Physical Memory Leak by Terminated Processes
Hi, I am facing an issue with Windows 2008 x64 Server (any edition). It frequenlty crashes due to lack of Physical Memory and when we check no other programs uses so much Physical Memory to create the issue. After some investigation with RAMMAP utility, we noticed that Processes (any windows executable) which are terminated does not release some part of Physical Memory (4KB under Private Bytes and 16KB under Page table). So any process terminates, does not release 20K of Physical Memory and gradually, server crashes when complete Memory chews up. We did some more investigation and noticed this issue Started after installation of one particular application on the server and issue stops after uninstalling this software. We had created a call with the Application Vendor and they confirmed that it is not an issue with their application, it is a Windows issue. Their view "This Application is not running as any Service and will be executed only when Someone starts the Application. As the issue exists, without executing the application it is not application problem. Also, not only their application exe, all windows executable leaves 20K of Physical Memory and as, Windows is responsible for Memory Management it is an issue with Operating System. Would someone help me to identify why this OS misbehaviour is happening. Thanks
September 23rd, 2011 10:33am

You might try to scan system files to see if the application changed some files. Run a cmd prompt as administrator and run "sfc /scannow" you can also add the /"verifyonly" if you dont what it to replace files Process Explorer can also give a better overview of your memory http://technet.microsoft.com/nb-no/sysinternals/bb795535 /Olav
Free Windows Admin Tool Kit Click here and download it now
September 24th, 2011 1:18pm

Hi Olav, Thanks for your response. I tried with sfc /verifyonly and it did not show any issues (all files are OK). Process explorer is not showing this part of unused (or leaking) Physical Memory. In Task Manager Physical Memory usage is 1.6GB, but sum of WorkingSet size of all processes is only 950MB. Above image shows the Mem usage of Terminated processes. All these PIDs does not exist (not running on the machine), but still uses Memory. Thanks
September 26th, 2011 8:31am

Any program will leave 20K of physical memory with or without the application is running, but the issue will not occur if remove the application. Is this correct? If this is correct, then the application should cause something like a conflition, specifically it occurs on any edition of Windows 2008 x64 server as you mentioned. What kind of application it is? Please provide more information about it so we can check if any one have a similar issue. Also I would like to confirm, if we reboot the server, without running the appliction, whether the same issue occurs if we start any program such as Notepad, Office program etc? And if we disable any security program, backup program etc and reboot, without running the appliction, whether the issue still exists?TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tnmff@microsoft.com.
Free Windows Admin Tool Kit Click here and download it now
September 29th, 2011 5:11am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics