Question meml - High non-paged memory usage

[Captain_Kuijt]

Greetings!

I've been trying to identify what exactly is the root cause of my high non-paged memory usage. Using Kernel Pool Monitor, it seems the culprit is something called "meml". Problem is, I can't find anything online as to what program/driver that would be. I was hoping maybe someone on here could help me figure this out. Thanks in advance!

 

[rgd1101]

it just mean data it is not cache in ram.
are you having system issue?

 

[hotaru.hino]

If I'm reading this right, the NP size is 4GB. Is that what Task Manager also reports?

If "meml" is the process name, you should be able to find where it's located in Task Manager by right clicking on it in the Details tab and selecting "Open File Location". Where it's located may help pinpoint what it is.

Also nitpicking beyond here, OP can ignore this

it just mean data it is not cache in ram.
are you having system issue?

Non-paged pool is data in RAM that can't be moved into the page file. This is usually from kernel space data like drivers.

Anything higher than about 1GB is usually a problem.

 

[Captain_Kuijt]

If I'm reading this right, the NP size is 4GB. Is that what Task Manager also reports?

If "meml" is the process name, you should be able to find where it's located in Task Manager by right clicking on it in the Details tab and selecting "Open File Location". Where it's located may help pinpoint what it is.

Also nitpicking beyond here, OP can ignore this

Non-paged pool is data in RAM that can't be moved into the page file. This is usually from kernel space data like drivers.

Anything higher than about 1GB is usually a problem.

That's correct, Task Manager also reports an absurdly large NP size. The thing is, there is no process called "meml". I used Kernel Pool Monitor specifically because the amount of RAM being used didn't match at all what the active processes were using, not even close. The NP begins at a "normal" size, around 250MB at boot, but keeps growing as the PC stays powered on, eventually reaching obscure sizes. For reference, it reached 4GB in size after 6 days.

I keep scratching my as to what on earth could be the cause, as neither Task Manager, Kernel Pool Monitor, nor Windows Performance Reporter give any clue as to what or where "meml" even is. But even after a restart, I think there's far more RAM being used than what should actually be in use. This is right after a restart:

https://i.postimg.cc/NFmwH6wY/Screenshot-8.png

https://i.postimg.cc/0yc1D5h6/Screenshot-9.png

This only grows in size as the PC stays on. After ~12 days, the RAM usage reached ~9.8GB, with only Steam, Discord, & Razer Synapse open. There's almost certainly a memory leak somewhere.

it just mean data it is not cache in ram.
are you having system issue?

In terms of RAM usage, yes. See the above.

 

[hotaru.hino]

That's correct, Task Manager also reports an absurdly large NP size. The thing is, there is no process called "meml". I used Kernel Pool Monitor specifically because the amount of RAM being used didn't match at all what the active processes were using, not even close. The NP begins at a "normal" size, around 250MB at boot, but keeps growing as the PC stays powered on, eventually reaching obscure sizes. For reference, it reached 4GB in size after 6 days.

I keep scratching my as to what on earth could be the cause, as neither Task Manager, Kernel Pool Monitor, nor Windows Performance Reporter give any clue as to what or where "meml" even is. But even after a restart, I think there's far more RAM being used than what should actually be in use. This is right after a restart:

https://i.postimg.cc/NFmwH6wY/Screenshot-8.png

https://i.postimg.cc/0yc1D5h6/Screenshot-9.png

This only grows in size as the PC stays on. After ~12 days, the RAM usage reached ~9.8GB, with only Steam, Discord, & Razer Synapse open. There's almost certainly a memory leak somewhere.


In terms of RAM usage, yes. See the above.

If you go to Task Manager in the Details tab and enable the "NP Pool" column when the usage goes up, does that show anything?

If nothing's showing up in Task Manager, it's likely malware, since they tend to hide the moment they detect Task Manager pops up. Process Explorer may also pick this up since they don't check for that either.

Either way, see if there's a way to figure out where the process is being launched from. These tools should be able to tell you that.

 

[Captain_Kuijt]

If you go to Task Manager in the Details tab and enable the "NP Pool" column when the usage goes up, does that show anything?

If nothing's showing up in Task Manager, it's likely malware, since they tend to hide the moment they detect Task Manager pops up. Process Explorer may also pick this up since they don't check for that either.

