Question Windows successfully diagnosed a low virtual memory condition - then locks up

[martij7au]

So my computer occasionally freezes up, and requires a hard reboot. I went back to look at the event logs, and noticed just before the computer locked up, the following messages appeared:
Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: firefox.exe (16972) consumed 660303872 bytes, firefox.exe (21396) consumed 602046464 bytes, and MBAMService.exe (4492) consumed 530677760 bytes.

However, my paging file appears to be ~32GB large (or bigger), and the programs listed are using much less than that ~600MB or so each. Any idea what might be going on here?

Thanks in advance!

Here is the details text for that error:
Log Name: System
Source: Microsoft-Windows-Resource-Exhaustion-Detector
Date: 7/14/2022 8:16:17 AM
Event ID: 2004
Task Category: Resource Exhaustion Diagnosis Events
Level: Warning
Keywords: Events related to exhaustion of system commit limit (virtual memory).
User: SYSTEM
Computer: DESKTOP-JCM
Description:
Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: firefox.exe (16972) consumed 660303872 bytes, firefox.exe (21396) consumed 602046464 bytes, and MBAMService.exe (4492) consumed 530677760 bytes.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Resource-Exhaustion-Detector" Guid="{9988748e-c2e8-4054-85f6-0c3e1cad2470}" />
<EventID>2004</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>3</Task>
<Opcode>33</Opcode>
<Keywords>0x8000000020000000</Keywords>
<TimeCreated SystemTime="2022-07-14T12:16:17.6026768Z" />
<EventRecordID>49592</EventRecordID>
<Correlation ActivityID="{46249b24-ffbd-40cd-8419-4c2bb0031247}" />
<Execution ProcessID="5556" ThreadID="22008" />
<Channel>System</Channel>
<Computer>DESKTOP-JCM</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<MemoryExhaustionInfo xmlns="http://www.microsoft.com/Windows/Resource/Exhaustion/Detector/Events">
<SystemInfo>
<SystemCommitLimit>96592314368</SystemCommitLimit>
<SystemCommitCharge>96564453376</SystemCommitCharge>
<ProcessCommitCharge>11671793664</ProcessCommitCharge>
<PagedPoolUsage>78999330816</PagedPoolUsage>
<PhysicalMemorySize>34219081728</PhysicalMemorySize>
<PhysicalMemoryUsage>32516501504</PhysicalMemoryUsage>
<NonPagedPoolUsage>1300463616</NonPagedPoolUsage>
<Processes>267</Processes>
</SystemInfo>
<PagedPoolInfo>
<Tag_1>
<Name>None</Name>
<PoolUsed>77401564496</PoolUsed>
</Tag_1>
<Tag_2>
<Name>SeLb</Name>
<PoolUsed>83701008</PoolUsed>
</Tag_2>
<Tag_3>
<Name>Ntff</Name>
<PoolUsed>67372800</PoolUsed>
</Tag_3>
</PagedPoolInfo>
<NonPagedPoolInfo>
<Tag_1>
<Name>ConT</Name>
<PoolUsed>212045824</PoolUsed>
</Tag_1>
<Tag_2>
<Name>smNp</Name>
<PoolUsed>190644224</PoolUsed>
</Tag_2>
<Tag_3>
<Name>smBt</Name>
<PoolUsed>172847104</PoolUsed>
</Tag_3>
</NonPagedPoolInfo>
<ProcessInfo>
<Process_1>
<Name>firefox.exe</Name>
<ID>16972</ID>
<CreationTime>2022-07-13T08:30:55.4430476Z</CreationTime>
<CommitCharge>660303872</CommitCharge>
<HandleCount>991</HandleCount>
<Version>102.0.1.8221</Version>
<TypeInfo>201</TypeInfo>
</Process_1>
<Process_2>
<Name>firefox.exe</Name>
<ID>21396</ID>
<CreationTime>2022-07-13T08:30:56.4424899Z</CreationTime>
<CommitCharge>602046464</CommitCharge>
<HandleCount>465</HandleCount>
<Version>102.0.1.8221</Version>
<TypeInfo>210</TypeInfo>
</Process_2>
<Process_3>
<Name>MBAMService.exe</Name>
<ID>4492</ID>
<CreationTime>2022-07-13T08:30:03.5689999Z</CreationTime>
<CommitCharge>530677760</CommitCharge>
<HandleCount>1816</HandleCount>
<Version>0.0.0.0</Version>
<TypeInfo>67</TypeInfo>
</Process_3>
<Process_4>
<Name>firefox.exe</Name>
<ID>20248</ID>
<CreationTime>2022-07-13T08:30:54.8778851Z</CreationTime>
<CommitCharge>435707904</CommitCharge>
<HandleCount>2187</HandleCount>
<Version>102.0.1.8221</Version>
<TypeInfo>152</TypeInfo>
</Process_4>
<Process_5>
<Name>
</Name>
<ID>0</ID>
<CreationTime>1601-01-01T00:00:00.0000000Z</CreationTime>
<CommitCharge>0</CommitCharge>
<HandleCount>0</HandleCount>
<Version>0.0.0.0</Version>
<TypeInfo>0</TypeInfo>
</Process_5>
<Process_6>
<Name>
</Name>
<ID>0</ID>
<CreationTime>1601-01-01T00:00:00.0000000Z</CreationTime>
<CommitCharge>0</CommitCharge>
<HandleCount>0</HandleCount>
<Version>0.0.0.0</Version>
<TypeInfo>0</TypeInfo>
</Process_6>
</ProcessInfo>
<ExhaustionEventInfo>
<Time>2022-07-14T12:16:16.5776255Z</Time>
</ExhaustionEventInfo>
</MemoryExhaustionInfo>
</UserData>
</Event>

