0

Much of the time, my laptop (Windows 7, Lenovo ThinkPad) will be using the expected ~50-70% of RAM, only going higher when I, say, play a game or load a bunch of images. But sometimes it's randomly using 90% for no apparent reason. Following a string of Google's recommendations, I ended up with poolmon. It revealed that there were at least six culprits working together in a nefarious plot to moderately inconvenience me.

They were tagged File, IoNM, NtfI, NtfE, and two had tags starting with NtF. "File" and one of the "Ntf"s were taking up more than a GB each when I first opened up poolmon, and all of the other ones near the top of the "most bytes" ranking. Google says all the "ntf"s are related to NTFS, which sounds important, so killing ntfs.sys sounds like a bad idea.

In summary: NTFS occasionally does something funky that takes up >2GB RAM and then gradually fades away. What can I do/not do in order to stop this from happening?

Edit: got screenshot. enter image description here

stellatedHexahedron
  • 111
  • 1
  • Disk / file indexing? NTFS journal? – Xen2050 Dec 19 '15 at 20:05
  • capture a xperf trace of the memory usage grow 2-3 minutes): http://superuser.com/a/949246/174557 and analyze it with WPA. If you have trouble, Zip the ETL (to reduce the file size), upload the zip to a cloud service (onedrive, dropbox) and post a share link here. – magicandre1981 Dec 20 '15 at 07:26
  • High memory usage isn't necessarily bad. It's only bad if it causes the system to need to resort to using swap space when otherwise it would be able to meet the memory demand exclusively using RAM. We've had a number of questions about this, see for example http://superuser.com/a/612916/53590 and (you can safely read "Windows" where it says "Linux") http://www.linuxatemyram.com/. **Said otherwise: Is this an actual problem in your case?** – user Dec 22 '15 at 19:51
  • Xen2050, You'll have to forgive me for not really knowing what to do with those sentence fragments. @magicandre1981 I couldn't get anything out of it; everything that might be helpful seemed to be "n/a" or similar. [here it is](https://drive.google.com/file/d/0B4t7kJeRAiKBaGxVSkhaaGx6bU0/view?usp=sharing). And yes, I'm sure that this slows down the system – stellatedHexahedron Dec 22 '15 at 20:04
  • The `"n/a`" shows up where no callstacks were captured, because the allocations were made before the trace was captured. reboot the system and run the trace directly after you see the increase of the memory usage for 2-3 minutes. – magicandre1981 Dec 23 '15 at 06:00
  • have you captured a new trace of the grow? – magicandre1981 Dec 24 '15 at 07:56
  • @magicandre1981 no, unfortunately constantly monitoring my memory waiting for it to skyrocket crosses the threshhold into "not worth it"...I _could_ find a script to alert me, but honestly that might be just as much grief – stellatedHexahedron Dec 25 '15 at 17:16
  • I need the callstacks of the allocations. Otherwise I can't help you – magicandre1981 Dec 26 '15 at 09:42

0 Answers0