Windows 10: explorer.exe uses all virtual memory, Resource-Exhaustion Detector

Had this problems twice, with no clue what the cause is.
It has happened when writing to a HDD so i guess it's that process that goes awry.
The two were very different and a long while between each other (weeks probably).

No clue what the reason is, was thinking it might be my overclock, but it's hard to identify as it's so rare and random.

:)

 

Windows 10 Pro - Unaccounted System Commit Charge - Resource Exhaustion

After idling overnight (I do not use/auto sleep or hibernate; only the display auto turns off after locking), my fully up-to-date Windows 10 Pro computer will fail to turn on the display upon mouse or keyboard activity the next day. Instead, the computer
crashes and reboots. The Event Viewer shows many Error events related to low virtual memory, and Event 2004 "Resource-Exhaustion-Detector" is logged every 5 minutes for hours.

Event 2004 "Resource-Exhaustion-Detector" General

Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: sqlservr.exe (3020) consumed 343736320 bytes, svchost.exe (7036) consumed 133574656 bytes, and MsMpEng.exe (2688) consumed 110944256 bytes.

Event 2004 "Resource-Exhaustion-Detector" Details (SystemInfo only because that is where my question lies)

<SystemInfo>


<SystemCommitLimit>49033330688</SystemCommitLimit>


<SystemCommitCharge>49031442432</SystemCommitCharge>


<ProcessCommitCharge>1374498816</ProcessCommitCharge>


<PagedPoolUsage>446369792</PagedPoolUsage>


<PhysicalMemorySize>17100132352</PhysicalMemorySize>


<PhysicalMemoryUsage>11527102464</PhysicalMemoryUsage>


<NonPagedPoolUsage>605999104</NonPagedPoolUsage>


<Processes>73</Processes>

</SystemInfo>

My breakdown of the above:

SystemCommitLimit = 49,033,330,688 = approx 48 GB = 16 GB RAM + 32 GB Pagefile

SystemCommitCharge = 49,031,442,432 = approx 48 GB

ProcessCommitCharge = 1,374,498,816 = approx 1.4 GB

PagedPoolUsage = 446,369,792 = approx 0.5 GB

NonPagedPoolUsage = 605,999,104 = approx 0.6 GB

If the SystemCommitCharge = 48 GB yet all processes and drivers combined have committed less than 3 GB, what has committed the other 45 GB that is causing my computer to crash?

All information that I can find regarding debugging this Event assumes that a process (ProcessCommitCharge) or a driver (PagedPoolUsage/NonPagedPoolUsage) is leaking the memory. In my case, I have no idea where to start debugging this memory leak.

 

windows 10 low memory problem continues

Jay

Log Name: System

Source: Microsoft-Windows-Resource-Exhaustion-Detector

Date: 18/06/2016 09:29:50

Event ID: 2004

Level: Warning

Description:

Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory:
iexplore.exe (5200) consumed 1,204,473,856 bytes,
iCloudServices.exe (7508) consumed 202,129,408 bytes, and
MsMpEng.exe (2400) consumed 137,383,936 bytes.

.com/Windows/Resource/Exhaustion/Detector/Events">

<SystemInfo>

<SystemCommitLimit>38,544,506,880</SystemCommitLimit>

<SystemCommitCharge>38,484,594,688</SystemCommitCharge>

<ProcessCommitCharge>2,628,644,864</ProcessCommitCharge>

<PagedPoolUsage>405622784</PagedPoolUsage>

<PhysicalMemorySize>12,774,703,104</PhysicalMemorySize>

<PhysicalMemoryUsage>3,724,541,952</PhysicalMemoryUsage>

<NonPagedPoolUsage>181,637,120</NonPagedPoolUsage>

iexplore.exe and MsMpEng.exe feature in all reports!

Similar reports keep recurring as demonstrated below:

Warning 18/06/2016 09:29:50
Resource-Exhaustion-Detector 2004

Warning 17/06/2016 18:49:55
Resource-Exhaustion-Detector 2004

Warning 17/06/2016 01:10:18
Resource-Exhaustion-Detector 2004

Warning 17/06/2016 01:05:18
Resource-Exhaustion-Detector 2004

Warning 17/06/2016 01:00:18
Resource-Exhaustion-Detector 2004

Warning 16/06/2016 21:22:21
Resource-Exhaustion-Detector 2004

Warning 16/06/2016 04:35:38
Resource-Exhaustion-Detector 2004

Warning 16/06/2016 01:55:10
Resource-Exhaustion-Detector 2004

Warning 16/06/2016 01:17:39
Resource-Exhaustion-Detector 2004

Warning 15/06/2016 21:25:27
Resource-Exhaustion-Detector 2004

Restarting your computer will clear the problem but the problem appears to build up again quickly. You will be able to see this in Resource Monitor.

