Hello Comodo!
I am happy user of CIS for many years, but now, I was rather shocked. I left my computer running for 14+ days and found out this (see the picture).
How is this possible? I think it should not ever need this much RAM and if so, why didn’t CIS returned reserved RAM after usage? Just to be clear, first number is process ID (irrelevant), second number is private RAM (reserved I guess), third is used RAM and screenshot was taken from procexp by sysinternals. Thanks
RAM usage can be hard to understand sometimes, but remember that no program can execute until the program’s instructions (at least the next few) and the data on which those instructions operate is in RAM. Your CPU(s) can only directly access and operate on instructions and data that is in RAM. It’s thus essential for performance reasons that as much of all your programs code and data is loaded into RAM, in addition you want all your RAM to be used - you’ve paid for it after all!
What you don’t want to do is run out of RAM, so Windows (like all operating systems) has a lot of memory management code that is designed to ensure that only active programs have their code and data stored in RAM, the code and data for inactive programs is paged out to your pagefile. If those code and data pages are needed again Windows will allocate spare RAM and page them back in.
What this all means is that from a performance point of view (and also form a cost point of view) you want RAM to be as full as it possibly can be, and you want your active programs (like CIS) to be using as much RAM as they can get their hands on. What you don’t want is to be running out of RAM.
How do you know when you’re running out? Because the system will then page in excessively. In Resource Monitor you’ll see the Hard Page Fault rate listed both globally and for each process. If the Hard Page Fault rate is consistently low (less than about 5 pages/s) then you have a normally operating system with no major RAM issues. If the Hard Page Fault rate is consistently higher than this then you need a RAM upgrade. If the Hard Page Fault rate is consistently zero (as it is on my PC) then you have more RAM than you really need.
I’d advise you therefore to take a look at your Hard Page Fault rate, and if it’s low or zero then I’d stop worrying. What you’re seeing is the normal operation of a program taking as much RAM as it can.
BTW these RAM usage figures don’t actually reflect how much RAM is actually being used by a program. Windows memory management is very sophisticated and it asks programs to pre-order RAM before they need to use it, Windows then commits this RAM to the program (and it reports as RAM used) but if Windows needs that RAM in a hurry, and as long as the program hasn’t yet written to it, Windows can steal it back.
Well, I don’t think so. Swapping is almost always a bad thing (maybe aside using pagefile as place to store RAM contents when turning sleep mode on in older Windows) and I want to have as much RAM as I need in peak load I can produce on my computer (probably playing some new game or running virtual computer inside my host system) so my computer won’t ever be slowed by swapping (let’s face it, Windows swapping is not the brightest thing in the world).
I have 6GB RAM installed and because I don’t ever need more, so I have disabled swapping (I have no reason at all to allow it, because I should never need it). Logical solution would be that OS would take reserved RAM away from CIS and give it to other processes which are in need of it, but it did not happen. I got error stating that programs will crash if I won’t free some space in RAM. Probably when time would come CIS would be one to be killed because it took 2/3 of my RAM at the time, but that’s not my point.
You haven’t answered my question though. I asked, why would CIS EVER want to pre-order (using your terminology) 4,5 GB RAM memory, more so when it only needs 18MB at the moment (I would get 200MB, reserve for important programs is not a bad thing, but 4,5GB is way too much). I would really love to know, what in the world CIS did with it. Even updating took most 450MB of my RAM and it was then freed.
I see “not-freeing” pre-ordered RAM when program don’t need it as serious bug. Probably some mistake in memory management (someone forgot to call free()
If it was set then I would have suggested to turn it off because that setting makes it so more resources are dedicated to CIS. Do you have viruscope enabled that might be the reason as viruscope keeps track of all actions/activities of every running process. As for which memory types to look at, you should focus on Working Set and Working Set Private in addition to Private bytes. Also Peak Private bytes will show the maximum private bytes a process has used and the same for Peak Working Set will show the highest amount of Working Set memory that the process has used. You can see this information by double-clicking on the cmdagent process in process explorer and clicking on the performance tab in the process properties window.
Swapping and paging are two very different things, but since you seem not to be interested in understanding memory management I’ll not expand further. For the record though, Windows memory management is actually very effective and efficient.
you may be right, there might be a memory leak in CIS, it’s strange that nobody else has noticed it though.
You haven’t told me what your Hard Page Fault rate is, that is the only measure of RAM usage that has any real meaning.
Yes, I have viruscope enabled, but since I haven’t tinkered with default settings, I have also option “Monitor sandboxed applications only” enabled, so I think it should have no impact on rest of the system (I rarely sandbox apps).
Well, information I provided consisted of private bytes (4,5GB) and working set (18MB) - those are two default columns regarding RAM usage in procexp. Sorry for not stating that. Peak Private bytes is nice tip, thanks for it. I feel from my observations though, that working set is often irrelevant, as processes like to amass large amounts of private bytes, which they won’t “return” after they don’t need them anymore. So as a result, RAM is often “filled” just by reserved space, not really used one.
Well, it’s not really my thing, but i found this: Swapping - Wikipedia and it seems they aren’t that different.
I was also shocked nobody have had this issue before, but there probably aren’t many people which let their PC run for straight 14+ days, so I might have knocked on never before tested use case.
futuretech: In my case, Private Bytes increase wasn’t noticeable, I was away from my PC for 14+ days. When I noticed, hardly anything changed at all. But I sent away about 100GB of data during that period.
Using administrator privilegies, I was able to kill and then manually start cmdagent.exe again, diagnostic hasn’t shown any problems after. It sits on about 450MB Private Bytes with peak at 492MB.
What would you require to look into it? I mean, it was probably separate incident, but if it should happen again, what should I do to get you more intel?
