[SOLVED] Possible Memory Leak

[nickel60]

So I've been running into an issue for quite some time, I've noticed that my non paged pool at times seems way too high. Sometimes a restart fixes this issue but other times it doesn't. From what I have gathered by searching through the forums is that this is most likely a network driver, however I have already updated the drivers by both checking through Device Manager and through Armoury Crate (the software that supports my motherboard-ASUS TUF Gaming X570-Plus Wifi). What else can I do to pinpoint the issue and resolve it? I've done virus scans, spent countless hours looking through different material and frankly I'm stumped on the next steps. Any help would be much appreciated. I've seen people using Task Manager or Poolmon as a way to try and figure this out. I've attached both screenshots below. Any ideas what this might be?

Thanks,

 

[Darkbreeze]

First thing you need to do is get rid of/uninstall Armory crate. As with practically ALL bundled manufacturer software and utilities, these tend to almost always tend to be more trouble than they are worth and often they are actually the cause of a great many issues. Generally these are poorly designed utilities that are not well developed nor well supported, and further, while in some cases they might work fine initially I've seen them become problematic after changes from updated BIOS firmware when the utility itself has not been updated along with it. Regardless, we almost always recommend NOT using any of the bundled manufacturer softwares, as there are essentially ALWAYS better free or open source options available.

In cases where it is the ONLY option out there, well..............you do what you have to do in those cases and sometimes that means continuing to use it.

At the least, I'd get rid of it temporarily to at least see if it changes this behavior you are seeing. You can always reinstall it later and for the record, the majority of what it does can be handled with other utilities. Drivers for example, should NEVER be updated using ANY automatic utility. They should always be manually installed based on what is available from the motherboard product support page. RGB controls can be handled though the Aura Sync software which is still available through other non-ASUS sources and there is also some 3rd party applications out there that I believe will handle it as well, but regardless, at least temporary uninstall should tell you if this is the cause or not. If it is not, then you can simply reinstall the latest version AND if you don't HAVE the latest version of it, that ought to be something you try as well.

Also, make SURE you have the MOST recent stable BIOS version installed.

Also, please post a screenshot of the Task manager "Processes" tab. If you've never used task manager previously you may have to click on "More details" at the bottom of the window in order to expand to the full list of processes. Next, click on the top of the memory column so we can see WHAT is actually using the majority of memory and whether that usage compares realistically to what that process ought to be using.

 

[Colif]

netio.sys and ndis.sys both used by windows to talk to LAN drivers, so if that is where biggest variance between frees and used are, then I would update LAN drivers.

If your PC uses Killer internet drivers, they were a known memory leak a few years ago

Sometimes a restart fixes this issue but other times it doesn't.

that isn't exactly how a memory leak works. if its a driver leak, it should give all ram back it was holding on a restart, as it flushes ram.
when you say restart, do you mean the command in power menu of startup? Just shutting down and restarting win 10 may not flush ram due to fast startup keeping PC awake during shutdown.

 

[Darkbreeze]

Just shutting down and restarting win 10 may not flush ram due to fast startup keeping PC awake during shutdown.

This.

If "Fast restart" or hibernation are not disabled, then likely you are not actually restarting OR shutting down, when you think you are. You are only going into a VERY low power state.

I almost always recommend disabling hibernation or at least disabling fast restart for any desktop. For laptops, on a case by case basis.

You can learn how to do that here:

To disable Hibernation:

The first step is to run the command prompt as administrator. In Windows 10, you can do this by right clicking on the start menu and clicking "Command Prompt (Admin)"
Type in "powercfg.exe /h off" without the quotes and press enter. If you typed it in correctly, the cursor will simply start at a new line asking for new input
Now just exit out of command prompt

 

[nickel60]

Hey guys thanks for the answers. I'll go ahead and uninstall armour crate. Honestly I never use it or and don't care about any of the rgb settings anyway. Half the time the program fails to start. I'll did install the intel lan driver from the website, I just didn't think I needed to install anything since the aforementioned program supposedly installed it to the latest one. I'll also take a look into the bios, Armour Crate said I was on the latest one but again who knows if that is true. Right now my memory is stable, but this is what task manager usually shows as the highest NP pool programs. Sometimes I see Python up there, I think it's associated with GOG.