In Windows 10 use the keyboard shortcut Ctrl+Shift+Esc, it gets you to Task Manager quicker. Select the Performance tab
1 , open Resource Monitor
(bottom of window) 3 , and Memory tab
5
(in second image). What are the figures for Hardware Reserved, In Use, Modified, Standby and Free
6 ?









Your Resource Monitor image will demonstrate the problem I have in mind. Your system is holding on to Standby memory and not releasing it to
Free memory. You can force release by restarting your computer but often this is not very convenient. Another way to force the release of Standby memory is available using RAM Map (freeware from Microsoft):

RAMMap - Windows Sysinternals

Download and install, and create a shortcut on your Desktop to RAMMap and / or pin to your Taskbar. When you sense the system is becoming unresponsive use Ctrl+Shift+Esc to access Task Manager. Click the Performance tab and the
Resource Monitor button. Click the Memory tab and check whether Free is near to Zero or is Zero. If it is, open RAMMap, click Empty on the Menu bar and Empty Standby list. This action instantly restores Free memory.

The procedure using RAMMap is an effective workaround but the true solution lies in discovering the source of the problem. Knowing the source you may be able to resolve the problem by contacting the provider of the software and / or updating
the software.

The solution lies in identifying the software that is accessing numerous files, either to check for malware or to index to facilitate Windows Search. If you discover which files are being unnecessarily accessed you can exclude them from routine
scans. The first image below illustrates the problem. The second image identifies the folders/ files. In the example Microsoft Security Essentials has been scanning my G drive, which I have since excluded from future scans.

Investigating what makes up the Standby figure may not be easy. How I found out what was the cause on this computer was achieved by following the procedure detailed below.

Open RAMMap when your Standby figure is too high and click the File Summary tab. Click the
Standby column header to sort the figures as in the image below to determine the
really large files held in Standby, see the image below. If you click the
Path header you can sort and see what partitions are being accessed. It is important to remember that these files have been accessed since the computer was booted. You then ask yourself what programme might have accessed
the file and did it really need to? Programmes having scheduled scans are good potential candidates.

In my case I found a very large download of Windows 7 that I had used for a Repair Install I had not removed after use. I also found a large number of files on a non-system partition relating to back up copies created by Windows BackUp. I decided
to see if these were being regularly scanned by Microsoft Security Essentials and excluded them from scans. You should also check whether you are Indexing more than you need as this will increase the impact of running Windows Search.

Please select the keyboard shortcut Win+R, type
msconfig and press the ENTER key. Click the Startup tab and
Open Task Manager. Click the Startup impact header so that the High items appear at the top of the list. Please provide the details of each line where the Startup impact is described as
High 2 .





Log Name: System

Source: Service Control Manager

Date: 17/06/2016 17:48:42

Event ID: 7001

Level: Error

Description:

The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error:

The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

To resolve this error select the keyboard shortcut Win+S, type
Services, click View local services in the drop down list and press the
ENTER key. Locate Net.Tcp Port Sharing Service in the list. Check that it has started and that the StartUp type is
Automatic. If it is not set to Automatic right click and select Properties, General tab. There is a box after StartUp type. The options are available on a drop down by clicking on the arrow down to the right of the box. Make the change and
click on Apply and OK. Restart the computer and check whether it has started.

 

Happened again, this time i was playing a game;(

 

What hard drive(s) are you using?

 

These, however i am starting to think it might be my overclock still, even though it should be stable,
have had some very weird issues i can't always reproduce, like Audio Glitches etc, but no BSOD, so frustrating;(

 

On what drive is the page file?

If you think it is due to overclocking, I would remove the overclocking.

 

It's automatic, but on the SSD (C: ) drive.

Problem is i can't reproduce the issue so it's so hard to confirm it's the overclock,
my stress testing all seems fine (Prime95 Blend, 12hour 7000mb (out of 8gb)).
It's such a weird issue as well, i mean why does Explorer eat all virtual memory, why not any other application.

EDIT:

Trying to get DISM restorehealth thingy to work, but no matter how i do it i doesn't detect the source.
Tried both esd and wim versions;(

 

What is the exact command you use for restorehealth?

 

That one, with F being my drive.
Also tried replacing wim with esd on the esd version.

 

There are a few ways to resolve the restorehealth problem, but what files are corrupted exactly?

 

I don't know if anything is corrupt or not, just that sfc /scannow fails, but i don't know if that is the cause of my problems.

 

What does DISM /Online /Cleanup-image /Scanhealth show?

 

This.

 

It is a bit of what I expected, but I'm not sure if this problem is due to your installed version (Windows 10240).
Please try Repair Install Windows 10 with an In-place Upgrade - Windows 10 Forums