Windows 11 just started to chew up RAM. ~15 GB unaccounted for.


_kaurus

Member
Local time
2:04 PM
Posts
17
OS
Windows 11
Hey guys, possible this is a known thing, but in the last few days, I've noticed a huge amount of memory getting consumed by seemingly nothing or some background service. Which I only really noticed since Star Citizen complained about having less than 8 GB of free memory.

I have 64 GB of RAM here, and ~15 GB is not accounted for. The consumption got so out of hand that I had to restart my computer to keep it at bay....

I sort of wonder if this is that new Windows 11 recording feature.

not sure, any ideas?
Is there any software that can tell me what's happening in the background?

2024-05-26 17_55_18-Star.Wars.The.Clone.Wars.The.TV.Film.Cuts.COMPLETE.SERIES.x265.HDR.2160p-N...png
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    7800x3d
    Motherboard
    Asrock B650E
    Memory
    64 GB F5-6000J3040G32GX2-RS5K
    Graphics Card(s)
    Gigabyte Windforce 4090
    Monitor(s) Displays
    s95b 55"
    Screen Resolution
    4k
    Hard Drives
    Many
    PSU
    HX850
    Case
    Mesh II
    Cooling
    Artic 390
In the top right corner of Task Manager, when you're on the Performance tab, you should have a three-dot menu. From there, you can launch Resource Monitor, which is a little better than Task Manager for looking at performance stats.

For memory usage specifically, you can look at the Microsoft (Sysinternals) tool RAMMap. RAMMap - Sysinternals
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3737]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
Your issue shows in your screenshot. Your system is recognizing ram is installed in only 2 of your slots for a total of 32gb recognized. Star Citizen alone is using almost 20gb of that 32gb that is recognized.
I would first reseat my ram. Then try the suggestions in this article.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 22631.3737
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 7080
    CPU
    i9-10900 10 core 20 threads
    Motherboard
    DELL 0J37VM
    Memory
    32 gb
    Graphics Card(s)
    none-Intel UHD Graphics 630
    Sound Card
    Integrated Realtek
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    1tb Solidigm m.2 nvme+256gb SKHynix m.2 nvme /External +512gb Samsung m.2 sata+1tb Kingston m2.nvme
    PSU
    500w
    Case
    MT
    Cooling
    Dell Premium
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    so slow I'm too embarrassed to tell
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium
  • Operating System
    Windows 10 Pro 22H2 19045.3930
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 9020
    CPU
    i7-4770
    Memory
    24 gb
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    256 gb Toshiba BG4 M.2 NVE SSB and 1 tb hdd
    PSU
    500w
    Case
    MT
    Cooling
    Dell factory
    Mouse
    Logitech wireless
    Keyboard
    Logitech wired
    Internet Speed
    still not telling
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium
Wait, what? The memory tab in Task Manager shows 64 GB at the top. And in the list of processes, it shows 57% used. If there were only 32 GB available, then Star Citizen alone would account for 60% of the 32,768 MB, so that 57% would be much higher.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3737]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
@pseymour You are so right. I looked at it wrong. I was fixated on only slots 2 or 4 being used. Not many systems I see use individual sticks that large.Thank you for correcting me. My apologies to @_kaurus
Looking at the screenshot closer, 35.6 in use + 26.8 available=62.4 gb. 14.5gb is currently cached memory
 
Last edited:

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 22631.3737
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 7080
    CPU
    i9-10900 10 core 20 threads
    Motherboard
    DELL 0J37VM
    Memory
    32 gb
    Graphics Card(s)
    none-Intel UHD Graphics 630
    Sound Card
    Integrated Realtek
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    1tb Solidigm m.2 nvme+256gb SKHynix m.2 nvme /External +512gb Samsung m.2 sata+1tb Kingston m2.nvme
    PSU
    500w
    Case
    MT
    Cooling
    Dell Premium
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    so slow I'm too embarrassed to tell
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium
  • Operating System
    Windows 10 Pro 22H2 19045.3930
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 9020
    CPU
    i7-4770
    Memory
    24 gb
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    256 gb Toshiba BG4 M.2 NVE SSB and 1 tb hdd
    PSU
    500w
    Case
    MT
    Cooling
    Dell factory
    Mouse
    Logitech wireless
    Keyboard
    Logitech wired
    Internet Speed
    still not telling
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium
No worries @glasskuter. I just thought I was missing something. :D
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3737]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
@pseymour You are so right. I looked at it wrong. I was fixated on only slots 2 or 4 being used. Not many systems I see use individual sticks that large.Thank you for correcting me. My apologies to @_kaurus
Looking at the screenshot closer, 35.6 in use + 26.8 available=62.4 gb. 14.5gb is currently cached memory

Alright, No worries

So we have 14.9 GB cached memory. What exactly does that mean. In my mind, RAM is a cache which stores whatever you need to run whichever application you have launched. Does cached RAM mean the applications have put that much memory on reserve?

1716782424957.png



When I terminate Star Citizen and Discord, etc. I now have nearly 17GB cached.

