Interesting suspected memory leak issue with Windows 10 and ntoskrnl...

S

shaneturner12

Tutorial Creator
Hi Trainzers,

I realise this may be a bit off-topic, but it may be of interest to those who are encountering memory usage issues with Windows 10.

In some instances, the System process (ntoskrnl.exe) uses a lot of memory (at one point on mine it was over 500MB, but looking at other sites about the issue some have had it as high as 2.1GB). This can be checked using Task Manager.

This appears to be an issue with the way the process operates, but I have managed to reduce mine down to just under 400MB by turning off the Windows Tips feature (Settings > System > Notifications and Actions > Show me tips about Windows).

Note that this is not a full solution (it's more of a workaround) as it looks like there is a memory leak in the ntoskrnl process. It also appears that the latest update does not fix the issue.

Hopefully this will be of use to other users who have Windows 10, as it may cause T:ANE and older Trainz versions to potentially run out of memory.

Shane
 
Mine's only showing 131mb. I'm been downloading stuff all day and running several versions of T:ANE. T:ANE is showing 541MB and I only have the launcher and one CM window open.

Of more concern are the five Windows Explorers showing in the list each using 14% of processor time. I don't even have a File Explorer open.
 
pcas1986 said:
Mine's only showing 131mb. I'm been downloading stuff all day and running several versions of T:ANE. T:ANE is showing 541MB and I only have the launcher and one CM window open.

Of more concern are the five Windows Explorers showing in the list each using 14% of processor time. I don't even have a File Explorer open.
Click to expand...

That's interesting to know, although it's a bit baffling why your system has 5 Explorer processes running - I know that one is a background process though.

I would be interested to see if anyone else has encountered high memory usage by the System process (although 131MB seems high when it starts around 50MB when the system is started up).

Shane
 
A further update on the issue - it appears that the memory usage by ntoskrnl seems to be affected by full screen applications (I've just closed one that I was running which was Rollercoaster Tycoon 3 and the memory usage more than halved down to just under 180Mb).

Shane
 
I'm not sure this is a memory leak, but more an indication of memory usage.

If the memory usage continued to climb or did not decrease when a program is closed, then this would be a memory leak. A good example would be the older Excel 2000. With this application, one would open the program and perform some functions within the application, close it and run something else, come back and do something else in Excel, close it and repeat. Eventually the computer would crash. The problem being that Excel 2000 never released the full amount of private bytes memory allocated to it when the program was closed.

I have noticed with Windows 8.1 that some of the earlier native Metro-style applications don't completely close and there is an application remaining open in the background even after clicking on the X or clicking close to close the application. That issue resolved its self after the applications were updated and I haven't been able to find that problem in Windows 10.

You might find RAM MAP by Mark Russinovitch very helpful. His application is available in the System Internals Suite. It will list the memory stacks and heaps and will even display who owns what, and you can track what's been released and what is still allocated by refreshing the application.



John
 
JCitron said:
I'm not sure this is a memory leak, but more an indication of memory usage.

If the memory usage continued to climb or did not decrease when a program is closed, then this would be a memory leak. A good example would be the older Excel 2000. With this application, one would open the program and perform some functions within the application, close it and run something else, come back and do something else in Excel, close it and repeat. Eventually the computer would crash. The problem being that Excel 2000 never released the full amount of private bytes memory allocated to it when the program was closed.

I have noticed with Windows 8.1 that some of the earlier native Metro-style applications don't completely close and there is an application remaining open in the background even after clicking on the X or clicking close to close the application. That issue resolved its self after the applications were updated and I haven't been able to find that problem in Windows 10.

You might find RAM MAP by Mark Russinovitch very helpful. His application is available in the System Internals Suite. It will list the memory stacks and heaps and will even display who owns what, and you can track what's been released and what is still allocated by refreshing the application.



John
Click to expand...

Thankyou for your response John. It seems rather strange for the System process to be using so much memory though so something is amiss somewhere (on previous versions and after a restart, it's usually around 50-60MB or even less in terms of pre-Windows 10).

I will have a look on RAM MAP though to see if that can make sense.

Shane

EDIT: Looking at results on the Internet, it looks like I'm not alone on this - something about Windows 10 Home (not sure about the Pro version). Also, RAMMap threw up an error when run regarding being unable to refresh the database (and that's with it running as administrator).
 
Last edited:
shaneturner12 said:
Thankyou for your response John. It seems rather strange for the System process to be using so much memory though so something is amiss somewhere (on previous versions and after a restart, it's usually around 50-60MB or even less in terms of pre-Windows 10).

I will have a look on RAM MAP though to see if that can make sense.

