memory leak, can't tell from what

Toggle sidebar Toggle sidebar
Solution
J
edit #2: http://www.msi.com/product/mb/Z87-G45-GAMING.html#download
has drivers dated 1-4-2014 for the killer NIC ethernet card. give them a shot

edit: googled and found someone else with the same issue caused by killer NIC ee220 drivers
with 2 network adapters.
http://social.technet.microsoft.com/Forums/windows/en-US/dd235c29-142c-4f0e-9197-4bbcb3bc7860/nonpaged-pool-leak-in-network-layer?forum=w8itproperf

cool, in the non paged pool text file is the one of interest:
Memory: 8331208K Avail: 268924K PageFlts: 4436 InRam Krnl:24272K P:89640K
Commit:9054952K Limit:17244104K Peak:9173416K Pool N:6814188K P:260840K
System pool information
Tag Type Allocs Frees Diff Bytes...
Sort by date Sort by votes
Dogsnake

Dogsnake

Distinguished
Oct 20, 2006
2,309
0
20,460
You do not have a leak your memory is in use. Start the system in safe mode and check the memory use. If the usage is lower in safe mode, you can use msconfig to do a selective start up to isolate what is using the memory. Have you run virus and other maleware scans. You may be infected. What software do you use for these scans? Please post your hardware specs. (brands, model # and OS version).
 
Upvote 0 Downvote
Dogsnake

Dogsnake

Distinguished
Oct 20, 2006
2,309
0
20,460
On the hardware side there are no leaks or losses. "Memory Leaking" is a rather old term and is not literal. Software design can cause what this refers to. It is where the software requests and reserves for it's use an amount of memory. Then because of the software design it fails to use some what it has reserved and then it reserves more. Your screen shots show 90+% memory use at idle (I think this is what you showed). And a total of 8gig installed. I would think at idle you might be using about 3gig. So some process(es) or background program(s) are using the memory. This is very common for an infected system. So now that I have replied to your question please reply to the items I asked of you if you wish to continue. GL
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
EDIT: from your photos, it is pretty clear that your issue is a driver bug.

-use resource monitor to see what resources are being used.
- or exit or terminate programs and let the OS free their resources
and see if you get a big chunk of your memory released back to the system

-you can also stop (and restart) a service if it is a service that caused the problem.

- file corruption can cause issues like this.
run chkdsk /r /f to check and fix file system corruption issues
system file checker to check for core OS file corruption and fix them.

if all else fails you can have device driver issues, firmware issues
often to find these you would connect a debugger to your system or configure your system for a full memory dump
and force a crash dump. Then you have someone look at the dump in a debugger to see what used up your memory.
I have seen problems with corrupt files system, just confuse the heck out of services and tie up resources.
(I am thinking of search index running on a corrupt file system, never got done with its search, and was indexing a corrupt file system)





 
Upvote 0 Downvote
B

bnn

Honorable
Oct 30, 2013
339
0
10,860


starting in safe mode will not do anything as it happens randomly there can be days between them or it can happen twice in a day it's completely random

i use bitdefender in 8.1 just like i used mse in win7, Works like a charm not had a virus in like 5years, and i have it scheduled to scan daily

my build is
i5 4670k
z87-g45
8gb corsair vengeance
r9 280x toxic
250gb ssd samsung 840 evo
corsair tx850m
Windows 8.1 pro
 
Upvote 0 Downvote
B

bnn

Honorable
Oct 30, 2013
339
0
10,860


if you look at the ressource manager screenshot nothing in there look to be using a lot of memory that's what i don't get, and i did try to close all my open programs but nothing changed was still at 96% memory usage, i have tried " chkdsk /r /f" already and found no errors

i don't know how to do the last bit with the full memory dump
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
configure your system to do a kernel memory dump, do the registry settings that allow you to force a crash dump when you hit a key sequence.

the next time you hit the problem, you force a memory dump and the state of the machine will be saved to the memory dump. post the crash dump on a cloud server with public access and I will connnect with a debugger and see.
here is how to force a crash dump
http://superuser.com/questions/224496/how-do-i-create-a-memory-dump-of-my-computer-freeze-or-crash

Or, you can start removing or updating various programs on your system in the hope that the problem goes away.
 
Upvote 0 Downvote
B

bnn

Honorable
Oct 30, 2013
339
0
10,860


i have set up the kernel memory dump, whenever it happens again i'll take a dump, however i don't have a cloud server, any other way?
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
just create a free one on google or skydrive they will have plenty of space, just make sure you put the file in a public folder.
the file will be pretty big (500mb or so), too big to email.