1716782703948.png

This seems rather insane to me since what would someone do with 32 GB of ram. I used to have 32 GB of ran and I never saw this luticris behaviour before. Even when Star Citizen was taking 22GB
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    7800x3d
    Motherboard
    Asrock B650E
    Memory
    64 GB F5-6000J3040G32GX2-RS5K
    Graphics Card(s)
    Gigabyte Windforce 4090
    Monitor(s) Displays
    s95b 55"
    Screen Resolution
    4k
    Hard Drives
    Many
    PSU
    HX850
    Case
    Mesh II
    Cooling
    Artic 390
Wait, what? The memory tab in Task Manager shows 64 GB at the top. And in the list of processes, it shows 57% used. If there were only 32 GB available, then Star Citizen alone would account for 60% of the 32,768 MB, so that 57% would be much higher.
Thanks for the tip!, this does shine some additional light on things, but not why I have ~15GB of cached RAM.

It seems insane while this computer worked like a charm with 32 GBs of ram with loads to spare, and now that I have 64, there is less than 32 GB "Free" at any given time.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    7800x3d
    Motherboard
    Asrock B650E
    Memory
    64 GB F5-6000J3040G32GX2-RS5K
    Graphics Card(s)
    Gigabyte Windforce 4090
    Monitor(s) Displays
    s95b 55"
    Screen Resolution
    4k
    Hard Drives
    Many
    PSU
    HX850
    Case
    Mesh II
    Cooling
    Artic 390
You'll notice the Cached value in Task Manager (and Resource Monitor) is the same as the Modified + Standby memory in Resource Monitor. In simplified terms, Modified memory is data in RAM that is not yet saved to disk. Standby is data that has not been used recently by an app, but it's still accessible in RAM in case an app wants it. Things in Standby have been written to disk, so those portions of RAM could be easily flushed and made available if an app needs more RAM.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3737]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
If you believe too much RAM is being used, check for junkware! (and possibly malware)

We need to be on alert for the new crypto malware that has been reported!
 

My Computers

System One System Two

  • OS
    Windows 11 Pro x64 23H2
    Computer type
    PC/Desktop
    CPU
    Ryzen 9 5900X
    Motherboard
    ASRock B550 PG Velocita (UEFI-BIOS P3.40)
    Memory
    32 GB G.Skill F4-3200C16D-32GVR
    Graphics Card(s)
    Sapphire Nitro+ Radeon RX 6750 XT
    Monitor(s) Displays
    Alienware AW3423DWF OLED ultrawide
    Hard Drives
    Western Digital Black SN850 1 TB NVMe SSD
    PSU
    eVGA Supernova 750 G3
    Case
    Corsair 275R
    Internet Speed
    VTel FTTH 1 Gb down and 1 Gb up
  • Computer type
    PC/Desktop
    CPU
    Ryzen 7 5800X3D
    Motherboard
    Asus ROG Strix B550-F Gaming (UEFI-BIOS version 3607)
    Memory
    32 GB (2x16 GB G.Skill TridentZ Neo)
    Graphics card(s)
    Sparkle Titan Arc A770 16 GB
    Hard Drives
    Samsung 970 Pro 512 GB NVMe SSD
    PSU
    eVGA Supernova 650 GQ
    Case
    Fractal Focus G
You can use System Informer for more detail analysis.
It also allows to clean unused memory for comparison.
 

Attachments

  • capture_05272024_084633.jpg
    capture_05272024_084633.jpg
    157.3 KB · Views: 1
  • capture_05272024_084709.jpg
    capture_05272024_084709.jpg
    161.1 KB · Views: 2
  • capture_05272024_084729.jpg
    capture_05272024_084729.jpg
    164 KB · Views: 1

My Computer

System One

  • OS
    Windows 11 Home
    Computer type
    PC/Desktop
    CPU
    AMD Ryzen 5 3600 & No fTPM (07/19)
    Motherboard
    MSI B450 TOMAHAWK 7C02v1E & IFX TPM (07/19)
    Memory
    4x 8GB ADATA XPG GAMMIX D10 DDR4 3200MHz CL16
    Graphics Card(s)
    MSI Radeon RX 580 ARMOR 8G OC @48FPS (08/19)
    Sound Card
    Creative Sound Blaster Z (11/16)
    Monitor(s) Displays
    24" Philips 24M1N3200ZS/00 (05/24)
    Screen Resolution
    1920×1080@165Hz via DP1.4
    Hard Drives
    ADATA XPG GAMMIX S11 Pro SSD 512GB (07/19)
    PSU
    Seasonic M12II-520 80 Plus Bronze (11/16)
    Case
    Lian Li PC-7NB & 3x Noctua NF-S12A FLX@700rpm (11/16)
    Cooling
    CPU Cooler Noctua NH-U12S@700rpm (07/19)
    Keyboard
    HP Wired Desktop 320K + Rabalux 76017 Parker (01/24)
    Mouse
    Logitech M330 Silent Plus (04/23)
    Internet Speed
    400/40 Mbps via RouterOS (05/21) & TCP Optimizer
    Browser
    Edge & Brave for YouTube & LibreWolf for FB
    Antivirus
    NoAV & Binisoft WFC & NextDNS
    Other Info
    Backup: Hasleo Backup Suite (PreOS)
    Notifier: Xiaomi Mi Band 7 NFC (05/24)
    Headphones: Sennheiser RS170 (09/10)
    Phone: Samsung Galaxy Xcover 7 (02/24)
    2nd Monitor: AOC G2460VQ6 @75Hz (02/19)

