Excessive ram usage, not associated with processes listed in Task Manager.

Something is using too much ram, or the auditing is side-ways screwed. What tool is available to report which process is sucking-up the ram?

Image list\description:
2023-11-18_174513_RAM_high_usage.png -- Sorted by ram usage, if you sum the entire column, it would not come close to 79% of memory being used. This displayed 79% decreased slightly from 85%, after I closed my heavy (ram) hitting apps: Swann and VMS --were closed before this capture.

2023-11-18_175225_Post_Reboot_Ram_Usage.png -- After a reboot, then restarting Swann and VMS, this is normal. The 'regular' items I run, barring any mem-leaks, will peak around 45% ram usage. If it gets busy, will jump to 60'ish.

2023-11-18_190241_Page_File.png -- The setting.

This box: Win-11\Home, 16\GB installed ram. All drivers are up-to-date; offered by the OEM. We have no intention of using drivers not offered from the machines' OEM. Additionally, this is an install using the 'Keep all files' option, without using Windows-Update. In doing so, this is the most stable this machine has ever been. Not interested in Windows-Update unless there is firm documentation that an available update will resolve an issue we are actively experiencing.

Finally, The install date was 20231028, this high mem-usage shown in the image just started in the last thirty-six hours. Other than one or two apps I've identified with obvious mem-leaks, should those two apps start excess mem-usage, they would hang\freeze\crash long before 'Task Manager' would report a total of 79% memory usage for the entire system.

Please let me know if I need to clarify or provide more detail.

Respectfully
Currently looking at Sysinternals ...

https://superuser.com/a/1695227
https://superuser.com/questions/133...t-running-any-programs#comment2002651_1338367
https://superuser.com/a/1338765

hdmi said:

RAMMap - Sysinternals

An advanced physical memory usage analysis utility that presents usage information in different ways on its several different tabs.

learn.microsoft.com

Click to expand...

I agree, thank you.

In such cases I usually scan for malware with Superantispyware or Malwarebytes Antimalware. Do the complete scan (it will take long) and delete all findings. If you find too many, I recommend scanning with a second utility since they tend to find some more that the first utility missed. In very severe cases also scan for viruses or consider to backup your data and do a clean Windows installation.

PS: To prevent any malware stopping the scan (yes, I have seen that), it is best to install the utility, update the malware database and then restart in Safe Mode to scan. Hold SHIFT and restart to see the troubleshooting options. Select Troubleshoot, Advanced Startup options and upon restart select Safe Mode from the list. When done simply restart and the computer will load Windows in normal mode.

spapakons said:

In such cases I usually scan for malware with Superantispyware or Malwarebytes Antimalware. ...

Click to expand...

The box in question is not infected; not connected to the Inet.

For what its worth, SysInternals\RamMap has found numerous video-files actively being written to; for twenty-two camera's. For some reason, unknown to me, once the program stops writing to a file --for a particular camera, it generates the next file for that subsequent timestamp. Yet the previous file, in this case twenty-two previous files --remain in memory while the new --active files are also added to ram.

I thought once the file is no longer actively being used, its dumped to the disk and the ram is released. Is someone able to clarify? 2) Is this considered a classic memory leak? I am truly both confused and listening ...

Query01 said:

The box in question is not infected; not connected to the Inet.

Click to expand...

Keep in mind that something doesn't need to be connected to the internet to be infected.
It could have been connected in the past... it could be you clicked or downloaded the wrong thing, now or in the past.

The things an infection attacks are determined by the virus or malware.
You may have an infection that only goes after... notepad... or a specific game, or specific file... etc.

As @spapakons mentioned... whenever you see excessive RAM usage, it's always a good idea to run a scan or two... just to eliminate infection as a possibility. It's a good first step when troubleshooting excessive RAM usage.

Query01 said:

For what its worth, SysInternals\RamMap has found numerous video-files actively being written to; for twenty-two camera's. For some reason, unknown to me, once the program stops writing to a file --for a particular camera, it generates the next file for that subsequent timestamp. Yet the previous file, in this case twenty-two previous files --remain in memory while the new --active files are also added to ram.

I thought once the file is no longer actively being used, its dumped to the disk and the ram is released. Is someone able to clarify? 2) Is this considered a classic memory leak? I am truly both confused and listening ...

Click to expand...

Some programs DO release RAM after using it. Some less than stellar ones... do not.

Ghot said:

Keep in mind that something doesn't need to be connected to the internet to be infected.
It could have been connected in the past... it could be you clicked or downloaded the wrong thing, now or in the past.

Click to expand...

@Ghot --the only possible infection the box in question could have is, either Windows-Eleven\Home, or this app that is not cleaning-up behind itself. After viewing RamMaps' details-tab, not only am I confused about why the program isn't cleaning-up behind itself. I'm also confused on why, after the program is terminated, the OS doesn't take action, but instead, would allow the system to continue and run low on resources until it ultimately hang\freeze\crashes.

... looking through SysInternals for something I can put on a timer to safely clear these dormant files sucking-up my ram.

Thank you 'everyone'.

Query01 said:

the only possible infection the box in question could have

Click to expand...

It's not a question of whether or not it has an infection.
The point is... IF there's an infection it could cause excessive RAM usage.
Because of that possibility... we run the scanner(s).
They are a troubleshooting tool. If they find NO infection, then we can mark that off the list of possible causes.

Sometimes, it's best just to go through the steps, when troubleshooting.
It usually ends up being faster in the long run.

IF the scanner(s) come up clean... then we "know" that infection is not the cause.
Infection probably isn't the cause, but we don't "know" for sure, and it's the easiest thing to check.

Then... we can start worrying about which if any programs or Apps might have a memory leak.





