Helping people with computers... one answer at a time.

When your system starts to slow down a frequent culprit are programs using excessive memory. It's fairly easy to find out which programs they are.

When I am online for any length of time I start losing RAM, any thing I am doing online starts to slow down! I recently installed an extra 512MB of RAM but didn't seem to help much. The only thing that seems to help is to shut down AOL, wait about 5 minutes and restart. Then all is OK.

If you believe you're losing available memory, or RAM, there are some fairly easy ways to see who's eating it up. And yes, programs that use more memory than they should can easily contribute to a machine slowing down more and more the longer you use it.

The most common culprit is what's called a "memory leak". This is when a program running on your PC reserves some of your computer's memory for itself, and then loses track of it. The net effect is that the program loses the ability to release that memory for other programs to use.

And if a program has a memory leak in some operation that it performs regularly, it can slowly eat up more and more of your system's memory until there's little left for any other programs.

In practice the effects of memory leaks are often minimized by the way manages memory by swapping unused memory to disk in the paging or virtual memory file. And memory that has been lost to leakage, while technically "in use" can actually not be accessed since the program that asked for it has lost track of it.

However over time memory leaks can definitely impact system performance. Rebooting resolves it for a while, as does shutting down the program that has the leak. The question is how to identify that program?

We'll start by downloading my most recommended tool: Process Explorer.

Fire up process explorer and you should see something very much like this:

Process Explorer

You should see columns labeled Working Set and Virtual Size. If you do not, right click on any column header, click on Select Columns... and in the resulting dialog, click on the Process Memory tab:

Process Explorer Column Selection

Make sure that Virtual Size and Working Set Size are both checked and click OK.

Click on the column header labeled Working Set and all the running processes on your machine will be sorted by decreasing physical memory use. The programs using the most physical memory will be listed at the top:

Process Explorer sorted by Working Set

Here you can see that on my machine as I type this firefox.exe is using the most memory, followed by explorer (the Windows taskbar and UI), Process Explorer itself, and the rest of the programs running on my machine.

Keep this open and watch it as you use your computer. If you see one program that's continually using more and more memory, that could be a sign of a problem with that program.

Now repeat this process, but this time sort by Virtual Size:

Process Explorer sorted by Virtual Size

Virtual Size include all the memory allocated by each process, including that which has been swapped out to virtual memory or the paging file. As you can see, sorting by this typically results in a different order of programs. In my case one of the instances of svchost.exe has consumed the most virtual memory, followed by process explorer and Window's explorer.exe.

Once again, leave this running as you use your computer for a while and watch for programs that continually grow in their virtual memory allocation.

As your system performance degrades you may see one program with an excessively large physical or virtual memory allocation. What to do next will depend entirely on exactly what that program turns out to be, but at least you'll have identified the potential culprit.

Article C2985 - April 5, 2007 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

12 Comments
Charlotte Kimm
April 6, 2007 11:43 PM

Thanks, you do an especially good job of making the steps easy to follow...here though, it might be helpful to state that the window may have to be made larger left to right size, in order to see the working set and virtual columns..thanks again for being there for your readers... Charlotte

Ron Ledet
April 7, 2007 7:37 AM

The article and the Process Explorer tool were very helpful. However, when I viewed processes running on my system, there were 6 abstantiations of "svchost.exe" running. The collective total of the memory being used by these processes was very large. Is this normal?

Rob Caunt
April 8, 2007 6:58 AM

Thanks Leo, another helpful tool and one that I will definitely be getting to grips with, you do a great job. May I point out with regard to the comment from Charlotte Kimm on 6 April, you can actually change the order of the columns. To do this, left click on the column header and, while holding down the mouse button, move the column header to the place you need it.

Leo A. Notenboom
April 8, 2007 12:07 PM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ron: It's quite common to have more than one, and yes, sometimes they do use a
lot of memory.
http://ask-leo.com/what_is_svchost_and_why_is_there_more_than_one_copy_running.html

Leo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)

iD8DBQFGGT2RCMEe9B/8oqERAqXuAJ0VapuqCVauqxTVnG8uolrZiLTKCACfRzCn
clTEGDE2abSFChRDpvLzAAE=
=vz+T
-----END PGP SIGNATURE-----

Fred
May 13, 2007 8:09 AM

thanks. but, now that I know one of my svchost.exe files is constantly hogging all my available memory, what do I do about it? It's gotten so bad that I sometimes have to reboot two or three times. it might take me up to a half hour before everything settles down and I can actually use my computer. How do I figure out why the svchost.exe file is killing me???

