Insane kernel memory usage (Vista)

L

LstBrunnenG

Supreme [H]ardness
Joined
Jun 3, 2003
Messages
6,676
littlekernel.jpg
bigkernel.jpg

The system on the left is my desktop, and the system on the right is my notebook. As you can see, the notebook has a bit of a problem. Don't see it? Look more closely at the kernel memory usage - more specifically, the amount of memory nonpaged and resident in physical memory. That's well over half a gigabyte! Over six times the amount of memory as my desktop!

I first noticed a problem when doing what should have been a relatively light load - browsing the internet, reading e-mail, etc. I noticed it was being sluggish, and the behavior was consistent with a large amount of swapping out to disk taking place. So I thought I'd close all my windows, just in case my IE window with two dozen tabs or one of my other programs was hogging all the physical memory. This turned out to not be the case, as it was still sluggish even as the last programs were being exited. So I decided to dig around in task manager and resource monitor some, and immediately found that adding up all the memory taken up by all the resident processes came up far short of the amount of RAM in use.

What's worse is that the screenshot from the notebook is taken with nothing open but Task Manager, and the screenshot from my desktop is taken with four Explorer windows, Programmer's Notepad, PuTTY, Word '07, WMP, VMC, and Outlook all open. ~1.1 GB is what I'd expect for that much activity in Vista. 1.5 GB on idle, with something approaching half being taken up by the kernel? Something's wrong here. Also, notice the uptime on the desktop versus the laptop. You'd think if it was some sort of inherent memory leak, it would be worse on a computer that had run for eleven days, not on the one running for just over two.

So, I ask if any of you guys have seen behavior like this before. As hesitant to call this a Vista issue as I am, I have pretty much the same application set instaled on both computers, so I'm left with few other options - any ideas?
 
Without a screenshot of open processes and their memory footprint, its almost impossible to know whats whats what on each computer.

Does one have a different antivirus than the other? "Lower Right-hand corner" programs (as I like to call them), that are typically rampant on oem systems, open for each? Etc.

You could very well have a leak, and it could also just be the way vista's new memory management is doing things.

I will say it this way, I run into high memory levels all the time, but I never seem to run out. I like it all in use (cache, etc), but being able to have enough for my programs. I have yet to run into a situation where I've completely run out

Now, also, with 2 gigs, you will run into situations where it will be "close". I wouldn't sweat about it. But without more info on whats running in the background, its a crapshoot on trying to guess what it is.
 
You've missed something in my post. I've already checked the amount of memory being used by individual processes. This is a laptop, and between the power manager, the tablet services, the app which parks the HDD head on sudden acceleration, etc, I expect there to be more processes running. Though, I have done a clean re-install to get rid of the OEM bloat.

The problem is that when you add up their private working sets, that number is nowhere near 1.5 GB. When I went looking for the extra ~.6 GB or so, I found it - in the Vista kernel itself! There's no process to kill, because the memory is being claimed by the core of the operating system.

The three numbers in the lower left, under "Kernel Memory (MB)" are what I'm concerned with. The total amount of virtual memory reserved for the kernel is a whopping 874 MB in the screenshot from my notebook. 212 MB of that is paged out to disk, but 662 MB of that is resident in physical memory and crowding out other processes. This shouldn't happen. This is more than likely a bug in the Vista kernel, exacerbated by some user-space process I've been using (remember the fiasco with Kaspersky and ~16k file copies?).What I'm asking is if anyone has encountered this before, and figured out what apps can cause this behavior.
 
A memory-leaking device driver sounds like a good candidate.. I only have 290MB of total kernel memory on this x64 system (92MB unpaged), although Vista x64 is rather selective (with good reason) about what it lets run in kernel space.

If you boot in Safe Mode, does it still happen?
 
Do you really need 85 processes running on your laptop?
 
At this time my computer has about half the number of processes running compared to TC...

Man I gotta run more processes... Gotta use the full potential of my quad core!!!
 
Wow, somebody is really chewing at the nonpaged pool.

If you can get the machine on a kernel debugger and run Driver Verifier w/ special pool, and pool tracking on, you can probably target the culprit pretty easy. If not you'll probably have to run it w/ the logging options.
 
Yeah, what 1337 proggi3s do you have loaded, specifically ones that use a kernel driver?
 
der_jackal said:
Wow, somebody is really chewing at the nonpaged pool.

If you can get the machine on a kernel debugger and run Driver Verifier w/ special pool, and pool tracking on, you can probably target the culprit pretty easy. If not you'll probably have to run it w/ the logging options.
Click to expand...
Good suggestion, I'll try this if I have time.
133 said:
Do you really need 85 processes running on your laptop?
Click to expand...
See:
xxEIEIOxx said:
I have 93 running on my desktop right now. It really isn't an issue, it's not Windows 95. ;)
Click to expand...


Mithent said:
A memory-leaking device driver sounds like a good candidate.. I only have 290MB of total kernel memory on this x64 system (92MB unpaged), although Vista x64 is rather selective (with good reason) about what it lets run in kernel space.

If you boot in Safe Mode, does it still happen?
Click to expand...
I haven't seen this recur since the night/morning I posted this. I'm keeping a close eye on this, and will report back if I track down what caused it.
Cre8ive said:
Is your laptop new? If it is it might just be vista indexing a whole bunch of stuff.

In any case I did a search for similar topics and noticed that at least one other person had the same problem...and it fixed itself in his case:

http://help.lockergnome.com/vista/Bad-memory-ftopict10582.html
Click to expand...
Laptop isn't new. Thanks for the link,but it's from the beta version of Vista. Notice 2006 in the post date.
pxc said:
Yeah, what 1337 proggi3s do you have loaded, specifically ones that use a kernel driver?
Click to expand...
None that I know of. The closest thing I can think of is the shell extension used by TortiseSVN - but that would eat up memory in explorer.exe, not the kernel.
 
You must log in or register to reply here.
Back
Top