Find a memory leak
Find a memory leak
A memory leak occurs when a process allocates memory from the paged or nonpaged pools, but doesn't free the memory. As a result, these limited pools of memory are depleted over time, causing Windows to slow down. If memory is completely depleted, failures may result.
Use perfmon to determine whether a memory leak exists
After opening the Performance Monitor run --> perfmon, add the following counters to the main Performance Monitor graph.
- Memory --> Pool Nonpaged Bytes
- Memory --> Pool Paged Bytes
- Paging File --> % Usage
To capture a graph of the leak over time, set the Sample every time to 600 seconds to measure the value every ten minutes. Set the Duration to capture enough activity. For example to set it to 24 hours, the value would be, 60*60*24 = 86,400 You might also want to log the data to a file for later examination.
Kernel-mode memory leaks usually deplete nonpaged pool, causing the Pool Nonpaged Bytes counter to increase, although pageable memory can be affected as well. Occasionally these counters may show false positives because an application is caching data.
User-mode memory leaks are always located in pageable pool and cause both the Pool Paged Bytes counter and the page file Usage counter to increase steadily over time.
Finding a Kernel-Mode Memory Leak
・ Download Windows Driver Kit (WDK).
Here is one approach to find a memory leak with the PoolMon utility:
- Start PoolMon.
- If you've determined that the leak is occurring in a non-paged pool, select P once. If you've determined that it's occurring in a paged pool, select P twice. If you don't know, don't select P, so both kinds of pool are included.
- Select B to sort the display by maximum byte use.
- Start your test. Copy the output from the screen, for example by taking a screenshot and saving it.
- Take a new screenshot every half hour. By comparing screenshots, determine which tag's bytes are increasing.
- Stop your test and wait a few hours. Determine how much of the tag was freed up in this time.
Typically, after an application reaches a stable running state, it allocates memory and free memory at the same rate. If it allocates memory faster than it frees it, its memory use grows over time. This often indicates a memory leak.
| Command key | Operation |
|---|---|
| P | Limits the tags shown to non-paged pool bytes, paged pool bytes, or both. Repeatedly pressing P cycles through each of these options, in that order. |
| B | Sorts tags by maximum byte usage. |
| M | Sorts tags by maximum byte allocations. |
| T | Sorts tags alphabetically by tag name. |
| E | Causes the display to include the paged and non-paged totals across the bottom. |
| A | Sorts tags by allocation size. |
| F | Sorts tags by free operations. |
| S | Sorts tags by the difference between allocations and frees. |
| Q | Quits PoolMon. |
C:\Program Files (x86)\Windows Kits\10\Tools\10.0.26100.0\x86> .\poolmon.exe -p -b
The following command shows the use of the /g parameter to add the Mapped_Driver column.
.\poolmon /g "C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\triage\pooltag.txt"
Finding a User-Mode Memory Leak
Use Performance Monitor
- Process --> Private Bytes (for each process you want to examine)
- Process --> Virtual Bytes (for each process you wish to examine)
The Private Bytes counter indicates the total amount of memory that a process has allocated, not including memory shared with other processes.
The Virtual Bytes counter indicates the current size of the virtual address space that the process uses.