Either way, see if there's a way to figure out where the process is being launched from. These tools should be able to tell you that.

NP Pool column is enabled in Task Manager, it's not visible there nor in Process Viewer. The only places you can see it is in Kernel Pool Monitor and Windows Performance Analyzer, but they don't show the source location or what it even does, except that it was using up a stupid amount of RAM.

After doing a reboot yesterday, "meml" stopped using a lot of RAM. It's currently sitting at 27MB. Though this doesn't explain why EtwB is using so much. From what I've gathered, it's diagnostic-related and sends data to Microsoft. To disable it, you go into settings > privacy. Except it's already set to off, so I have no idea what it's doing or why, or if it's merely a symptom of something else going haywire.

 

[ubuysa]

Are you actually having a problem, or are you just wondering why the non-paged pool seems high to you? In the two screenshots in post #4 I see nothing at all out of the ordinary.

A non-paged pool memory leak does happen sometimes, and the cause is almost always a third-party driver.

TBH I'm wondering why this is an issue for you? Apart from not knowing what the meml process is - although some web searching throws up two possibilities...

• Meml is a deep-learning data augmentation methodology
• Meml is a Lisp-like markup language, similar to HTML

 

[hotaru.hino]

Are you actually having a problem, or are you just wondering why the non-paged pool seems high to you? In the two screenshots in post #4 I see nothing at all out of the ordinary.

A non-paged pool memory leak does happen sometimes, and the cause is almost always a third-party driver.

TBH I'm wondering why this is an issue for you? Apart from not knowing what the meml process is - although some web searching throws up two possibilities...

• Meml is a deep-learning data augmentation methodology
• Meml is a Lisp-like markup language, similar to HTML

Non Paged Pool shouldn't be creeping past 1-1.5GB of usage over time. I'm currently sitting at 9 days of uptime and my NP pool is ~750MB.

A leaky kernel mode program is a problem. While issues like this may be tolerable in user space mode (after all, you can just restart the app), they may not be in kernel mode. Unless you really know what you're doing, you can't simply just restart the offending process. You have to restart the computer. In addition, it may present a security problem.

 

[Captain_Kuijt]

Are you actually having a problem, or are you just wondering why the non-paged pool seems high to you? In the two screenshots in post #4 I see nothing at all out of the ordinary.

A non-paged pool memory leak does happen sometimes, and the cause is almost always a third-party driver.

TBH I'm wondering why this is an issue for you? Apart from not knowing what the meml process is - although some web searching throws up two possibilities...

• Meml is a deep-learning data augmentation methodology
• Meml is a Lisp-like markup language, similar to HTML

It seems that the high NP usage has gone down somewhat. At boot it was ~250MB, now after 20 hours uptime it's sitting at 435MB. I'm also just wondering why the RAM usage is so high when doing virtually (heh) nothing.

As you can see, there's hardly anything running to make it use 4.9GB of RAM. Maybe I'm just being picky, but I feel like this is higher than it should be, especially given the fact that it slowly ramps up as the PC stays on over the course of the week(s). Or is this normal for a Windows 10 installation? It's not an absolute crisis, seeing as RAM is so cheap nowadays I could easily just upgrade to 64GB. But I'd still like some clarity.

 

[hotaru.hino]

How much RAM is being used after a boot depends on what you have starting up. However, I do expect the overall RAM usage to creep up over time to a plateau point.

Also another thing to correct myself with, I found out the uptime Task Manager reports is based on time since a specific Windows event. It only triggers on a reboot or a shutdown that isn't using Fast Boot. However, my computer's been on basically 12-16 hours a day.

 

[ubuysa]

My non-paged pool is currently 517MB, larger than yours. All I'm doing is streaming a radio station and accessing this forum. My PC is on 24 x 7.

 

[Captain_Kuijt]

Update:

Apparently I spoke too soon. After 3 days and 22 hours of uptime, the NP pool bloating is back to where it was previously again. Prior to this, I had done a full system-wide scan with both Malwarebytes and Kaspersky.

NP Pool at 3.1GB, overall RAM usage at 7.6GB. At boot it was 4.9GB, now three days later is has gone up massively with the same exact processes running. Again, this is with virtually nothing running in the background. I honestly have no idea what else to try at this point. Unless I can find out what these two processes (meml & EtwB) are and why they're behaving this way, I'm out of options.