 

[nickel60]

netio.sys and ndis.sys both used by windows to talk to LAN drivers, so if that is where biggest variance between frees and used are, then I would update LAN drivers.

If your PC uses Killer internet drivers, they were a known memory leak a few years ago


that isn't exactly how a memory leak works. if its a driver leak, it should give all ram back it was holding on a restart, as it flushes ram.
when you say restart, do you mean the command in power menu of startup? Just shutting down and restarting win 10 may not flush ram due to fast startup keeping PC awake during shutdown.

This now makes sense, I realize when I start my PC in the morning it's usually always fine. But when I do a fast restart it doesn't always remedy the issue.

 

[Colif]

never seen it cause one, but of the drivers showing as most usage, I would blame Synapse (only as its not great software)

Nvidia and dwm.exe being high is normal

the trick with Poolmon is to find the process with the biggest difference between Allocs and Frees and it helps to ignore all Microsoft processes as they are unlikely causes.

app seems to name processes in your example but this might help for any unknown tags - https://github.com/zodiacon/PoolMonXv2/blob/master/PoolMonX/res/pooltag.txt

 

[Darkbreeze]

And, clearly you didn't click on the top of the memory column, so that ALL of the highest memory usage processes would be moved to the top of the column with the highest use process being first and graduating downward from there. That would also be useful because there may be something further down the stack that you aren't seeing, because they tend to change positions a lot, which might be important to the conversation.

While I agree that poolmon is a useful tool, in my opinion it's a good idea to first determine that there isn't simply a process that is using an unreasonable amount of memory versus an actual memory leak, which of course is an entirely different thing.

Also, you are screenshotting the "Resource monitor" utility data, not the "Task manager" data. I have seen HUGE discrepancies between the data provided between these two utilities at times in the past. Simply press control+alt+delete simultaneously, then click on Task manager, then click on "more info" and then click the top of the memory column to order it with high to low rules.

Taking Colif's advice is a good idea as well, as he is pretty well versed in troubleshooting Windows 10 errors and driver issues, among other OS problems.

 

[nickel60]

Couple updates here. Wow did I have a lot of stuff outdated. My network drivers were up to date, however my bios was severely outdated. as well as LAN drivers (don't know if this even matters since I'm always connected on WIFI?) and chipset. There had been over a year of update that I have assumed the program was notifying and updating me on. My system was always snappy but after the updates it does feel a bit more responsive and smoother. I'm holding out hope that these updates will do the trick.

I've taken a hard look at what is consuming the most memory from a program perspective using Task Manager, however the numbers were paltry with Chrome usually at the top of the list. I do know that Chrome can be memory intensive at times, however it never seemed to anything egregious. I've taken a screenshot, it always looks like this (currently my memory usage is fine). Like my previous screenshots suggested, my non paged pool was over 15GB.

 

[Darkbreeze]

Drivers ALWAYS matter, because even if you aren't using the ethernet much or at all, it's STILL loaded into memory JUST IN CASE you do use that device. So it STILL has just as much potential to cause problems as if were actually in full use.

When was the last time, if ever, you did a CLEAN install of Windows? Has this OS installation been used for more than one hardware configuration over the years?

Also, I didn't see it mentioned here, and I just assumed you were using Windows 10 but maybe not. So, what OS version ARE you running? And, what BUILD version if you're running Windows 10?

 

[nickel60]

I actually built this PC about a year ago. So the last time I did a clean install was then. The only thing I have added since then was another drive to increase capacity, otherwise everything is still as is. I'm running version 10.0.19043 build 19043 windows 10 . I have thought about upgrading to 11, however I still use this machine to remote in for work and don't want to mess up any compatibility issues that might create.

