Solved Which drivers are using RAM, and how much are they using?

[writhziden]

Since this is where the drivers experts are, I was thinking someone may have had some experience determining what drivers might be using a lot of RAM.

I am looking for a program to determine which of my drivers are using RAM and how much they are using. Does anyone know of any software that can do this? If not third party software, does anyone know how to use Windows utilities, logs, etc. to determine RAM usage for each driver or at least determine which driver might be using a lot of RAM?

 

[DavidE]

You can do a Google for "windows driver memory usage" and look through results...

here's a quote from one post i found:

Windows tracks device driver memory usage with pool tags. If you know what pool tags the driver in question passes to ExAllocatePoolWithTag, then you can track its memory usage using tools such as poolmon (from the Windows Driver Kit), PoolTag (from OSR), or WinDbg (or KD) (from the Debugging Tools for Windows).

hope this helps...

 

[writhziden]

I found that, as well. Unfortunately, the link is five years outdated.

I may still look into the software posted there (I have WinDbg for analyzing blue screen crashes, so I could see if I can get driver memory usage from it), but I was hoping for something simple. From the sounds of the posts in that link, that is not a likely option and I will have to learn to use WinDbg in a new way.

 

[NoN]

I found that, as well. Unfortunately, the link is five years outdated.

I may still look into the software posted there (I have WinDbg for analyzing blue screen crashes, so I could see if I can get driver memory usage from it), but I was hoping for something simple. From the sounds of the posts in that link, that is not a likely option and I will have to learn to use WinDbg in a new way.

Can't the Resource Monitor could helps you investigating...

 

[writhziden]

Unfortunately, the resource monitor is limited to applications and services and does not show what drivers are doing. I tried using the Kernel Debugger through WinDbg, but activating debug mode caused my system to freeze when Windows started. I ended up having to deactivate it. I'm hoping to find a tool to check driver memory usage that will not cause the system to crash...

 

[NoN]

Unfortunately, the resource monitor is limited to applications and services and does not show what drivers are doing. I tried using the Kernel Debugger through WinDbg, but activating debug mode caused my system to freeze when Windows started. I ended up having to deactivate it. I'm hoping to find a tool to check driver memory usage that will not cause the system to crash...

I found this thread.
Using Driver Verifier to identify issues with Drivers

 

[writhziden]

Thank you NoN. I work in crashes and debugging much of the time, so I am very familiar with Verifier. I may give it a go, but I highly doubt it will give the results I am looking for. Still, I will admit it has possibilities.

 

[NoN]

You're Welcome!

 

[writhziden]

That is odd. I have Verifier enabled, and it seems to have reduced the resources being used that were causing my system to hang... The system is no longer using most of the RAM to transfer files from a Macrium image. I am still waiting for a crash to occur due to Verifier.

Turns out if I open a command prompt and type verifier /query, it gives me the paged and non-paged usage in bytes. iaStor is using the majority of the memory if this is any indication. It would be nice if the drivers were doing their normal thing so I could be sure. I may try enabling only iaStor in Verifier and seeing if I get a different result.

 

[carwiz]

I use a small program from Nirsoft called Driver View. It lists the start address, end address and size but it's in hex. It shows just about everything you want to know about the drivers that are loaded including where they are (file name).

Download here: DriverView: Loaded Windows Drivers List
The download link is toward the bottom. The first is 32-bit, second is 64-bit and the third is for Win-NT.
There's no install--It's stand-alone. I just create a Desktop shortcut for it.

By the way, they have other pretty slick utilities.

Forgot to mention: You can click on a column to sort the list ascending or descending. Sort the list by size and it will show the "hogs".

 

[NoN]

That is odd. I have Verifier enabled, and it seems to have reduced the resources being used that were causing my system to hang... The system is no longer using most of the RAM to transfer files from a Macrium image. I am still waiting for a crash to occur due to Verifier.

Turns out if I open a command prompt and type verifier /query, it gives me the paged and non-paged usage in bytes. iaStor is using the majority of the memory if this is any indication. It would be nice if the drivers were doing their normal thing so I could be sure. I may try enabling only iaStor in Verifier and seeing if I get a different result.

Could be not only IaStor.sys...There's two others processes for Intel: IAStorIcon.exe & IAStorDataMgrSvc.exe that are running

 

[writhziden]

I use a small program from Nirsoft called Driver View. It lists the start address, end address and size but it's in hex. It shows just about everything you want to know about the drivers that are loaded including where they are (file name).

Download here: DriverView: Loaded Windows Drivers List
The download link is toward the bottom. The first is 32-bit, second is 64-bit and the third is for Win-NT.
There's no install--It's stand-alone. I just create a Desktop shortcut for it.

By the way, they have other pretty slick utilities.

Forgot to mention: You can click on a column to sort the list ascending or descending. Sort the list by size and it will show the "hogs".

Thinking this over, I think carwiz answered the question I posed for the thread with the software download through that link. I will mark this as solved.

I realize now that I asked the wrong question. NoN tried to answer it, and between DavidW7ncus, NoN, and carwiz, I have found the right direction. I may start another thread in the debugging and crashes thread at some point in the future with the correct question. I appreciate all the help.