Wednesday, December 3, 2014

Windows 10 memory leak research (xperf/WPA) with process "Unknown"

I'm facing a memory leak issue with Windows 10. I've got 4 GB physical memory which is mostly occupied by "nonpaged pool" according to RamMap, which sadly cannot be attributed to any single process. Generally, the processes in task manager don't add up to resource usage of such scale (biggest processes have two-figure MB private memory). And it gets worse with growing uptime. Alas, this computer is running in an industrial environment and normally has to be running continuously. Presently, it locks up every few weeks and has to be reset manually.


As per magicandre1981's detailed answer to this question, I identified the tags FMic and Irp as the main offenders using poolmon (see image).


After using xperf to record a few minutes of data, in Windows Performance Analyser, the most memory usage under those tags is in the Stack level "n/a" by process "Unknown" (see image).


The memory allocations under both tags consist of 1 KB chunks or smaller, roughly 600 each (FMic, Irp detail).


I think it's beyond dispute that there is a memory leak in this system. What else could I try to isolate the offending process or driver?


Thanks and best regards


Björn


EDIT 2018-07-11: Captured the following using WPA.


Highest level showing 350 MB spent by one path


Expansion yields two 100 MB offenders


Expanding the first shows many small allocations


If the detail isn't deep enough, I can provide the ETL after a little setup work (two days download link).


The offending processes seem to be from "F-Secure Client Security" (memory leak?). Can I do anything else about it, other than complaining to F-Secure?


EDIT 2018-07-16: After removing F-Secure (using Windows Defender now) several days ago, the nonpaged pool is stable at about 200 MB. Problem solved, it seems.

No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...