We have a production web server running Windows Server 2008 x64 with 8GB of RAM. After it was placed into production the app team noticed that "In Use" memory as identified by Windows Resource Monitor (and RAMMap) has been growing over time, despite the server not being under increased load. "In Use" memory even increases during non-business hours when the server isn't in use at all. Currently "In Use" memory totals approximately 4GB. However, if I look at the Memory tab of Resource Monitor and total up the Working Set of each process they're only using about 1GB total. We want to identify the source of the memory consumption growth so it can be fixed.
I've done a bunch of research online and came across RAMMap. It tells the same story, though in a bit more detail (see attached screen shot). RAMMap shows Active memory = 4,293,268kb. However, if I go to RAMMap's processes tab and total up the memory used by all the processes it's only about 1GB. So we have 3GB of RAM usage that is not accounted for. Comparing this server to the identical server in our dev/test environment (which doesn't have this problem) I note that the biggest difference in memory usage according to RAMMap is Active Page Pool memory. On the dev/test server it's only about 150MB but on the production server it's almost 2.5GB.
Doing some reading in Russinovich's excellent Windows Internals he states there are two sitations where memory can be used but won't be included in the working set:
* Address Windowing Extension (AWE)
* Large page memory
From RAMMap we can clearly see that AWE is using no memory whatsoever, so that isn't the smoking gun.
According to Technet (http://technet.microsoft.com/en-us/query/aa366720
) Large page memory will show up as part of the process private bytes, which I can also see from RAMMap and doesn't differ significantly from the working set (at least not enough to account for 3GB of missing memory!)
So at this point I'm stumped. Any help would be greatly appreciated!