Very recently, I noticed my memory usage would slowly approach 100% with normal computer usage, until eventually the system would crash. I went hunting to see if any particular process(es) were responsible (i.e., potential memory leak), but couldn't account for the vast majority of the in-use memory.
Running RamMap (from sysinternals) I discovered there was a huge chunk of memory listed as Transition with usage Process Private. I discovered on a fresh boot, this amount is fairly small, but seems to grow with normal usage (not tied to any particular process, but memory-intensive tasks cause it to grow more quickly - there's definite correlation). In other words, it seems that this memory isn't being "un-Transition-ed" properly, and eventually there isn't enough space for Active memory and the system crashes.
Any ideas on what may have suddenly caused this would be most welcome. I really can't think of many solutions beyond a full wipe and re-install at this point.
Extra info:
OS is Win 7 Pro.
None of RamMap's "Empty" options are able to reclaim this "Transition" memory.
In resmon the memory in question simply shows as In Use, but no process (or all of them combined) can account for the huge memory usage.
2 Answers
I'm guessing you have Crowdstrike installed ?
I had the same issue, you will need to downgrade the sensors.
For clarity as the URL is behind a support portal you need to downgrade to 6.23.13702 until the issue is resolved.
See below :
Falcon sensor high memory consumption on Windows Hosts
Jun 28, 2021 Symptoms
Falcon sensor high memory consumption on Windows Hosts.
Appears to be more prevalent on Windows 7 and Server 2008 R2.Applies To
All Windows OSes more prevalent on Windows 7 and Windows Server 2008 R2
Falcon Sensor for Windows versions 6.25.13905 6.24.13806Resolution
Issue is currently unresolved.
Workarounds, if running on Windows 7 or Server 2008 R2: Customers with both CrowdStrike and Microsoft Extended Support Updates installed: Downgrade sensors to 6.23.13702 Lock update policies to prevent upgrade, until issue is resolved If you have paid for and signed a Microsoft ESU Agreement, those updates must be installed on Windows 7 or Server 2008 R2 hosts to fall into this category. Customers without Microsoft Extended Support Updates installed: Windows 7 and Server 2008 R2 are only supported on specific versions. Downgrade, and lock to, one of these versions. If you have paid for and signed a Microsoft ESU Agreement, but those updates are not installed on Windows 7 or Server 2008 R2 hosts, they fall into this category.I am looking at a couple of (Windows 10) machines here and RamMap shows very little transition memory on both machines.
On your Windows 7 machine, run Admin Tools, Resource Monitor.
Make sure the Memory Line is open.
Let resource monitor run for 15 minutes or so and then see what is taking the memory.
Try running SFC /SCANNOW from an admin command prompt and restart. See if that changes memory usage.
Remember Windows 7 is old, out of support and readily attacked and compromised. If you have a virus, you may need to back up an reinstall.
