If you believe you’re losing available memory, or RAM, there are some fairly easy ways to see who’s eating it up. And yes, programs that use more memory than they should can easily contribute to a machine slowing down more and more the longer you use it.
Become a Patron of Ask Leo! and go ad-free!
The most common culprit is what’s called a “memory leak”. This is when a program running on your PC reserves some of your computer’s memory for itself, and then loses track of it. The net effect is that the program loses the ability to release that memory for other programs to use.
And if a program has a memory leak in some operation that it performs regularly, it can slowly eat up more and more of your system’s memory until there’s little left for any other programs.
In practice the effects of memory leaks are often minimized by the way manages memory by swapping unused memory to disk in the paging or virtual memory file. And memory that has been lost to leakage, while technically “in use” can actually not be accessed since the program that asked for it has lost track of it.
However over time memory leaks can definitely impact system performance. Rebooting resolves it for a while, as does shutting down the program that has the leak. The question is how to identify that program?
We’ll start by downloading my most recommended tool: Process Explorer.
Fire up process explorer and you should see something very much like this:
You should see columns labeled Working Set and Virtual Size. If you do not, right click on any column header, click on Select Columns… and in the resulting dialog, click on the Process Memory tab:
Make sure that Virtual Size and Working Set Size are both checked and click OK.
Click on the column header labeled Working Set and all the running processes on your machine will be sorted by decreasing physical memory use. The programs using the most physical memory will be listed at the top:
Here you can see that on my machine as I type this firefox.exe is using the most memory, followed by explorer (the Windows taskbar and UI), Process Explorer itself, and the rest of the programs running on my machine.
Keep this open and watch it as you use your computer. If you see one program that’s continually using more and more memory, that could be a sign of a problem with that program.
Now repeat this process, but this time sort by Virtual Size:
Virtual Size include all the memory allocated by each process, including that which has been swapped out to virtual memory or the paging file. As you can see, sorting by this typically results in a different order of programs. In my case one of the instances of svchost.exe has consumed the most virtual memory, followed by process explorer and Window’s explorer.exe.
Once again, leave this running as you use your computer for a while and watch for programs that continually grow in their virtual memory allocation.
As your system performance degrades you may see one program with an excessively large physical or virtual memory allocation. What to do next will depend entirely on exactly what that program turns out to be, but at least you’ll have identified the potential culprit.
Thanks, you do an especially good job of making the steps easy to follow…here though, it might be helpful to state that the window may have to be made larger left to right size, in order to see the working set and virtual columns..thanks again for being there for your readers… Charlotte
The article and the Process Explorer tool were very helpful. However, when I viewed processes running on my system, there were 6 abstantiations of “svchost.exe” running. The collective total of the memory being used by these processes was very large. Is this normal?
Thanks Leo, another helpful tool and one that I will definitely be getting to grips with, you do a great job. May I point out with regard to the comment from Charlotte Kimm on 6 April, you can actually change the order of the columns. To do this, left click on the column header and, while holding down the mouse button, move the column header to the place you need it.
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1
Ron: It’s quite common to have more than one, and yes, sometimes they do use a
lot of memory.
http://ask-leo.com/what_is_svchost_and_why_is_there_more_than_one_copy_running.html
Leo
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.6 (MingW32)
iD8DBQFGGT2RCMEe9B/8oqERAqXuAJ0VapuqCVauqxTVnG8uolrZiLTKCACfRzCn
clTEGDE2abSFChRDpvLzAAE=
=vz+T
—–END PGP SIGNATURE—–
thanks. but, now that I know one of my svchost.exe files is constantly hogging all my available memory, what do I do about it? It’s gotten so bad that I sometimes have to reboot two or three times. it might take me up to a half hour before everything settles down and I can actually use my computer. How do I figure out why the svchost.exe file is killing me???
Fred,
There is an article on how to fix what you’re experiencing, I hope that this will be helpful to you: http://ask-leo.com/how_do_i_fix_this_high_cpu_usage_svchost_virus_or_whatever_it_is.html
Thanks Leo,
Have installed and run the Process Explorer. It shows that SQL Server Windows NT uses 1,175,000 of virtual memory approximately. This is the higher virtual memory item. Is it normal ?
09-Oct-2010
I installed the Process Explorer, but the instructions with the download say to read the help file for further information on how to interpret the data. When I try to open the help file, I get a message stating, “Navigation to the webpage was cancelled”. Running Windows XP SP3. I’m fighting a serious memory leak and looks like this tool will be very helpful in finding it. How do I get into the help file??
Hi Leo.
Your article identify my problem. Thanks a lot.
But..can you give me a solution?What if i need this program to run 24/7 and dont want to shut it down in order to free the memory?
Is there a way to free the memory without shut down the program?
Im running XP 32bit and the program starts with 4Mb of memory..but after a few hours it uses 150Mb of memory.
Any idea?
Thanks a lot.
13-Dec-2010
Hi again. Thank you for the quick reply.
Yes, 150Mb isn’t much. But what if the pc has only 1GB of memory (maximun for the current motherboard) from wicht 260MB are used by windows itself and i’m running this program (L2NET) x3 (3×150=450MB). For your information is a small program (140MB) that helps me with a game. Right now each one L2NET uses 180MB of memory. Total usage of memory 0,99GB of 1GB. I hardly open the explorer. Contacting the manufacturer is out of the question (company doesn’t exist, self made by few programers).
Bottom line, i know i talk (***) right now, but any idea? Any alternative idea?
Maybe the program itself has the problem, but what can i do if i have to use it…?
Thank you for your time. Best regards.
after all posts here ;am still of need to know; when have open 30 tabs ;whether one of them and which one is it that uses up my ram ?task manager shows one chrome exe is using a third of all my ram ;now which oine ???
28-Jan-2012
Hi, Leo! I need some help.
My memory is getting lower even if i delete something. Slowly, little by little. Sometimes it recovers a little, but it continues disappearing. I can’t tell if it happens when being online, i am always online, when my laptop is turned on. The problem is i have either way too little free space and this is making me worry. I barely have free space now.
I’ve tried and checked different options, used some programs to check things, but i am only searching for solution, still not sure where the problem is. I ran Process Explorer and i saw that Mozilla Firefox is on top both Virtual and Work set. What should i do then? I am not using the last version, i don’t like it and so far i didn’t have problems using older version.
What if the cause of the problem is a program on 2nd or 3rd place of the list? On Working set, 2nd program is cmdagent.exe (COMODO i am using as anti virus program), skype is somewhere on top, but i didn’t open it, i am not logged in.
Another thing is, that Skype cannot log me in, for a second time. Last time it did that i installed a program called TuneUp Utilities 2012, we (with helm from other person) cleaned some registry and unused paths/files and it worked out, but still there’s a problem it seems.
The scan i run just now shows no infections or anything.
The “svchost” file i wrote has a virus if it’s written with a space between svchost and .exe, but mine it’s written only like this “svchost” and i don’t understand is there anything wrong with that.
My Windows is XP Professional SP 3
Pentium (R) Dual-Core CPU
T400 @ 2.00GHz
2.00 GHz, 2,93 GB of RAM
Also i noticed that after the installation of that TuneUp Program my computer takes almost 10min to turn off. It wasn’t like this before. Says it saves my settings, i thought that would be only after the first work with the program. That’s only annoying for now, but i am not sure if it’s a problem too.
Sorry or the bunch of questions.
Best regards,
Iv.