memorysysinternalswindows 7
I have a one-year-old iMac with 8GB RAM running a bootcamped Windows 7 Ultimate 64 bit.
The following memory analysis with Sysinternals RamMap.exe leaves some questions open:
What could be the reason for the nearly 5 GB of memory in the Nonpaged Pool? How can I find out which driver is causing this huge memory usage?
You must use xperf to trace what causes the usage. Install the WPT, open a cmd.exe as admin and run this:
xperf -on PROC_THREAD+LOADER+POOL -stackwalk PoolAlloc+PoolFree+PoolAllocSession+PoolFreeSession -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 256 -FileMode Circular && timeout -1 && xperf -d pool.etl
capture 30s of the grow. Open the ETL with WPA.exe, add the Pool graphs to the analysis pane.
Put the pooltag column at first place and add the stack column. Now load the symbols inside WPA.exe and expand the stack of the NDnD tag. Now find other 3rd party drivers which use this tag. Look for driver updates
From the CleanMem about page:
"The memory is pushed to the system cache, not the page file. The system cache is still in memory. And a program can call back what it needs instantly"
AKA, running "CleanMem" just hides memory behind the system in the cache, so you don't see it being used.
Generally, any kind of "memory management" tool in Windows is a bad idea.
Why? Because especially in an OS as complicated as Windows 10, using some "tweak" to try to get more memory is probably just going to make the existing memory management algorithms get confused. Windows has extremely advanced built-in memory management, compression, caching, and prediction. Don't mess with it. Need to free memory? Use Firefox instead of Chrome.
Also, check out the SysInternalsSuite tool procexp.exe. It is a lot easier to read than xperf:
Another process you may not see using memory would be if you have Hyper-V installed and are running any virtual machines within it.
Best Answer
Found it, you can add the column "NP Pool" to the "Processes" tab on Task Manager:
In my case, the culprit was Fling File Transfer, which has a serious memory leak. It was using more than 2 GB of the nonpaged memory pool before I restarted it. The above screenshot shows it after running for two minutes.
Bug report filed.