ID: QA350 | Access Levels: TechConnect

Diagnosing the source of memory leaks and their affect on

system operation

Document ID QA350

Published Date 02/13/2020

Summary
Diagnosing the source of memory leaks and their affect on system operation

Question
How to troubleshoot and diagnose a memory leak in an application or driver?

Environment
Microsoft Windows

Answer
What is a Memory Leak?
A memory leak occurs when a process (like an application or a service) allocates memory, but fails to release the
memory back to the system when the application is finished using it. The application with the leak continues to
run periodically, eating away at your system’s memory, until all available memory is used up. This can take
several minutes to several days depending on the characteristics of the memory leak. A patch or update of the
offending piece of software is required to fix this type of problem.

Leaks can vary in degree, but you can usually track down the source or the memory leak using tools supplied by
Microsoft.

Symptoms
Symptoms of memory leaks usually include one or more of the following:

Poor system performance - hard disk thrashing, applications lake longer to load, etc.
Applications no longer load when you attempt to launch them
Applications don’t perform as expected, i.e. you can no longer save files, execute
different menu options, etc.
Error messages regarding virtual memory and/or resources
For instance, you’ll get the following message when running low on virtual
memory:

System Process - Out of Virtual Memory. Your system is

running low on virtual memory. Please close some
applications. You can then start the System option in the
Control Panel and choose the Virtual Memory button to create
an additional paging file or to increase the size of your
current paging file.

The mouse and/or keyboard locks up

Windows no longer re-paint properly when moving them around the desktop
What to Monitor for Signs of a Memory Leak

Memory Usage and Virtual Memory increasing (even during inactivity)

Paged Pool Memory being consumed and not returned
Non-paged Pool Memory being consumed and not returned
Threads being spawned and not removed
increases in the number of Handles or GDI objects used.

Paged Pool Memory is system (kernel) code that is pageable to disk (stored in pagefile.sys). Non-paged Pool
Memory is code that must stay resident in physical memory (RAM)

Diagnosing the Source of an Application Memory Leak

For simple problems, the built-in Task Manager can be used to periodically inspect memory use of various
programs:

1. Reboot the computer so that an initial baseline record can be made.

2. Open Task Manager and select the Performance tab, take a screen shot capturing
the total values of Handles, Threads and Kernel Memory etc.

3. Click the Processes tab. Add the additional columns shown to the screen shot below
by clicking View-->Select Columns. Take a screen shot to record the values.
 4. Open the application thought to have a memory leak, and repeat steps 2 and 3.
Continue using the suspect application and take further screen shots to compare
with the original.
5. Compare the later screen shots with the original set.
Performance Tab
This gives a general overview of the entire system. As applications are opened,
the number of Handles, Threads and Processes should increase, as should the
Commit, and Paged memory values. When applications are closed, these values
should reduce back nearly to the original values. If the Commit (MB) used is
close to the Commit Limit, this indicates the system is running low on virtual
memory. If the current Commit (MB) limit is larger than the initial Commit (MB) -
limit, this indicates that the page file (pagefile.sys) had to increase above its
initial size. The page file size is limited by values set from Control Panel >
System. If the page file limit reaches the Maximum Size, it cannot grow larger
and chances are you will not be able to open any more applications and will
experience one or more Symptoms as described above.
Processes Tab
As applications are opened, new processes will appear in the list. Observe
changes in the values for each process to help narrow-down the source of any
increases observed in the overall system values seen in the Performance tab.
Specifically, compare the number of Page Faults (current vs. initial) for each
process. If one or two processes have a large deviation between initial and
current values (compared to other processes), this indicates that these
processes are probably leaking memory. Handle and GDI object counts will
increase as objects are displayed on the screen, these should fluctuate around a
steady-state average, continual increase is a sign of a leak.

Remember, the only way to fix a leak in an application is to obtain an update or a patch that fixes the memory
leak. Please report any findings to Rockwell Automation Technical Support.

Diagnosing the Source of a Driver Memory Leak

A driver memory leak may be suspected if the amount of Nonpaged memory is seen to be increasing over time.
Driver resource use is otherwise not shown in the Windows Task manager, so other tools are required.

Microsoft produce a suite of debugging tools as part of the Software Development Kit (SDK) for Windows. One of
these tools, the Windows Performance Monitor, will record various performance statistics similar to that seen in
Task Manager above, but in more detail and allowing for the results displayed graphically over time.