 

[ubuysa]

EtwB is part of event tracing - it's the Windows logging function. I wonder whether meml could be memory logging? Could you export and upload your Application and System logs please? Here's how to do that....

1. Enter the command eventvwr into the Run command box. The Event Viewer will open.
2. Locate the Windows Logs folder in the left hand pane and expand it by clicking on the arrow (>) to the left of it.
3. Right-click on the Application entry and select 'Save all events as...'. Choose a folder anywhere that suits you and a filename of 'Application' (an .evtx suffix will be added automatically).
4. Right-click on the System entry and select 'Save all events as...'. Choose a folder anywhere that suits you and a filename of 'System' (an .evtx suffix will be added automatically).
5. Zip the Application.evtx and System.evtx files together and upload the zip file here.

 

[Captain_Kuijt]

EtwB is part of event tracing - it's the Windows logging function. I wonder whether meml could be memory logging? Could you export and upload your Application and System logs please? Here's how to do that....

1. Enter the command eventvwr into the Run command box. The Event Viewer will open.
2. Locate the Windows Logs folder in the left hand pane and expand it by clicking on the arrow (>) to the left of it.
3. Right-click on the Application entry and select 'Save all events as...'. Choose a folder anywhere that suits you and a filename of 'Application' (an .evtx suffix will be added automatically).
4. Right-click on the System entry and select 'Save all events as...'. Choose a folder anywhere that suits you and a filename of 'System' (an .evtx suffix will be added automatically).
5. Zip the Application.evtx and System.evtx files together and upload the zip file here.

Here you go!

Application & System logs.zip

drive.google.com

 

[ubuysa]

Your System log is jammed full of these errors, and I'm not kidding, there are hundreds...

Log Name:      System
Source:        Service Control Manager
Date:          10/07/2023 03:36:04
Event ID:      7034
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Assburger-Station
Description:
The Windows Search service terminated unexpectedly. It has done this 214 time(s).

Log Name:      System
Source:        Service Control Manager
Date:          10/07/2023 03:36:04
Event ID:      7023
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Assburger-Station
Description:
The Windows Search service terminated with the following error:
The system cannot find the file specified.

These errors occur in huge numbers and go right back to the start of the log in February.

Not surprisingly your Application log also has a huge number of similar search errors...

Log Name:      Application
Source:        Microsoft-Windows-Search
Date:          04/07/2023 19:55:03
Event ID:      3058
Task Category: Gatherer
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Assburger-Station
Description:
The application cannot be initialised.

Context: Windows Application

Details:
    The system cannot find the file specified.  (HRESULT : 0x80070002) (0x80070002)


Log Name:      Application
Source:        Microsoft-Windows-Search
Date:          04/07/2023 19:55:03
Event ID:      7010
Task Category: Gatherer
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Assburger-Station
Description:
The index cannot be initialised.

Details:
    The system cannot find the file specified.  (HRESULT : 0x80070002) (0x80070002)

The Application log also contains a huge number of this sequence of ESENT informational messages...

Log Name:      Application
Source:        ESENT
Date:          05/07/2023 22:08:19
Event ID:      105
Task Category: General
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Assburger-Station
Description:
SearchIndexer (16076,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)
 
Additional Data:
 lgposV2[] = 00000559:0001:0000 - 00000559:009F:00EA - 00000559:00A0:0000 - 00000559:00A0:0000 (00000000:0000:0000)
cReInits = 20
 
