Windows 11 just started to chew up RAM. ~15 GB unaccounted for.

_kaurus · May 26, 2024

Hey guys, possible this is a known thing, but in the last few days, I've noticed a huge amount of memory getting consumed by seemingly nothing or some background service. Which I only really noticed since Star Citizen complained about having less than 8 GB of free memory.

I have 64 GB of RAM here, and ~15 GB is not accounted for. The consumption got so out of hand that I had to restart my computer to keep it at bay....

I sort of wonder if this is that new Windows 11 recording feature.

not sure, any ideas?
Is there any software that can tell me what's happening in the background?

2024-05-26 17_55_18-Star.Wars.The.Clone.Wars.The.TV.Film.Cuts.COMPLETE.SERIES.x265.HDR.2160p-N...png

pseymour · May 26, 2024

In the top right corner of Task Manager, when you're on the Performance tab, you should have a three-dot menu. From there, you can launch Resource Monitor, which is a little better than Task Manager for looking at performance stats.

For memory usage specifically, you can look at the Microsoft (Sysinternals) tool RAMMap. RAMMap - Sysinternals

glasskuter · May 26, 2024

Your issue shows in your screenshot. Your system is recognizing ram is installed in only 2 of your slots for a total of 32gb recognized. Star Citizen alone is using almost 20gb of that 32gb that is recognized.
I would first reseat my ram. Then try the suggestions in this article.

4 Fixes to Try if Windows Won't Use All of Your RAM

Why ensure your PC has lots of RAM when Windows won't use it all? Utilize all your RAM with these tips.

www.makeuseof.com

pseymour · May 26, 2024

Wait, what? The memory tab in Task Manager shows 64 GB at the top. And in the list of processes, it shows 57% used. If there were only 32 GB available, then Star Citizen alone would account for 60% of the 32,768 MB, so that 57% would be much higher.

glasskuter · May 26, 2024

@pseymour You are so right. I looked at it wrong. I was fixated on only slots 2 or 4 being used. Not many systems I see use individual sticks that large.Thank you for correcting me. My apologies to @_kaurus
Looking at the screenshot closer, 35.6 in use + 26.8 available=62.4 gb. 14.5gb is currently cached memory

pseymour · May 26, 2024

No worries @glasskuter. I just thought I was missing something.

_kaurus · May 27, 2024

glasskuter said:
@pseymour You are so right. I looked at it wrong. I was fixated on only slots 2 or 4 being used. Not many systems I see use individual sticks that large.Thank you for correcting me. My apologies to @_kaurus
Looking at the screenshot closer, 35.6 in use + 26.8 available=62.4 gb. 14.5gb is currently cached memory

Alright, No worries

So we have 14.9 GB cached memory. What exactly does that mean. In my mind, RAM is a cache which stores whatever you need to run whichever application you have launched. Does cached RAM mean the applications have put that much memory on reserve?

When I terminate Star Citizen and Discord, etc. I now have nearly 17GB cached.

This seems rather insane to me since what would someone do with 32 GB of ram. I used to have 32 GB of ran and I never saw this luticris behaviour before. Even when Star Citizen was taking 22GB

_kaurus · May 27, 2024

pseymour said:
Wait, what? The memory tab in Task Manager shows 64 GB at the top. And in the list of processes, it shows 57% used. If there were only 32 GB available, then Star Citizen alone would account for 60% of the 32,768 MB, so that 57% would be much higher.

Thanks for the tip!, this does shine some additional light on things, but not why I have ~15GB of cached RAM.

It seems insane while this computer worked like a charm with 32 GBs of ram with loads to spare, and now that I have 64, there is less than 32 GB "Free" at any given time.

pseymour · May 27, 2024

You'll notice the Cached value in Task Manager (and Resource Monitor) is the same as the Modified + Standby memory in Resource Monitor. In simplified terms, Modified memory is data in RAM that is not yet saved to disk. Standby is data that has not been used recently by an app, but it's still accessible in RAM in case an app wants it. Things in Standby have been written to disk, so those portions of RAM could be easily flushed and made available if an app needs more RAM.