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    7800x3d
    Motherboard
    Asrock B650E
    Memory
    64 GB F5-6000J3040G32GX2-RS5K
    Graphics Card(s)
    Gigabyte Windforce 4090
    Monitor(s) Displays
    s95b 55"
    Screen Resolution
    4k
    Hard Drives
    Many
    PSU
    HX850
    Case
    Mesh II
    Cooling
    Artic 390
Thank you to everyone for your help!

It seems I'm just a bit more concerned than is warranted and now I have a tool to monitor what's going on with far more detail.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    7800x3d
    Motherboard
    Asrock B650E
    Memory
    64 GB F5-6000J3040G32GX2-RS5K
    Graphics Card(s)
    Gigabyte Windforce 4090
    Monitor(s) Displays
    s95b 55"
    Screen Resolution
    4k
    Hard Drives
    Many
    PSU
    HX850
    Case
    Mesh II
    Cooling
    Artic 390
Everything in standby or cached memory you can see in Rammap64 under File Summary Tab.

For example for me, an local ai model from Olama, and some other files.
1716850231430.png
The cashed memory/standby has nothing to do with usage of application. However it does have use to start an application, as there files are already loaded in the free memory.

To test and clear this, you can Use the Empty Button, and then use button "Empty Standby List"
Will result in this, an empty standby list: However not really usefull. But it shows a bit of what is possible.
1716850350998.png
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
The cashed memory/standby has nothing to do with usage of application. However it does have use to start an application, as there files are already loaded in the free memory.

It's definitely related to usage of applications. Standby contains pages that have been removed from the working set of some process, either a running one or a recently running one. For example, if there's nothing in my standby related to PowerShell or VS Code, then I run VS code and work on some scripts, all of a sudden Standby contains data related to VS Code extensions for PowerShell and the PowerShell host itself.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3737]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
Can you provide a printscreen of those pages/(files) from Rammap, because me or you could be confusing something.
There is a feature in windows for frequantly used files, and when and what order or startup. So if you start program x, usally you open afterwards program y and z, so were going to side load y and z so those files already in standby memory. So when you do press the Powershell button to start it, those files are loaded from Standby and not from Disk. If you empty standby list, then you start application from disk it self.
Standby memory is for example not usefull when you have 90%memory load, as it only loads 10% of files from harddisk. The more memory it uses, the lesss files can be cached in standby.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
I'm not sure a screenshot will do you any good, without you knowing what apps I'm starting and stopping. You can do it yourself: start an app, let it run for a minute, and then shut it down. Look at RAMMap before and after. You will see pages from that process still in Standby memory after you close it. That's in case you start that app again. If another process comes along and needs the memory, Windows can allocate it from free memory, or Standby if needed.

I'm not exactly sure which feature in Windows you're referring to, but it sounds like Prefetch, which is something different. I'm talking about the actual working set of a running (or recently running) process. Anyway, I've explained the gist of standby twice; that's sufficient.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3737]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
Standby = cached disk files. data, code, to speed up most commenly used files on harddisk.
Standby + free = available memory.
No pages go into standby, maybe your pages go inside the Modified part.
However i would like to see a printscreen of you so called pages from rammap, as i cannot find them.
I already provided a list of what is in standby memory, and there are only files in it. Will show it again.
1716906637656.png
1716906809354.png
I rotate wallpapers every 30min, and all those wallpapers files are loaded into standby:
The entire list of standby contains only caches files from disk. So called Mapped-Files.
1716907163308.png
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
However i would like to see a printscreen of you so called pages from rammap, as i cannot find them.
You're looking at the File Summary tab, which shows "file data in RAM by file" (from the Sysinternals page). If you want to see pages, you go to the Physical Pages tab.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3737]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
Yes and in Pysical Pages, then when you see the Pysical adresses, then sort of filename, then you see all the Mapped-Files, and those are mapped(pointed) to standby memory. So direclty looking at the File Summary tab is for me easer to see the entire file standby cached files list.
All Applications that run, there memory are in the memory parts of "In Use, and Modified".

1716912468887.png
Appliciation memory, is everything what apps are using and has access to, including the modified part. If a program calls a .dll file from disk, it is first checked if it is cached in Standby, if so, it retrieves it from there instead of the disk.
The modified part(to-write) is processed data not yet written back to disk (application data in progress), so not present yet in standby (cached files from disk) yet.
 
Last edited:

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
Back
Top Bottom