 
Internal Timing Sequence:
[1] 0.000488 +J(0) +M(C:0K, Fs:191, WS:732K # 732K, PF:4872K # 4872K, P:4872K)
[2] 0.000256 +J(0) +M(C:0K, Fs:230, WS:916K # 916K, PF:984K # 984K, P:984K)
[3] 0.000021 +J(0) +M(C:0K, Fs:21, WS:80K # 80K, PF:68K # 68K, P:68K)
[4] 0.000071 +J(0) +M(C:0K, Fs:43, WS:172K # 172K, PF:348K # 348K, P:348K)
[5] 0.000838 +J(0) +M(C:0K, Fs:12, WS:48K # 48K, PF:20K # 20K, P:20K)
[6] 0.001614 +J(0) +M(C:0K, Fs:23, WS:92K # 92K, PF:16K # 24K, P:16K)
[7] 0.001360 +J(0) +M(C:0K, Fs:270, WS:1076K # 1076K, PF:1028K # 1020K, P:1028K)
[8] 0.020765 -0.001765 (3) CM -0.001693 (5) WT +J(CM:3, PgRf:15, Rd:0/3, Dy:3/27, Lg:644904/1077) +M(C:0K, Fs:4641, WS:1616K # 1616K, PF:1344K # 1344K, P:1344K)
[9] 0.000398 +J(0) +M(C:0K, Fs:6, WS:24K # 24K, PF:0K # 0K, P:0K)
[10] 0.000391 +J(0) +M(C:0K, Fs:0, WS:-1020K # 0K, PF:-1020K # 0K, P:-1020K)
[11] 0.000013 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:49/1) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K)
[12] 0.004358 -0.004234 (3) WT +J(CM:3, PgRf:0, Rd:0/3, Dy:0/0, Lg:0/0) +M(C:0K, Fs:15, WS:12K # 0K, PF:0K # 0K, P:0K)
[13] 0.010648 -0.000812 (2) CM -0.004335 (20) WT +J(CM:2, PgRf:2, Rd:0/2, Dy:0/0, Lg:8759/5) +M(C:0K, Fs:309, WS:-900K # 0K, PF:-912K # 0K, P:-912K)
[14] 0.000012 +J(0)
[15] 0.000023 +J(0)
[16] 0.000098 +J(0) +M(C:0K, Fs:2, WS:0K # 0K, PF:0K # 0K, P:0K).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESENT" />
    <EventID Qualifiers="0">105</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2023-07-05T19:08:19.6930024Z" />
    <EventRecordID>41774632</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Assburger-Station</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SearchIndexer</Data>
    <Data>16076,D,0</Data>
    <Data>Windows: </Data>
    <Data>0</Data>
    <Data>0</Data>
    <Data>
[1] 0.000488 +J(0) +M(C:0K, Fs:191, WS:732K # 732K, PF:4872K # 4872K, P:4872K)
[2] 0.000256 +J(0) +M(C:0K, Fs:230, WS:916K # 916K, PF:984K # 984K, P:984K)
[3] 0.000021 +J(0) +M(C:0K, Fs:21, WS:80K # 80K, PF:68K # 68K, P:68K)
[4] 0.000071 +J(0) +M(C:0K, Fs:43, WS:172K # 172K, PF:348K # 348K, P:348K)
[5] 0.000838 +J(0) +M(C:0K, Fs:12, WS:48K # 48K, PF:20K # 20K, P:20K)
[6] 0.001614 +J(0) +M(C:0K, Fs:23, WS:92K # 92K, PF:16K # 24K, P:16K)
[7] 0.001360 +J(0) +M(C:0K, Fs:270, WS:1076K # 1076K, PF:1028K # 1020K, P:1028K)
[8] 0.020765 -0.001765 (3) CM -0.001693 (5) WT +J(CM:3, PgRf:15, Rd:0/3, Dy:3/27, Lg:644904/1077) +M(C:0K, Fs:4641, WS:1616K # 1616K, PF:1344K # 1344K, P:1344K)
[9] 0.000398 +J(0) +M(C:0K, Fs:6, WS:24K # 24K, PF:0K # 0K, P:0K)
[10] 0.000391 +J(0) +M(C:0K, Fs:0, WS:-1020K # 0K, PF:-1020K # 0K, P:-1020K)
[11] 0.000013 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:49/1) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K)
[12] 0.004358 -0.004234 (3) WT +J(CM:3, PgRf:0, Rd:0/3, Dy:0/0, Lg:0/0) +M(C:0K, Fs:15, WS:12K # 0K, PF:0K # 0K, P:0K)
[13] 0.010648 -0.000812 (2) CM -0.004335 (20) WT +J(CM:2, PgRf:2, Rd:0/2, Dy:0/0, Lg:8759/5) +M(C:0K, Fs:309, WS:-900K # 0K, PF:-912K # 0K, P:-912K)
[14] 0.000012 +J(0)
[15] 0.000023 +J(0)
[16] 0.000098 +J(0) +M(C:0K, Fs:2, WS:0K # 0K, PF:0K # 0K, P:0K).</Data>
    <Data>lgposV2[] = 00000559:0001:0000 - 00000559:009F:00EA - 00000559:00A0:0000 - 00000559:00A0:0000 (00000000:0000:0000)
cReInits = 20
</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        ESENT
Date:          05/07/2023 22:08:19
Event ID:      326
Task Category: General
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Assburger-Station
Description:
SearchIndexer (16076,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)
 
