it kinda keeps it hidden from you. Would you rather know or not, that it’s doing what’s intended behavior?

And yes from time to time with you doing nothing different, it will change the cache. It will evict some stuff that’s probably older and reload it and completely evict some to storage, and pull something different into RAM. You never know exactly. It’s closed source so you, nor any of us, can tell you exactly what is in there or what changes are made day to day.

 

[HarimMZ]

I tried.

Windows will cache what it is going to cache. There is nothing you can do to tell it how to do what it’s supposed to do.

Like I said above, there are alternatives, but that requires Linux. Windows has done this since Windows 7(?) I think. Since HDDs are being phased out of boot drive use, and shifted more to archival, it’s gonna cache what it’s gonna cache. 🤷

I can’t tell you what it’s going to cache as it does it itself. Any system component or service or file/app/dependencies and anything it thinks it may need to keep everything snappy. Like was stated above also, because it’s saying that doesn’t mean it’s actively being “used” so much as it’s showing you that the cache is doing what it’s supposed to be doing. This is completely normal behavior for Windows and many other OSes. macOS does it as well, but it kinda keeps it hidden from you. Would you rather know or not, that it’s doing what’s intended behavior?

And yes from time to time with you doing nothing different, it will change the cache. It will evict some stuff that’s probably older and reload it and completely evict some to storage, and pull something different into RAM. You never know exactly. It’s closed source so you, nor any of us, can tell you exactly what is in there or what changes are made day to day.

But its function is for performance you wrote yourself, but how can I be sure that cached there need me or at least is not a virus?
Maybe it's running something and that's why the cache is so big, yes I realize it probably sounds crazy (although I used different available antiviruses and they found nothing).
It's just that in my case it seems like something strange, with it caching different values literally every day, even though my actions don't change from day to day

 

[rgd1101]

by anti virus/malware software scan.
and common sense.

this is not DOS. windows have lot of different app/service running in the background.

 

[HarimMZ]

this is not DOS. windows have lot of different app/service running in the background.

But is there an answer to the question of why the cache differs by a factor of 2 every day? If it's true program services and such?
More about the days when cache becomes 8gb, it happens in a short period of time and paged pool increases to 500-600mb from 200mb

 

[rgd1101]

Even if you stop using the pc for a month. there are service and schedule job that run in the background.
the only way to make it the same is turn it off. 0GB

 

[HarimMZ]

Even if you stop using the pc for a month. there are service and schedule job that run in the background.
the only way to make it the same is turn it off. 0GB

Yeah, I've had a cat turn on my computer, I come home eight hours later. And I don't even have an authorized account, the cache indicator was 6-7gb, although no application was running, maybe it's true that some service every two days does caching like that.

 

[Bob.B]

I've thought about it actually, but I don't know how to do it right

Try this.

What Is SuperFetch or SysMain ? How To Fix It Or Disable It?

Sysmain causing 100% CPU or Disk issue? How to disable it? Or how to fix permanelty without disabling the service or Is it a virus?

www.techsupportall.com

 

[JayBird99]

Do note that disabling these features will most of the time impact performance. Some positively, some very very negatively.

So watch carefully what you clear and disable. If you disable pre-fetch and then the OS or you re-enable it, that cache/swap could grow even larger. So keep that in mind as well. There is a chance it could grow larger.

 

[hotaru.hino]

But is there an answer to the question of why the cache differs by a factor of 2 every day? If it's true program services and such?
More about the days when cache becomes 8gb, it happens in a short period of time and paged pool increases to 500-600mb from 200mb

If you're paranoid about viruses at this point, do a clean reinstall of Windows and monitor exactly everything you do and touch. Then come back in about a month of use and see if worrying about cached data in RAM changing is worth worrying about.