 

[Darkbreeze]

Forget 11. It's still not fully ready for prime time IMO. Besides which, it's mostly the same as 10 except that it's a real PITA when it comes to dealing with it's prerequisites and for the most part, the differences are largely aesthetic. I haven't really seen any features that 11 has which are lacking in 10, that most people would ever care about.

@Colif should be able to help you with trying to track down the memory leak if there is one using various tools. If all else fails though, I'd recommend backing up anything important and doing a clean install of Windows, then slowly add software back in one application or utility at a time, checking between installations to see if the problem has returned, so that you can hopefully determine what is causing it.

 

[Colif]

i don't get the win 11 hate, its fine. Its pretty much win 10 with a different UI. I haven't noticed that much difference to 10. Too many people seem to want it to fail as their hardware can't run it. Too much "I told you so" going on. They want to be proven right... like all those that wanted win 10 to fail so MS had to fix 7... stop living in the past. Stop forcing everyone else to do same.

Upgrading to 11 likely not help a memory leak as it would take same drivers along for ride.

i don't think applications can cause memory leaks, unless they are programs associated with hardware (like Asus programs). Almost all leaks are drivers.

 

[Darkbreeze]

For the record, I never wanted Windows 10 to fail and was actually an early adopter because it had ACTUAL improvements over Windows 7. Windows 11, I have yet to see what those improvements are other than a revised desktop and and one number more than 10. But I'm certainly not against anybody upgrading either if they desire to do so. I just don't see an imperative for it.

i don't think applications can cause memory leaks, unless they are programs associated with hardware (like Asus programs). Almost all leaks are drivers.

Applications absolutely can, and do, cause memory leaks.

Finding a User-Mode Memory Leak describes how to find a leak that is caused by a user-mode driver or application.

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/finding-a-memory-leak

Hardware can also be the cause in some rarer cases.

Finding a Kernel-Mode Memory Leak describes how to find a leak that is caused by a kernel-mode driver or component.

It's entirely possible for specific hardware to cause the software to go down an atypical path that leaks memory.

So, there are many things that MIGHT potentially be at fault for causing a memory leak.

 

[USAFRet]

i don't think applications can cause memory leaks, unless they are programs associated with hardware (like Asus programs). Almost all leaks are drivers.

"memory leak' is one of the most misunderstood concepts around.
Like ping and bottleneck.

Applications can absolutely cause issues that would be regarded as a 'memory leak'.

For instance, Paintshop Pro...

Every once in a while, it checks into home base for a new version.
Lets say it consumes 50MB each time it checks, and it checks once an hour.
If that check function did NOT release whatever memory was used....after 10 hours...that is 500MB still consumed, and doing nothing.

Many applications do that. For versioning, updates, or licensing checks.

 

[hotaru.hino]

i don't think applications can cause memory leaks, unless they are programs associated with hardware (like Asus programs). Almost all leaks are drivers.

Oh they can. You can easily do it with the following:

int main() {
    int *foo = malloc(64);     // Allocate 64 bytes
    while(true) {            // Loop forever lol
        *foo = malloc(64);    // Allocate 64 bytes, but never free the 64 bytes we allocated before
    }
}

This will balloon up real fast.

But what you say does have a measure of truth. If the application was developed with a language and framework that automatically manages its own memory (such as C#, Java, or Python), then it's a lot harder for the programmer to leak memory. However, that doesn't mean the application won't continue to consume memory for other purposes.

 

[Colif]

I know programs can be written to steal memory, the video I watched on poolmon showed a program they had written to do that very thing. It was used to explain how to use poolmon
I should have said most of the time its drivers, but there are exceptions. There are always exceptions.