Saved Cache: 0 0
Additional Data: lgposAttach = 00000559:00A2:0268,
dbv = 1568.110.240
 
Internal Timing Sequence:
[1] 0.000002 +J(0)
[2] 0.000249 +J(0) +M(C:0K, Fs:24, WS:32K # 0K, PF:32K # 0K, P:32K)
[3] 0.002310 -0.000549 (5) WT +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:18, WS:40K # 0K, PF:36K # 0K, P:36K)
[4] 0.000064 +J(0)
[5] -
[6] -
[7] -
[8] 0.000964 -0.000745 (2) CM +J(CM:2, PgRf:2, Rd:14/2, Dy:0/0, Lg:54/1) +M(C:0K, Fs:25, WS:100K # 0K, PF:1272K # 0K, P:1272K)
[9] 0.006052 -0.000258 (5) CM -0.005639 (1) WT +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:65, WS:256K # 0K, PF:228K # 0K, P:228K)
[10] 0.000314 -0.000235 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:10, WS:40K # 0K, PF:96K # 0K, P:96K)
[11] 0.000009 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:2, WS:8K # 0K, PF:0K # 0K, P:0K)
[12] 0.000032 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:3, WS:12K # 0K, PF:0K # 0K, P:0K)
[13] 0.0 +J(0)
[14] 0.0 +J(0)
[15] 0.000004 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).


Log Name:      Application
Source:        ESENT
Date:          05/07/2023 22:08:19
Event ID:      301
Task Category: Logging/Recovery
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Assburger-Station
Description:
SearchIndexer (18520,R,98) Windows: The database engine has finished replaying logfile C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jtx.
 
Processing Stats:
[1] 0.018459 -0.002321 (3) CM -0.000661 (4) WT +J(CM:3, PgRf:15, Rd:0/3, Dy:3/27, Lg:709800/1185) +M(C:0K, Fs:4775, WS:496K # 416K, PF:484K # 388K, P:484K).
Log record of type 'Commit   ' was seen most frequently (220 times)


Log Name:      Application
Source:        ESENT
Date:          05/07/2023 22:08:19
Event ID:      302
Task Category: Logging/Recovery
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Assburger-Station
Description:
SearchIndexer (18520,U,98) Windows: The database engine has successfully completed recovery steps.

ESENT is the transactional database engine used by search (and others).

I'd suggest seeing whether an sfc /scannow can fix this, but there seems to be a big issue with the search function.

There are also a number of these errors in your System log...

Log Name:      System
Source:        disk
Date:          09/07/2023 05:52:09
Event ID:      7
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Assburger-Station
Description:
The device, \Device\Harddisk4\DR4, has a bad block.

I would run a chkdsk /f (or /r if it's an HDD) on that drive.

 

[Captain_Kuijt]

ESENT is the transactional database engine used by search (and others).

I'd suggest seeing whether an sfc /scannow can fix this, but there seems to be a big issue with the search function.

There are also a number of these errors in your System log...

Log Name:      System
Source:        disk
Date:          09/07/2023 05:52:09
Event ID:      7
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Assburger-Station
Description:
The device, \Device\Harddisk4\DR4, has a bad block.

I would run a chkdsk /f (or /r if it's an HDD) on that drive.

Running chkdsk on the harddrive, ETA 4 hours to completion. Will report back what it says once finished. Here's the log from sfc /scannow:

Log file: https://drive.google.com/file/d/1DDUJjmkN_abfWLZhrVXrItwbLe1MPmZN/view?usp=sharing

Afterwards, I ran Dism /Online /Cleanup-Image /ScanHealth. Not sure if that would fix it, but worth a shot.

I can't say for certain whether or not that fixed the issue, as it doesn't specify if it left behind a log file or not. I'll reboot the PC after chkdsk is completed and report back then.

 

[Captain_Kuijt]

Okay, so I did the following:

-Ran chkdsk /r on the harddrive, bad sectors/blocks were fixed successfully by the looks of it.