1. The Windows 8.1 SDK can be downloaded for free from Microsoft. The Windows 8.1
SDK that has been linked to will also work fine for Windows 7 and Windows Server
2008. The Windows 10 SDK does not have the option to install on a computer without
Internet access.
2. The initial download is small <1 MB, when it is run you will be presented with the
screen below. You have the option of installing directly, or downloading for offline
installation on another computer. Select the appropriate option for your
circumstances and click Next.
3. You will be asked if you want to join the Customer Experience program on the next
screen, you can choose either option, then click Next. The following screen lists
multiple options to install, all you need are the 2nd and 3rd options - Windows
Performance Toolkit and Debugging Tools for Windows. Select the options and
click Download or Install.

4. If offline installation was chosen and Download clicked above, four file/folders will be
created in the location you choose to download too. These four will need to be copied
to the computer on which you want to install them. Run SDKSetup.exe to install the
Performance Tools. This process looks similar to the previous steps, and so is not
illustrated here. There are no options to change.
5. Once the Installation is complete, run the Windows Performance Recorder, which you
will find on the Start menu under All Programs-->Windows Kits-->Windows
 Performance Toolkit.
6. The Windows Performance Recorder interface open. Click Show Options to
customize the data recorded. Continuing below, the option for Pool Usage has
been selected and the Detail Level has been set to Light in order to investigate a
suspect leak in Nonpaged pool memory.

7. Click Start, and the recorder begins. It will reserve a block of system memory as a
circular buffer and will record data into that buffer until Save is clicked. At this point,
you will have the option to specify a file name and path. Saving take a few moments,
after which Open in WPA may be clicked.

8. A sample of the Pool Graphs output is shown below, showing the Nonpaged pool
memory use over 30 seconds. The column labeled Impacting Size records the
change in memory use for each Pool Tag during the course of recording. Note that
Pool Tag EtwB will likely be high, as it is in the screen shot below- this is part of the
recorder process and a red-herring when investigating a leak.
 9. Each Pool Tag is a string identifier for a specific driver or process. Common
Windows tags are listed in a file named pooltag.txt located in C:\Program
Files (x86)\Windows Kits\8\Debuggers\x86\triage (assuming the default
path was used for installation). Search this file to help identify Pool Tags with
unusually high or increasing utilization seen in the graph.
10. If the Pool Tag can not be found pooltag.txt, it may be found by inspecting the content
of installed driver files for text strings. A utility is provide by Microsoft to help with
this, download and extract the Strings utility to C:\Windows\System32.
11. Driver files will likely be installed in either C:\Windows\System32\drivers or
C:\Windows\SysWOW64\drivers (on 64-bit computers). To use the Strings utility
to search a folder, navigate to the folder at a Command prompt. The syntax for a
search is as follows, results are listed with the file-name and string the text is
contained within:

strings * findstr <Pool Tag>

12. Now that the file containing the string has been identified, locate the file in Windows
Explorer, right-click the file and select Properties. The Details tab will have
information such as Description, Manufacturer, Version and Modified date, which
should be useful in obtaining updated files.
 Attachments

File
7253 - Diagnosing the source of memory leaks and their affect on system operation
(original 1999.pdf

DISCLAIMER
This knowledge base web site is intended to provide general technical information on a particular subject or subjects and is not an exhaustive treatment of such
subjects. Accordingly, the information in this web site is not intended to constitute application, design, software or other professional engineering advice or services.
Before making any decision or taking any action, which might affect your equipment, you should consult a qualified professional advisor.

ROCKWELL AUTOMATION DOES NOT WARRANT THE COMPLETENESS, TIMELINESS OR ACCURACY OF ANY OF THE DATA CONTAINED IN THIS WEB SITE AND MAY MAKE
CHANGES THERETO AT ANY TIME IN ITS SOLE DISCRETION WITHOUT NOTICE. FURTHER, ALL INFORMATION CONVEYED HEREBY IS PROVIDED TO USERS "AS IS." IN NO
EVENT SHALL ROCKWELL BE LIABLE FOR ANY DAMAGES OF ANY KIND INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS PROFIT OR DAMAGE, EVEN
IF ROCKWELL AUTOMATION HAVE BEEN ADVISED ON THE POSSIBILITY OF SUCH DAMAGES.

ROCKWELL AUTOMATION DISCLAIMS ALL WARRANTIES WHETHER EXPRESSED OR IMPLIED IN RESPECT OF THE INFORMATION (INCLUDING SOFTWARE) PROVIDED
HEREBY, INCLUDING THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, AND NON-INFRINGEMENT. Note that certain
jurisdictions do not countenance the exclusion of implied warranties; thus, this disclaimer may not apply to you.

www.rockwellautomation.com

Copyright © 2023 Rockwell Automation, Inc. All Rights Reserved.