Jenn
May 13, 2007 9:05 PM

Fred,

There is an article on how to fix what you're experiencing, I hope that this will be helpful to you: http://ask-leo.com/how_do_i_fix_this_high_cpu_usage_svchost_virus_or_whatever_it_is.html

Sacha
October 9, 2010 2:16 AM

Thanks Leo,

Have installed and run the Process Explorer. It shows that SQL Server Windows NT uses 1,175,000 of virtual memory approximately. This is the higher virtual memory item. Is it normal ?

No way for me to know - it depends on how it's being used. I'd expect SQL Server to use a lot of memory, though.
Leo
09-Oct-2010
Vee Butterfield
November 7, 2010 2:01 PM

I installed the Process Explorer, but the instructions with the download say to read the help file for further information on how to interpret the data. When I try to open the help file, I get a message stating, "Navigation to the webpage was cancelled". Running Windows XP SP3. I'm fighting a serious memory leak and looks like this tool will be very helpful in finding it. How do I get into the help file??

Kostas
December 13, 2010 6:25 AM

Hi Leo.
Your article identify my problem. Thanks a lot.
But..can you give me a solution?What if i need this program to run 24/7 and dont want to shut it down in order to free the memory?
Is there a way to free the memory without shut down the program?
Im running XP 32bit and the program starts with 4Mb of memory..but after a few hours it uses 150Mb of memory.
Any idea?
Thanks a lot.

You didn't tell me what program it is, so I have no idea what's possible. Basically you'll need to understand the appropriate options and settings for the program - perhaps contact the program's manufacturer. Anf for the record: 150MB isn't much these days. I'm not sure I'd worry.
Leo
13-Dec-2010

Kostas
December 13, 2010 12:40 PM

Hi again. Thank you for the quick reply.
Yes, 150Mb isn't much. But what if the pc has only 1GB of memory (maximun for the current motherboard) from wicht 260MB are used by windows itself and i'm running this program (L2NET) x3 (3x150=450MB). For your information is a small program (140MB) that helps me with a game. Right now each one L2NET uses 180MB of memory. Total usage of memory 0,99GB of 1GB. I hardly open the explorer. Contacting the manufacturer is out of the question (company doesn't exist, self made by few programers).
Bottom line, i know i talk (***) right now, but any idea? Any alternative idea?
Maybe the program itself has the problem, but what can i do if i have to use it...?

Thank you for your time. Best regards.

star
January 26, 2012 9:06 PM

after all posts here ;am still of need to know; when have open 30 tabs ;whether one of them and which one is it that uses up my ram ?task manager shows one chrome exe is using a third of all my ram ;now which oine ???

Use task manager to kill that one, and see which tab disappears.
Leo
28-Jan-2012
Iv.
August 26, 2012 7:00 AM

Hi, Leo! I need some help.

My memory is getting lower even if i delete something. Slowly, little by little. Sometimes it recovers a little, but it continues disappearing. I can't tell if it happens when being online, i am always online, when my laptop is turned on. The problem is i have either way too little free space and this is making me worry. I barely have free space now.
I've tried and checked different options, used some programs to check things, but i am only searching for solution, still not sure where the problem is. I ran Process Explorer and i saw that Mozilla Firefox is on top both Virtual and Work set. What should i do then? I am not using the last version, i don't like it and so far i didn't have problems using older version.
What if the cause of the problem is a program on 2nd or 3rd place of the list? On Working set, 2nd program is cmdagent.exe (COMODO i am using as anti virus program), skype is somewhere on top, but i didn't open it, i am not logged in.
Another thing is, that Skype cannot log me in, for a second time. Last time it did that i installed a program called TuneUp Utilities 2012, we (with helm from other person) cleaned some registry and unused paths/files and it worked out, but still there's a problem it seems.

The scan i run just now shows no infections or anything.
The "svchost" file i wrote has a virus if it's written with a space between svchost and .exe, but mine it's written only like this "svchost" and i don't understand is there anything wrong with that.

My Windows is XP Professional SP 3
Pentium (R) Dual-Core CPU
T400 @ 2.00GHz
2.00 GHz, 2,93 GB of RAM

Also i noticed that after the installation of that TuneUp Program my computer takes almost 10min to turn off. It wasn't like this before. Says it saves my settings, i thought that would be only after the first work with the program. That's only annoying for now, but i am not sure if it's a problem too.

Sorry or the bunch of questions.

Best regards,

Iv.

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.