RJARRRPCGP · May 27, 2024

If you believe too much RAM is being used, check for junkware! (and possibly malware)

We need to be on alert for the new crypto malware that has been reported!

TairikuOkami · May 27, 2024

You can use System Informer for more detail analysis.
It also allows to clean unused memory for comparison.

_kaurus · May 27, 2024

TairikuOkami said:
You can use System Informer for more detail analysis.
It also allows to clean unused memory for comparison.

Amazing, thank you!

_kaurus · May 27, 2024

Thank you to everyone for your help!

It seems I'm just a bit more concerned than is warranted and now I have a tool to monitor what's going on with far more detail.

Tester · May 27, 2024

Everything in standby or cached memory you can see in Rammap64 under File Summary Tab.

For example for me, an local ai model from Olama, and some other files.

The cashed memory/standby has nothing to do with usage of application. However it does have use to start an application, as there files are already loaded in the free memory.

To test and clear this, you can Use the Empty Button, and then use button "Empty Standby List"
Will result in this, an empty standby list: However not really usefull. But it shows a bit of what is possible.

pseymour · May 27, 2024

Tester said:
The cashed memory/standby has nothing to do with usage of application. However it does have use to start an application, as there files are already loaded in the free memory.

It's definitely related to usage of applications. Standby contains pages that have been removed from the working set of some process, either a running one or a recently running one. For example, if there's nothing in my standby related to PowerShell or VS Code, then I run VS code and work on some scripts, all of a sudden Standby contains data related to VS Code extensions for PowerShell and the PowerShell host itself.

Tester · May 27, 2024

Can you provide a printscreen of those pages/(files) from Rammap, because me or you could be confusing something.
There is a feature in windows for frequantly used files, and when and what order or startup. So if you start program x, usally you open afterwards program y and z, so were going to side load y and z so those files already in standby memory. So when you do press the Powershell button to start it, those files are loaded from Standby and not from Disk. If you empty standby list, then you start application from disk it self.
Standby memory is for example not usefull when you have 90%memory load, as it only loads 10% of files from harddisk. The more memory it uses, the lesss files can be cached in standby.

pseymour · May 27, 2024

I'm not sure a screenshot will do you any good, without you knowing what apps I'm starting and stopping. You can do it yourself: start an app, let it run for a minute, and then shut it down. Look at RAMMap before and after. You will see pages from that process still in Standby memory after you close it. That's in case you start that app again. If another process comes along and needs the memory, Windows can allocate it from free memory, or Standby if needed.

I'm not exactly sure which feature in Windows you're referring to, but it sounds like Prefetch, which is something different. I'm talking about the actual working set of a running (or recently running) process. Anyway, I've explained the gist of standby twice; that's sufficient.

Tester · May 28, 2024

Standby = cached disk files. data, code, to speed up most commenly used files on harddisk.
Standby + free = available memory.
No pages go into standby, maybe your pages go inside the Modified part.
However i would like to see a printscreen of you so called pages from rammap, as i cannot find them.
I already provided a list of what is in standby memory, and there are only files in it. Will show it again.

I rotate wallpapers every 30min, and all those wallpapers files are loaded into standby:
The entire list of standby contains only caches files from disk. So called Mapped-Files.

pseymour · May 28, 2024

Tester said:
However i would like to see a printscreen of you so called pages from rammap, as i cannot find them.

You're looking at the File Summary tab, which shows "file data in RAM by file" (from the Sysinternals page). If you want to see pages, you go to the Physical Pages tab.

Tester · May 28, 2024

Yes and in Pysical Pages, then when you see the Pysical adresses, then sort of filename, then you see all the Mapped-Files, and those are mapped(pointed) to standby memory. So direclty looking at the File Summary tab is for me easer to see the entire file standby cached files list.
All Applications that run, there memory are in the memory parts of "In Use, and Modified".

Appliciation memory, is everything what apps are using and has access to, including the modified part. If a program calls a .dll file from disk, it is first checked if it is cached in Standby, if so, it retrieves it from there instead of the disk.
The modified part(to-write) is processed data not yet written back to disk (application data in progress), so not present yet in standby (cached files from disk) yet.