Let the system do some work without restarting for a bit. Could be getting some stuff done in the background after the cmd. Let me know how it goes if it still happens.
If it continues to happen try resmon.exe to see what it is doing
Let the system do some work without restarting for a bit. Could be getting some stuff done in the background after the cmd. Let me know how it goes if it still happens.
If it continues to happen try resmon.exe to see what it is doing
Excluding software or hardware from troubleshooting efforts because you need it to use the system is a mistake. The goal is to expose the issue, regardless of how essential the cause may be to the utility of the system.
Had a similar thing happen when my memory was unstable.
Pull one stick, check if the problem still exists, replace the stick with the one you pulled, check again.
Issue still persists? Use JEDEC settings with one stick.
Still a problem? Run at least 2-3 full rounds of memtest86.
Had this problem on some Ryzen servers in the past on Linux as well, a few kilobytes of memory was detected as corrupted in /proc/meminfo and memory usage was growing despite nothing showing up in htop/ps.
If you rule out memory, Iād try stripping down the system to bare minimum - one drive, one GPU (maybe even try iGPU, while at it - check if thereās maybe some pre allocated memory to the GPU in bios, although I think it just wouldnāt show up in task manager at all) etc.
We ruled out it was a ram issue
What were you doing when it started?
Do you have Asus Armory Crate installed? I didnāt see the process in the pictures. It has an memory leak when running it as a standard user.
I uninstalled that bloatware a while ago for different reasons.
It was months ago, so I donāt remember. It wasnāt immediately obvious to me that this was even happening.
Iām a developer and I was frequently running code that was using all my RAM at the time, so messing up and running out of memory wasnāt unusual to begin with.
Eventually I noticed it was happening regardless of what I was doing, over time.
By the way, weāre back to WMI Provider Host using high CPU (5-10%+)
Check autoruns(download) with admin rights and see whatās going on as well as resmon.exe to see what exactly is being used so much
Thanks but Iāve already posted a resmon screenshot and it doesnāt provide much more insight. WMI Provider Host uses a lot of CPU and thatās all I can see.
Not sure about autoruns, I have it and Iāve used it but itās not going to let me understand why WMI Provider Host is using so much CPU or why I am having a memory leak given the memory isnāt shown to be used by any visible process.
CPU usage by WMI Provider Host is usually a sign that another application is requesting data through WMI. That is why I suggested we look to see what it is requesting in resmon or autoruns to figure it out. Maybe there is something in the background that you may have missed.
Possible to upload a picture?
Wow, this is truly weird.
Iāve read through the thread so far, and have no real insights into what might be causing it. For sure, it smells of a kernel-level problem (and Iād agree that a driver issue is a plausible cause).
I have never gotten around to playing with Poolmon, but am disappointed to see that it isnāt obviously giving you any clues. The pic above isnāt sorted by bytes though - did you try that? A guidance page at Use PoolMon to Find a Kernel-Mode Memory Leak - Windows drivers | Microsoft Learn suggests to āSelect B to sort the display by maximum byte useā. Given the large amount of non-paged pool, there just might be a clue lurking, especially if (as seems likely) a shedload of it belongs to a single driver.
Iām also puzzled/disappointed to see that Rammap is claiming that you have 20 GB free when the other tools are saying itās more like 1 GB. (I wonder if that 20 GB number is actually the physical memory minus all of the measured uses it can find.) It may be broken, or it may be a clueā¦
I ran Rammap on my own box (v 1.60, i.e. not quite the most recent) which has 32 GB of RAM.
A few things which caught my eye:
Hereās a screenshot of my Rammap summary:
I restarted my system yesterday night so at the moment Iām at lower CPU usage and 28% RAM usage (still not totally justified by the processes I can see)
I will repeat this in a day or two when it inevitably goes up in memory usage.
However here is the screenshot from opening poolmon and pressing b
Hereās a resmon screenshot, sorted by CPU usage
RAMMap
Autoruns:
Good stuff!
Interesting to see the byte-sorted info from poolmon, but of course the really interesting info will hopefully be found in the same pic after the memory leak has been up to no good for a bit longer. Did you manage to take another snapshot yet?
Completely stop brave from running at startup and keep it off during a restart. See if that works
I am also having a weird memory leak, I think due to something about WMIC.exe, comhost.exe, or cmd.exe. Each of those processes duplicates themselves each time the computer wakes from sleep. I have no idea why.
Sorry, I missed your latest post a few weeks back (not sure how).
Great to see the byte-sorted data from when the memory is almost all used up.
I see that āProcā is the highest entry in the non-paged pool - couldnāt find any clues about exactly what that is (some Google hits led me to iffy AMD GPU drivers, but you have Nvidia cards), but maybe the name implies something linked to processesā¦
This brings me back to the stupidly-large page table: the only cause I can so far identify for it being really big is if you have a massive number of processes, since every process (not sure about threads, but probably not) gets its own page table entry. I doubt that this will turn out to be the cause of your trouble, but I guess thereās no harm in having a straw to clutch. Can you see how many processes/threads exist when itās running out of memory?
Beyond this, it may be worth considering doing another brute-force device driver removal/downgrade/upgrade exercise to see if any changes influence the memory leak.
If the leak occurs even when the system is idle, you could even try swapping it to a simpler configuration with just a single GPU (harming your ability to work on the machine, Iām sure, but possibly still useful to rule out leak sources).
dwm.exe is using a lot of memory (10x the value on my box) but itās still small beer by comparison to the missing memory.
Just for paranoiaās sake: did you check if the mobo BIOS is up to date?