 

[rgd1101]

PagedPoolUsage is huge

 

[martij7au]

yeah I saw that... any idea how I can troubleshoot what might be causing/have caused that?

 

[rgd1101]

bad driver or app.
does it go up the longer the pc is on?

 

[martij7au]

I'll have to keep an eye on it. I've noticed the PC doesn't freeze while I'm using it. Usually, I come back to it after several hours of non-use and find it frozen. I'll monitor the paged and non-page memory size as I use the PC and see if I can detect any noticable increases over time.

 

[martij7au]

It happened again overnight (started having low memory logs around 6AM) found my computer in a BSOD around lunch... While using it, I did not notice any significant increased. I reviewed and noticed the paged pool item using the most memory by far (Tag_1) has a name "None". I can't figure out what that might be.

Also, I identified that these memory crashes started occurring 6/22/2022.

Any ideas what to check now? I know the high paged pool item is the cause, but I don't seem to know how to figure out what is driving that memory leak.

 

[rgd1101]

what did you installed or update around 6/22?

 

[martij7au]

Programs from around 6/22 - App Installer (Microsoft) and "Xbox Console Companion." As far as I know these were automatically downloaded by Windows. Event viewer for events from "WindowsUpdateClient" show some Microsoft Defender updates, and the same "app Installer" and "XboxApp." Nothing else of note appears.

I also likely installed some games on Steam and Fall Guys on Epic on 6/22.

 

[rgd1101]

are any of those app except defender running in the background?

 

[Colif]

what are specs of the PC?

How occasionally is it? Does it give any sign its going to happen? How often do you restart PC? PC with fast startup on is never really off at shutdown, so it could be you just need to refresh ram by restarting PC occasionally. I noticed my paged pool grows if I hibernate pc for a few weeks.

Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: firefox.exe (16972) consumed 660303872 bytes, firefox.exe (21396) consumed 602046464 bytes, and MBAMService.exe (4492) consumed 530677760 bytes.

Programs generally don't cause Out of Memory errors but drivers can. One common driver type that can be responsible for memory leaks is LAN drivers, and since all 3 programs that were mentioned are LAN related, it could be the case here.

Try updating Ethernet or WIFI drivers, depending which you use.

What occurs is some software asks for a certain amount of memory, and once its finished, should release it. But often software instead asks for more and more and WIndows only has so much it can give before you get out of memory errors.

One way to track down what driver is using the memory is to run poolmon
You get it from installing the Windows Driver Kit - https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk
this video shows where to find it and briefly how to use it:

View: https://www.youtube.com/watch?v=W381C8XHjAA&t=8s


what you need to do is identify the Tag that has the biggest different between Allocations and Frees, as this is possibly the cause of the problem
Alphabetical List of common tags - https://github.com/zodiacon/PoolMonXv2/blob/master/PoolMonX/res/pooltag.txt
Now many of the tags are windows processes, some of them will always have large amounts of memory as it is their jobs to manage memory. You want to find non microsoft tags

Ideally you run it at startup. After a restart if you use Hibernate. To get a baseline for what PC should be like with normal memory usage. Take screenshots so you know what it looks like

You might need to track memory usage over the weeks and see if you can catch it in the act. As we need to run Poolmon again when its using lots of memory to spot differences between it and baseline.

Share any screenshots via an image sharing website and show links here, I help where I can.