Another option if you haven't tried it yet is to reboot the computer. That always "lessens" % RAM used.
Then... try your programs and Apps one at a time, and then close them... watch the % RAM used and released.

But... you should still check for infections, first... just to be sure.



Thar's hackerz in them thar wood. ^^




In post #7 it looks like you may have found the issue. But we won't KNOW that, until you run a few scans.

Query01 said:

this high mem-usage shown in the image just started in the last thirty-six hours

Click to expand...

This is probably the most important thing you've posted.
If the problem started 36 hours ago... then something "changed", at or about 36 hours ago.


So... what did you do/change/update/install etc., 36 hours ago?

I don't like to bring bad news, but high RAM usage without registering in Task Manager is probably due to malwares. The scanner should find over 200 Registry entries or cookies or whatever. If it finds over 500 scan with a second utility as well. If it finds over 1000 scan for viruses as well.

Query01 said:

For what its worth, SysInternals\RamMap has found numerous video-files actively being written to; for twenty-two camera's. For some reason, unknown to me, once the program stops writing to a file --for a particular camera, it generates the next file for that subsequent timestamp. Yet the previous file, in this case twenty-two previous files --remain in memory while the new --active files are also added to ram.

I thought once the file is no longer actively being used, its dumped to the disk and the ram is released. Is someone able to clarify? 2) Is this considered a classic memory leak? I am truly both confused and listening ...

Click to expand...

On the File Summary tab in RAMMap, do the 22 previous video files use up Active memory or just Standby memory? Processes are responsible for moving unused data from Active to Standby memory if the processes no longer use the data but still intend to use the data again later. Normally, Windows Memory Management clears the unused data from Standby memory after the processes terminate. But zombie processes (see the last link I gave in my previous reply) can keep the unused data from being released from Standby memory. You can use FindZombieHandles to hunt them down. (Perhaps you could catch them on camera? lol )

Ghot said:

IF the scanner(s) come up clean... then we "know" that infection is not the cause.
Infection probably isn't the cause, but we don't "know" for sure, and it's the easiest thing to check.

Then... we can start worrying about which if any programs or Apps might have a memory leak.

Click to expand...

@Ghot , @spapakons and everyone else, I understand what is being said about the scans. Please do understand post #:10. The only possible infection the box in question could have is Windows-Eleven -or- the program generating the video files, then not cleaning-up behind itself.

Ghot said:

Another option if you haven't tried it yet is to reboot the computer. That always "lessens" % RAM used.
Then... try your programs and Apps one at a time, and then close them... watch the % RAM used and released.

Click to expand...

This is exactly what I do when a program starts to misbehave along with 'Task Manager' reporting high ram usage for that application. In this case, I was not able to associate any application misbehaving, along with 'Task Manager' reporting excessive ram usage for one or more processes; no obvious evidence, leaving me to think it was the OS, until I posted here, then employed RamMap.

Ghot said:

In post #7 it looks like you may have found the issue. But we won't KNOW that, until you run a few scans.

Click to expand...

I will not be running any scans for virii\malmare, which cannot possibly be on this machine.

Ghot said:

This is probably the most important thing you've posted.
So... what did you do/change/update/install etc., 36 hours ago?
If the problem started 36 hours ago... then something "changed", at or about 36 hours ago.

Click to expand...

If something changed, either the OS, or the program writing the aforementioned video files --made that change. This box does nothing but what the OS and the surveillance package instructs it; without any method of Inet connection. No-one has physical access to this machine except yours truly.

During one of the initial screenshots (post #1), showing 79% Mem-usage, this had decreased from approximately 85%. Seventy-nine percent was the result of closing two separate exe packages that are known to use excessive ram from time-to-time, then hang\crash the respective exe; not take down the entire OS by way of excessive ram use. Once those known offenders were closed, the remaining itemized high ram usage, reported by 'Task Manager', did not sum to the seventy-nine percent displayed at the top of the Mem column.

Given that closing the executable\s did not lower the total ram usage to an acceptable number, without a reboot, I'm going to assume the numerous files (attached screenshot), previously generated by one of the closed packages, in-fact remained resident, stale\dormant within ram until the reboot; which seems to have cleared everything. From this point forward, I'll continue and compare RamMap reports over time. The surveillance package author's seem to have gone fishing almost two years ago. As I posted previously, I'll be looking for something I can put in 'Task Scheduler' to clear-out dormant\stale files stuck in ram, install more ram; or both.

Image attached
Using the attached image, review the channel-one entries, compare the individual file's timestamp with the desktops' clock. These file's, for all twenty-two channels, are written approximately every five minutes, truncated, then a subsequent file created. Look at the age, size and quantity of channel-ones' file's; now multiply by twenty-two cameras. I'm still not understanding how\why the OS allows this, to its own demise (crash). I would think the OS would notice these aged files are no longer active or immediately accessed, unless the generating program has put some sort of lock or flag on them. If needed, you have my apologies for the long wind.

I do believe this is the issue (infection) <smile>. I continue to listen.

Query01 said:

something I can put in 'Task Scheduler' to clear

Click to expand...

@hdmi --Thank you, I have not found the details for that help pop-up (RamMap), wasn't sure if it was 'emptying' the report data, or the actual data. Both my knowledge and experience of what goes on under the hood is extremely limited. 2) What are you using to hi-lite\encircle a selection (red)?

This is very good information coupled with --adding another sixteen -to- forty-eight Gigabyte's of DDR5, I may be able to salvage this box without a replacement. That statement was based on 'not knowing' if the ram usage shown in the RamMap screenshot, would increase and not be contained after adding more physical ram.

I have been enlightened.

Query01 said:

What are you using to hi-lite\encircle a selection (red)?

Click to expand...