Yes, used for caching and buffers. Modern OS's try to be smart...if you have 8GB of memory just sitting idle, not being used for anything, it's being wasted. So as long as no application is requesting it, the OS finds other things to use it for to try and speed stuff up. Don't worry about it -- if you application needs the memory, the OS will instantly free it up as soon as the app asks for it.
Same problem here. I found that these instructions for finding the issue with non-paged pool also work for paged pool.
This requires installing a 2gb windows driver kit package from Microsoft. I'm not sure if visual studio is necessary, even though the Microsoft installation directions say it is.
If you have windows 10, and want to avoid installing that massive package, I have created a zip file containing just the poolmon.exe and a shortcut that runs it using the "-b" option. According to Microsoft, the exe is standalone and should work. I don't know if the exe works with other Windows OS versions. The exe is from "WDK for Windows 10, version 1709"
- First step is to run
poolmon.exe -b
. You can do this from the command prompt or the shortcut I provided in the zip file. Or create a new shortcut to poolmon.exe and in "properties" put the full "target" address in quotes and add " -b" after it, without quotes. The "-b" is important because it organizes the list according to the most bytes used.
You should get results that look like this:
poolmon -b results
As you can see, in my case, the tag for the process using 7.2 gb of Paged Pool is "AvN".
- Next open a command prompt and
cd C:\Windows\System32\drivers
Then findstr /s (Tag) *.sys
where (Tag) is your tag from the left-most column in poolmon. It is very important that capitalization is exact.
Here are my results from command prompt, with one mistake where I did not correctly capitalize AvN.
results from findstr
From this I can see that the tag "AvN" belongs to a driver called "avgMonFlt.sys". From a google search it seems that "avgMonFlt.sys" belongs to "AVG Antivirus Free". If I find that file in explorer, and look at the properties, under the "details" tab it gives me the name of the product "AVG Internet Security System" file description, Copyright owner, and other information. The "Digital Signatures" tab shows me who the signer is.
In most cases simply updating the driver will solve the issue. If an update isn't available, uninstalling the driver may be necessary. At the very least, you have identified the faulty driver and use that information to find a solution.
I actually haven't fixed this problem yet. I may just need to uninstall "AVG Antivirus" and get a different antivirus, or I may need to simply uninstall and reinstall. I just recently repaired it, as well as updating it, before this problem occurred. I will update this answer with my results.
Best Answer
The high memory usage comes from the large page table:
I've explained here, how to trace this.
also the nonpaged pool is too high. You can use poolmon to see which driver is causing the high pool usage.
Install the Windows WDK, run poolmon, sort it via P after pool type so that non paged is on top and via B after bytes to see the tag which uses most memory.
Now look which pooltag uses most memory as shown here:
Now open a cmd prompt and run the findstr command to see which driver uses this tag:
Now look at the file properties, find the driver version and look for an update.