Shane

EDIT: Looking at results on the Internet, it looks like I'm not alone on this - something about Windows 10 Home (not sure about the Pro version). Also, RAMMap threw up an error when run regarding being unable to refresh the database (and that's with it running as administrator).
Click to expand...

You might want to try Sys Internals Process Explorer as well. This lets you see individual components of named processes such as svchost.exes and a breakdown of who is using what when viewing CPU and memory usage graphs.

I also see none of these issue occurring on my system at all, which is weird. I am running PRO so that must be the reason? But could it be because I have done a recent fresh install and not carried over any baggage from my previous versions of Windows 10 test builds and Windows 8.1 prior to that?

My Explorer only shows a single instance running and that of course is the background process. Right now I am running the T:ANE Dev version and doing various things in there including asset replacement while posting here on the forums.

I wonder too if it has something to do with other system drivers. Ensure that all your drivers are up-to-date as far as your system is capable of. With my Intel motherboard, I have the latest and do not use the built-in ones from Microsoft. I discovered years ago that their drivers are awful and in many cases a bit behind what the hardware manufacturers have available on their websites.



John
 
JCitron said:
I'm not sure this is a memory leak, but more an indication of memory usage.


You might find RAM MAP by Mark Russinovitch very helpful. His application is available in the System Internals Suite. It will list the memory stacks and heaps and will even display who owns what, and you can track what's been released and what is still allocated by refreshing the application.

John
Click to expand...

Ram Map isn't working here John in Win 10, opens with error refreshing database and is blank. Wasn't related to Shanes problem, I've just been investigating what is doing what in Win 10, least Process Explorer is working.
 
JCitron said:
You might want to try Sys Internals Process Explorer as well. This lets you see individual components of named processes such as svchost.exes and a breakdown of who is using what when viewing CPU and memory usage graphs.

I also see none of these issue occurring on my system at all, which is weird. I am running PRO so that must be the reason? But could it be because I have done a recent fresh install and not carried over any baggage from my previous versions of Windows 10 test builds and Windows 8.1 prior to that?

My Explorer only shows a single instance running and that of course is the background process. Right now I am running the T:ANE Dev version and doing various things in there including asset replacement while posting here on the forums.

I wonder too if it has something to do with other system drivers. Ensure that all your drivers are up-to-date as far as your system is capable of. With my Intel motherboard, I have the latest and do not use the built-in ones from Microsoft. I discovered years ago that their drivers are awful and in many cases a bit behind what the hardware manufacturers have available on their websites.



John
Click to expand...

I'm starting to wonder as well. Process Explorer is showing me that ntoskrnl has a high figure for working set, although none of it's sub-processes are showing high figures. I'm also wondering if it's related to the fact that I upgraded rather than doing a clean install.

Shane

EDIT: Just done another check. There are two problem processes that may be involved within the System process - AVG's server scanning process which is using around half of that amount, and SearchUI (Cortana) which is using the rest.
 
Last edited:
shaneturner12 said:
I'm starting to wonder as well. Process Explorer is showing me that ntoskrnl has a high figure for working set, although none of it's sub-processes are showing high figures. I'm also wondering if it's related to the fact that I upgraded rather than doing a clean install.

Shane

EDIT: Just done another check. There are two problem processes that may be involved within the System process - AVG's server scanning process which is using around half of that amount, and SearchUI (Cortana) which is using the rest.
Click to expand...

I will bet a Trainz loco (free one :) ) that this is probably your antivirus being a big part of this problem. I noticed that with IOBit's Advanced System Care utilities before when I was running them. They'd hog the system down completely with their processes and hooks. Try disabling your AVG and running Windows Defender and see if it helps. You can always swap back afterwards.

The other reason I'm thinking this is I do not have the ASC suite installed on my freshly rebuilt system so the system is pretty much squeaky clean in this respect. :) The compatibility is sure these older applications will work, however, they may not work as efficiently as they will on their native OS they were written for. Sounds familiar, doesn't it. :)

John
 
Here's the results from my last testing:

Disabled AVG (not fully removing it) - went up to around 650MB (was around 500MB at the time).
Disabled Cortana - slight increase
Closed a full screen program I had running - went up to 750MB then dropped to just over 500MB.

I'm even more confused now. For some reason the SearchIndexer process memory usage has suddenly increased to around 690MB, although it's dropped back down to around 150MB.

Shane
 
Last edited:
No problem with ntoskrnl here, Cortana is a greedy little pest, especially as it is supposedly disabled here. AVG has a bit of a reputation as a memory hog
My two highest users are Avast and Cortana. I left T:ANE running for an hour in AI mode without doing anything else other than keeping an eye on Gpuz and memory usage and memory sat firmly on 3.9GB
 
clam1952 said:
No problem with ntoskrnl here, Cortana is a greedy little pest, especially as it is supposedly disabled here. AVG has a bit of a reputation as a memory hog
My two highest users are Avast and Cortana. I left T:ANE running for an hour in AI mode without doing anything else other than keeping an eye on Gpuz and memory usage and memory sat firmly on 3.9GB
Click to expand...

