Consistent Memory Leaks on W11 not coming from userland, not visible in task manager

Let the system do some work without restarting for a bit. Could be getting some stuff done in the background after the cmd. Let me know how it goes if it still happens.

If it continues to happen try resmon.exe to see what it is doing

Excluding software or hardware from troubleshooting efforts because you need it to use the system is a mistake. The goal is to expose the issue, regardless of how essential the cause may be to the utility of the system.

Had a similar thing happen when my memory was unstable.

Pull one stick, check if the problem still exists, replace the stick with the one you pulled, check again.
Issue still persists? Use JEDEC settings with one stick.

Still a problem? Run at least 2-3 full rounds of memtest86.

Had this problem on some Ryzen servers in the past on Linux as well, a few kilobytes of memory was detected as corrupted in /proc/meminfo and memory usage was growing despite nothing showing up in htop/ps.

If you rule out memory, Iā€™d try stripping down the system to bare minimum - one drive, one GPU (maybe even try iGPU, while at it - check if thereā€™s maybe some pre allocated memory to the GPU in bios, although I think it just wouldnā€™t show up in task manager at all) etc.

1 Like

We ruled out it was a ram issue

What were you doing when it started?

Do you have Asus Armory Crate installed? I didnā€™t see the process in the pictures. It has an memory leak when running it as a standard user.

I uninstalled that bloatware a while ago for different reasons.

2 Likes

It was months ago, so I donā€™t remember. It wasnā€™t immediately obvious to me that this was even happening.
Iā€™m a developer and I was frequently running code that was using all my RAM at the time, so messing up and running out of memory wasnā€™t unusual to begin with.
Eventually I noticed it was happening regardless of what I was doing, over time.

By the way, weā€™re back to WMI Provider Host using high CPU (5-10%+)

1 Like

Check autoruns(download) with admin rights and see whatā€™s going on as well as resmon.exe to see what exactly is being used so much

Thanks but Iā€™ve already posted a resmon screenshot and it doesnā€™t provide much more insight. WMI Provider Host uses a lot of CPU and thatā€™s all I can see.

Not sure about autoruns, I have it and Iā€™ve used it but itā€™s not going to let me understand why WMI Provider Host is using so much CPU or why I am having a memory leak given the memory isnā€™t shown to be used by any visible process.

CPU usage by WMI Provider Host is usually a sign that another application is requesting data through WMI. That is why I suggested we look to see what it is requesting in resmon or autoruns to figure it out. Maybe there is something in the background that you may have missed.

Possible to upload a picture?

1 Like

Wow, this is truly weird.

Iā€™ve read through the thread so far, and have no real insights into what might be causing it. For sure, it smells of a kernel-level problem (and Iā€™d agree that a driver issue is a plausible cause).

I have never gotten around to playing with Poolmon, but am disappointed to see that it isnā€™t obviously giving you any clues. The pic above isnā€™t sorted by bytes though - did you try that? A guidance page at Use PoolMon to Find a Kernel-Mode Memory Leak - Windows drivers | Microsoft Learn suggests to ā€œSelect B to sort the display by maximum byte useā€. Given the large amount of non-paged pool, there just might be a clue lurking, especially if (as seems likely) a shedload of it belongs to a single driver.

Iā€™m also puzzled/disappointed to see that Rammap is claiming that you have 20 GB free when the other tools are saying itā€™s more like 1 GB. (I wonder if that 20 GB number is actually the physical memory minus all of the measured uses it can find.) It may be broken, or it may be a clueā€¦

I ran Rammap on my own box (v 1.60, i.e. not quite the most recent) which has 32 GB of RAM.
A few things which caught my eye:

  • you have a massive amount of usage under ā€œPage Tableā€ - this feels rather clue-like but I donā€™t know what to make of it (20 GB, vs 350 MB on my box)
  • your non-paged pool is also pretty large, verging into the unhealthily large zone perhaps (6x mine)
  • your paged pool is an identical fraction of physical RAM as mine (i.e. twice as much in total), so no reason to suspect any issue there

Hereā€™s a screenshot of my Rammap summary:

2 Likes

I restarted my system yesterday night so at the moment Iā€™m at lower CPU usage and 28% RAM usage (still not totally justified by the processes I can see)

I will repeat this in a day or two when it inevitably goes up in memory usage.
However here is the screenshot from opening poolmon and pressing b

Hereā€™s a resmon screenshot, sorted by CPU usage

RAMMap

Autoruns:





2 Likes

Good stuff!
Interesting to see the byte-sorted info from poolmon, but of course the really interesting info will hopefully be found in the same pic after the memory leak has been up to no good for a bit longer. Did you manage to take another snapshot yet?






Once again WMI Provider Host consuming too much CPU.

Completely stop brave from running at startup and keep it off during a restart. See if that works

I am also having a weird memory leak, I think due to something about WMIC.exe, comhost.exe, or cmd.exe. Each of those processes duplicates themselves each time the computer wakes from sleep. I have no idea why.

Sorry, I missed your latest post a few weeks back (not sure how).

Great to see the byte-sorted data from when the memory is almost all used up.
I see that ā€œProcā€ is the highest entry in the non-paged pool - couldnā€™t find any clues about exactly what that is (some Google hits led me to iffy AMD GPU drivers, but you have Nvidia cards), but maybe the name implies something linked to processesā€¦

This brings me back to the stupidly-large page table: the only cause I can so far identify for it being really big is if you have a massive number of processes, since every process (not sure about threads, but probably not) gets its own page table entry. I doubt that this will turn out to be the cause of your trouble, but I guess thereā€™s no harm in having a straw to clutch. Can you see how many processes/threads exist when itā€™s running out of memory?

Beyond this, it may be worth considering doing another brute-force device driver removal/downgrade/upgrade exercise to see if any changes influence the memory leak.

If the leak occurs even when the system is idle, you could even try swapping it to a simpler configuration with just a single GPU (harming your ability to work on the machine, Iā€™m sure, but possibly still useful to rule out leak sources).

dwm.exe is using a lot of memory (10x the value on my box) but itā€™s still small beer by comparison to the missing memory.

Just for paranoiaā€™s sake: did you check if the mobo BIOS is up to date?