 

[nickel60]

Good to know that upgrading wouldn't have resolved the issue. I do like the UI of windows 11 and even though it might be half gimmicky I still don't mind a fresh look at things. Again only reason I wouldn't be updating is due to certain software possibly being incompatible

I wasn't able to use my machine much this weekend, I didn't notice the memory leak the times I did use it. But it usually rears it's head later in the day so I'm curious how it holds up today. I'll revert back anyway with any updates. For anyone else who might find this down the line turns out that my drivers were out of date and I thought Armoury Crate/Windows updater had my back...turns out they didn't. Updated all network drivers (including LAN) as well as BIOS. Seems to have done the trick so far.

 

[hotaru.hino]

If by memory leak, we're talking about "I don't have anything open but Task Manager says most of my RAM is being used" and it reports the non-paged pool is taking up most of the space (it should never be more than 1GB on a typical system), then we can start looking at drivers. You might be able to use Process Explorer to narrow down where memory is actually leaking, but otherwise it's a driver. And 9 times out of 10 it's usually the network driver because network stacks are notorious for having various areas where memory leaks.

 

[nickel60]

"memory leak' is one of the most misunderstood concepts around.
Like ping and bottleneck.

Applications can absolutely cause issues that would be regarded as a 'memory leak'.

For instance, Paintshop Pro...

Every once in a while, it checks into home base for a new version.
Lets say it consumes 50MB each time it checks, and it checks once an hour.
If that check function did NOT release whatever memory was used....after 10 hours...that is 500MB still consumed, and doing nothing.

Many applications do that. For versioning, updates, or licensing checks.

Just out of curiosity, would this kind of consumption be in paged or non paged pool?

 

[nickel60]

If by memory leak, we're talking about "I don't have anything open but Task Manager says most of my RAM is being used" and it reports the non-paged pool is taking up most of the space (it should never be more than 1GB on a typical system), then we can start looking at drivers. You might be able to use Process Explorer to narrow down where memory is actually leaking, but otherwise it's a driver. And 9 times out of 10 it's usually the network driver because network stacks are notorious for having various areas where memory leaks.

Exactly right, nothing is open but my non paged pool was over 15g. Looks like for now it's holding steady so it just might have been those LAN drivers

 

[Darkbreeze]

Very possible.

 

[Colif]

Just out of curiosity, would this kind of consumption be in paged or non paged pool?

non paged.

Drivers have to run in ram, they cannot run from page file, so they are always in the non paged pool

to see if it is drivers, run in safe mode as there is nothing other than windows there. Its unlikely its the lan drivers that come with windows.

what motherboard do you have?

Can you download and run Driverview - http://www.nirsoft.net/utils/driverview.html

All it does is looks at drivers installed; it won't install any (this is intentional as 3rd party driver updaters often get it wrong)

When you run it, go into view tab and set it to hide all Microsoft drivers, will make list shorter.

Now its up to you, you can look through the drivers and try to find old drivers, or you can take a screenshot from (and including)Driver name to (and including)Creation date.

upload it to an image sharing website and show link here

just curious what you have.

 

[nickel60]

non paged.

Drivers have to run in ram, they cannot run from page file, so they are always in the non paged pool

to see if it is drivers, run in safe mode as there is nothing other than windows there. Its unlikely its the lan drivers that come with windows.

what motherboard do you have?

Can you download and run Driverview - http://www.nirsoft.net/utils/driverview.html

All it does is looks at drivers installed; it won't install any (this is intentional as 3rd party driver updaters often get it wrong)

When you run it, go into view tab and set it to hide all Microsoft drivers, will make list shorter.

Now its up to you, you can look through the drivers and try to find old drivers, or you can take a screenshot from (and including)Driver name to (and including)Creation date.

upload it to an image sharing website and show link here

just curious what you have.

I was mostly referring to his Paintshop pro example. But that's good to keep in mind.

Just an update from the past couple days of using it, I have not come across the issue again even after heavy use and gaming. I think that did the trick I appreciate everyone's help here.

I have the tuf gaming x570-plus (wi-fi).

Here are the drivers that I have.

 

[Darkbreeze]

👍