-Ran the following on my main drive:

DISM.exe /Online /Cleanup-image /Scanhealth
sfc /scannow
DISM.exe /Online /Cleanup-image /Restorehealth

-Rebooted afterwards. Unfortunately, while the DISM command did find corrupted/missing files, /Restorehealth was unable to fix all issues via /Online. I therefore used the Media Creation Tool to create a Windows 10 ISO file to use as a Windows Repair Source. Afterwards I ran the following:

Dism /Online /Cleanup-Image /RestoreHealth /Source P:\sources\install.esd /LimitAccess

Following this, it reported the issues as fixed and I did a reboot after. Unfortunately, this did not fix the issue regarding Search.

As the following files were modified all on the same date & time;
Search_ProtocolHandler.MAPI2.dll
SearchFilterHost.exe
SearchIndexer.exe
SearchProtocolHost.exe

...I figured it worth a shot to have a friend who's also running this exact version of Win10 to send me his copy of these files, then replace mine as a last ditch effort in case the files themselves were corrupted and at fault. I took ownership of the folder, permissions etc, replaced my files with his then reverted permission/ownership back to TrustedInstaller.

Unfortunately, not even this seems to have fixed the issue at hand. At this point I went into Services and set Windows Search's startup type to Disabled and under the Recovery tab I set first, second, and subsequent failures as "Take No Action" to stop it from flooding the Event Viewer. This has "fixed" the issue, even though Search is still crippled. At this point I think I'll just evacuate all my important files to one of my harddrives and get ready to reinstall Windows entirely.

 

[ubuysa]

Have you stopped it indexing your drives?

 

[Captain_Kuijt]

Have you stopped it indexing your drives?

Yep! It wasn't set to index anything to begin with.

 

[ubuysa]

Unfortunately, not even this seems to have fixed the issue at hand. At this point I went into Services and set Windows Search's startup type to Disabled and under the Recovery tab I set first, second, and subsequent failures as "Take No Action" to stop it from flooding the Event Viewer. This has "fixed" the issue, even though Search is still crippled. At this point I think I'll just evacuate all my important files to one of my harddrives and get ready to reinstall Windows entirely.

By 'fixed this issue' do you mean that the non-paged memory issue leak is resolved?

I think I might do a Windows Reset at this point, it does sound as though your Windows installation may be less than ideal...?

 

[Captain_Kuijt]

By 'fixed this issue' do you mean that the non-paged memory issue leak is resolved?

I think I might do a Windows Reset at this point, it does sound as though your Windows installation may be less than ideal...?

Hard to say, as it takes a couple of days before it shows itself. I did a reboot yesterday so it hasn't had enough time yet to say whether or not it's "fixed". But yeah, I agree that the Windows installation definitely could use a complete reinstall at this point, it would (likely) be the easiest way to fix whatever this is.

On that note, do you know of any custom Win10 ISOs you could recommend? I've looked at Ghost Spectre so far and it looks promising, particularly in regards to its lower RAM usage as well as the absence of bloatware and telemetry. I know you can make a custom ISO yourself and that this is usually the better way in terms of security, but I have no knowledge on how to do this.

 

[ubuysa]

Personally I wouldn't entertain a custom ISO. You can never be certain what else is in there.

I always recommend and use the Microsoft Media Creation Tool.

 

[Captain_Kuijt]

Personally I wouldn't entertain a custom ISO. You can never be certain what else is in there.

I always recommend and use the Microsoft Media Creation Tool.

Yeah, you're right. I suppose I'll just try to clean the ISO myself to get all the telemetry and bloat out of it pre-install.

 

[ubuysa]

Personally I don't see the fuss about telemetry. You can control much of it and what's left isn't personslly identifiable. I don't think it unreasonable for MS to collect this kind of info to help improve the product.

As for the bloatware, there isn't all that much, and what there is can mostly uninstall.

 

[Captain_Kuijt]

Update:

So I finally did a full reinstall of Windows 10. RAM usage is back to normal now.

After 3 days uptime: (used to be 7.6GB pre-reinstall)

After a reboot: (used to be 4.9GB pre-reinstall)

This is miles better than what I was getting before. I still have no clue as to what caused the NPP issues, but it seems to have resolved itself after a doing a complete reinstall. Unless anything else pops up, this thread can safely be marked as solved