Thankyou for your response Malc.

I've now determined it to be a working set issue, as I've just run my Process Hacker version and told it to reduce the working set on ntoskrnl and the memory usage has dropped dramatically to just over 1MB although it looks to be steadily climbing again and is currently hovering around 20MB.

Shane
 
The working set should vary shouldn't it?

Isn't that the memory that's in use then dumped as applications are closed or increase as they are opened. I would be more concerned with private memory as that is locked by applications and should be released when they are closed. If this doesn't release then there's an issue with the application, and thus a memory leak.

I just confirmed the same with RAM Map. Too bad, perhaps Mark will update this to work with Windows 10. Yup, PE works fine and I'm glad too as that's one of the most useful tools we've got. I too have seen AVG act like this before even in Windows 7.

There's a possibility that other components such as Cortana are now integrated with the NTOSKrnl and therefore show that kernel as having a higher memory footprint. This may explain part of the issue too. My concern is we're reading into this deeper than necessary. Windows 10 may work differently then the older versions of Windows though share much of the underpinnings of the older versions. If there is no performance drop, then I'd leave well enough alone is what I'm trying to say here.

John
 
Hi John,

Indeed it should vary, but not necessarily to that large an amount I would think. It does appear though that memory that has been in use isn't necessarily being dumped properly when programs are closed.

In terms of private memory, that's what made up most of the figure - only a few MB was showing as shareable.

Unfortunately, the problem did cause other performance related issues including a low memory message.

Either way, it's currently under control at around 27MB although when I restart it's probably going to go back up again.

Shane
 
Last edited:
From reading around quite a few forums, it would appear that not everyone is seeing the expected improvements / performance with Win 10 and there is another update due on the 10th to sort some of these issues out, may be worth hanging on and see if the issue gets resolved?
 
clam1952 said:
From reading around quite a few forums, it would appear that not everyone is seeing the expected improvements / performance with Win 10 and there is another update due on the 10th to sort some of these issues out, may be worth hanging on and see if the issue gets resolved?
Click to expand...

Indeed - I will keep an eye out for that one. In the meantime though, I will be keeping an eye on that ntoskrnl process to see if it misbehaves again.

Thankyou to you, Paul, and John though for responses as it's helped me track things down.

Shane
 
Last edited:
shaneturner12 said:
In some instances, the System process (ntoskrnl.exe) uses a lot of memory (at one point on mine it was over 500MB, but looking at other sites about the issue some have had it as high as 2.1GB). This can be checked using Task Manager.
Click to expand...

You cannot diagnose a memory leak by looking at instantaneous figures. Unused memory is wasted memory - you may as well take it out. A properly configured operating system will arrange for applications to use as much memory as they can get, subject to priorities. High memory usage might indicate that the application is well designed to take advantage of the resources available to it.

Turning off unused applications is always worthwhile, but might not result in reduced memory use - just a re-allocation.

Memory usage is complex. the simple figure provided by task manager can be very misleading.
 
BuilderBob said:
You cannot diagnose a memory leak by looking at instantaneous figures. Unused memory is wasted memory - you may as well take it out. A properly configured operating system will arrange for applications to use as much memory as they can get, subject to priorities. High memory usage might indicate that the application is well designed to take advantage of the resources available to it.

Turning off unused applications is always worthwhile, but might not result in reduced memory use - just a re-allocation.

Memory usage is complex. the simple figure provided by task manager can be very misleading.
Click to expand...

I know what you mean, although that kind of memory usage by a process that doesn't normally do much is still strange, especially as it didn't do that prior to Windows 10.

Shane
 
An update to my situation...

I've now removed AVG from my system completely and the memory usage is now sitting around the 50-60MB mark even with a full screen application running, which makes me think that AVG was at least partially responsible for the memory issues.

Something for those with Windows 10 to think about I'd say, especially if they have all the protection options turned on.

Shane

EDIT: Looks like it's just gone back up to around 285MB (284MB of that is private memory) - something else is amiss...
 
Last edited:
You must log in or register to reply here.

Similar threads

J
Updating programs and Windows components using Winget
Replies
8
Views
344
JCitron
J
C
Running BasemapzSetup.msi on Windows 10
Replies
5
Views
368
JCitron
J
J
Notes on toys for backing up
Replies
4
Views
439
JCitron
J
P
An issue with a passenger mesh
Replies
4
Views
237
johnwhelan
J
T
Issue with background in Trainz inPE edition
Replies
1
Views
173
Forester1
F
Back
Top