I have a Windows 2012 R2 std. server with a memory leak. Something tells me that the leak started after we installed Symantic Endpoint protection 12.1.5 - but I am not sure. I tried to disable Symantic without any change to the memory leak.

Using RamMap I can see that The Nonpaged Pool grows ~1GB per day. Using Poolmon, I can see that the “file” tag is the cause of the memory leak in the nonpaged pool.

How do I debug this further? I seems like “file” is a generic tag used for unknown files? Or I cant really search for that?

Any suggestion would be greatly appreciated..


Update: Memory Leak

Memory Leak 2

  • Ouch... that really is the least helpful pool tag ever. – Ryan Ries Apr 8 '15 at 18:55

Use XPerf/Windows Performance Analyzer to record pool allocations.


  • Thanks, I am downloading XPerf/Windows Performance Analyzer right now. I hope that it can help me locate the sinner. – user2536967 Apr 8 '15 at 21:30
  • Ok, I got a little further now. I captured a dump of the file tag, and I can see that the process csrss.exe is causing the leak. For some reason I can’t load symbols in Windows Performance Analyzer, so I can’t get more information about what is causing this . (I can see that other people have the same problem, but unfortunately it don’t help to copy the .dlls manually like suggested here randomascii.wordpress.com/2012/10/04/…). – user2536967 Apr 9 '15 at 16:38
  • @user2536967 if you use Windows Server 2012 R2, you have to use the Windows 8.1 SDK/WPT, not an older version: msdn.microsoft.com/en-US/windows/desktop/bg162891 – magicandre1981 Apr 9 '15 at 17:14
  • @user2536967 does the new WPT work? Do you see stacks in the new captured ETL file? – magicandre1981 Apr 12 '15 at 17:19
  • no, I already used the newest version. I tried to install on my Windows 7 as well with same result. – user2536967 Apr 13 '15 at 18:49

Use perfmon to track which process has run-away pool allocations. I don't have a server to hand, but the counters are something like "process\memory\pool nonpaged" and "process\memory\paged".

Also, what is the role of the server? Do you have volume shadow copies enabled?

  • It’s a combined SQL 2014 and SCADA server (Proficy iFIX) We don’t have any disk configured for Volume Shadow Copies. – user2536967 Apr 8 '15 at 21:30
  • Cool - thanks. Be interested to hear which process has growing NPP allocations... should be easy to spot if your pool is growing this fast. I am surprised you're not seeing kernel lock-ups. – Simon Catlin Apr 8 '15 at 21:38
  • I have actually already tried to run “Process\Memory\Pool Nonpages(*)” overnight, and none of the services looked suspicious (increased in size) even though the total size increased (I can upload csv if you are interested). – user2536967 Apr 8 '15 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.