 
Upvote 0 Downvote
B

bnn

Honorable
Oct 30, 2013
339
0
10,860


oki will use skydrive as i already have a microsoft account, will get back to you when it happens again, thanks so far:) and hope we can find the problem, having to reboot everytime sucks :)

also checked for updated to all my programs, everything is uptodate
 
Upvote 0 Downvote
B

bnn

Honorable
Oct 30, 2013
339
0
10,860
cool cool, i'll put it on skydriver, how can i give you access or however it works?

edit: well i thought i could, apparentely i don't have the permissions to do it as adminstrator, lol...

edit 2: okay figured it out, it's on skydrive now, how can you access it?
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
if you put it in a public folder, you should be able to just copy and paste the brower link in this thread



 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
Your machine was configured for a mini dump. I can not tell which device driver used all the memory from it.
Just looking at the drivers loaded i would remove the old logitech drivers from 2009 (or check to see if you can find new/updated drivers)

LGBusEnum.sys Mon Nov 23 17:36:48 2009
LGVirHid.sys Mon Nov 23 17:36:48 2009


the corruption that the sfc /scannow found was most likely introduced as the files were transfered on to the machine. This is pretty common if the files were transfered using a USB thumb drive or were installed while using a network driver with bugs in it. The dism command fixes the copy if the file was one that microsoft ships. (drivers provided by other vendors are not checked)

I had the debugger compare your memory image of the core windows files to the ones Microsoft has on their server and no errors were detected in the main modules.

change you memory dump to full, remove/update the logitech drivers and retest

note:
There are also tools you can use locally to find excessive non page pool used by kernel drivers
poolmon.exe and verifier.exe. verifier comes with your system and i think you have to download poolmon from the windows sdk. http://msdn.microsoft.com/en-us/library/windows/hardware/ff545403(v=vs.85).aspx
 
Upvote 0 Downvote
B

bnn

Honorable
Oct 30, 2013
339
0
10,860
2009? that's strange since windows 8.1 wasn't out at that time and i downloaded the 8.1 versions, and both my software says it is uptodate

my machine was configured for a kernel dump, but okay i will change it to complete memory dump, and make a new dump when it happens again
 
Upvote 0 Downvote
B

bnn

Honorable
Oct 30, 2013
339
0
10,860
okay, new dump file is up, used "complete memory dump" this time, however the file size didn't change, this is annoying as hell -.- if this can't be fixed i'll have to go back to windows7

edit: (KB2911106) this released recently and just updated today, maybe it'll fix something, can hope :)
edit2: meh doesn't look like it, slowly crawling towards 95 again, 73% atm.
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
post the link again, the old one indicates the file is no longer there.


 
Upvote 0 Downvote
B

bnn

Honorable
Oct 30, 2013
339
0
10,860


oh okay thought you could just use the same link https://skydrive.live.com/redir?resid=88BBB6D0FA7B684C%21145
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
edit #2: http://www.msi.com/product/mb/Z87-G45-GAMING.html#download
has drivers dated 1-4-2014 for the killer NIC ethernet card. give them a shot

edit: googled and found someone else with the same issue caused by killer NIC ee220 drivers
with 2 network adapters.
http://social.technet.microsoft.com/Forums/windows/en-US/dd235c29-142c-4f0e-9197-4bbcb3bc7860/nonpaged-pool-leak-in-network-layer?forum=w8itproperf

cool, in the non paged pool text file is the one of interest:
Memory: 8331208K Avail: 268924K PageFlts: 4436 InRam Krnl:24272K P:89640K
Commit:9054952K Limit:17244104K Peak:9173416K Pool N:6814188K P:260840K
System pool information
Tag Type Allocs Frees Diff Bytes Per Alloc

Wfpn Nonp 9478631 (4157) 0 ( 0) 9478631 6066320960 ( 2660480) 639
NDNB Nonp 9477697 (4055) 0 ( 0) 9477697 758216800 ( 324400) 80

from this we see that the driver allocates driver memory but has never returned any.
now lookup the pooltag Wfpn and NDMB

http://blogs.technet.com/b/yongrhee/archive/2009/06/24/pool-tag-list.aspx

My guess there is a error condition in your network driver that causes the other drivers to not free its memory resources.

I would update my network drivers, if that fails i would turn off the microsoft driver
using:
start cmd.exe with admin rights (windows key+x then A)
sc.exe config NDU start= disabled (this will config the service no to start on next boot)

reboot and see if your memory leak problem continues.

and we find the WFPN =netio.sys - WFP NBL info container
"Windows Network Data Usage Monitoring Driver"
Ndu.sys Thu Aug 22 04:35:42 2013
e22w8x64.sys Wed Mar 20 14:24:01 2013 looks like a killer network card driver
I think MSI will have the updatedriver for your machine
Manufacturer MSI
Product Z87-G45 GAMING (MS-7821)


 
Upvote 0 Downvote
Solution
B

bnn

Honorable
Oct 30, 2013
339
0
10,860
just updated the net driver from msi, but i think i had the newest already downloaded it with liveupdate just 2 days ago, but the e22w8x64.sys still says Wed Mar 20 2013 if that was the issue, but let's see if it works, otherwise i'll try the cmd, do disabling ndu do anything noteable? otherwise i found this

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu

Change the "Start" value to 4 (to disable it). to disable it permanently and not just on next boot
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom