Troubleshoot high memory usage on a Windows instance

Updated at:

Follow this workflow to diagnose and resolve high memory usage on a Windows server caused by applications, system services, or misconfigurations.

Symptoms

The following symptoms indicate a potential memory bottleneck on your Windows server:

  • Business applications running on the Windows server respond slowly, experience service interruptions, or cause system-wide lag.

  • Memory usage for your instance is excessively high in the Simple Application Server console.

  • You receive an alert that memory usage has exceeded a configured threshold.

Troubleshooting workflow

  1. Assess status: Use Task Manager to review overall memory usage and determine if the system is under significant memory pressure.

  2. Process-level analysis: Use Resource Monitor to identify the processes that consume the most physical memory.

  3. Resolve the issue: Based on the analysis, implement the appropriate solution.

  4. Monitor continuously: After implementing the solution, configure ongoing monitoring and alerts to track the server's health.

Procedure

The following steps use Windows Server 2025 Datacenter Edition as an example. The user interface (UI) may differ in other versions.

Step 1: Assess the overall memory status

  1. Remotely connect to the Windows server.

  2. Right-click the taskbar and select Task Manager.

  3. Navigate to the Performance tab and select Memory.

  4. Analyze the key metrics:

    • Available: The amount of physical memory that the system can immediately allocate to applications.

    • Committed: The total amount of virtual memory that the operating system has allocated for all processes. This value is displayed as X/Y, where X is the virtual memory currently in use, and Y is the virtual memory limit (physical memory + paging file size). If X consistently approaches Y, the system is likely using the paging file frequently, which can degrade performance.

Step 2: Locate memory-intensive processes

First, use Resource Monitor to locate processes. If no abnormal application processes are found in Resource Monitor, use the RAMMap tool for analysis (RAMMap can view system-level memory usage).

Resource Monitor

  1. In the search box on the desktop taskbar, type Resource Monitor and open it.

  2. Navigate to the Memory tab.

  3. Click the Working Set (KB) column to sort processes by memory usage in descending order.

  4. Analyze the processes at the top of the list. Focus on the Working Set metric, which shows the physical memory a process is actively using and is the best indicator of its memory footprint. Identify the process with the highest Working Set and determine if it is an expected business process.

    • Working Set (KB): The amount of physical memory currently used by the process.

    • Commit (KB): The amount of virtual address space that the operating system has reserved for the process. This metric can be misleading, as a process might commit a large amount of memory but not actively use it.

    In this example, the Memory tab in Resource Monitor shows physical memory usage at 82%. In the process list, Testlimit64.exe (PID 3068) has a Working Set of approximately 3,083,868 KB (about 3 GB) and is the top physical memory consumer.

RAMMap

If Resource Monitor shows no abnormal processes but available memory remains consistently low, consider system-level memory usage, such as file caching or driver leaks. Use RAMMap for an in-depth analysis.

  1. Download and run RAMMap.

    1. Visit the official RAMMap download page to download and extract the tool.

    2. Double-click RAMMap.exe to run the program.

  2. In RAMMap, the Use Counts grid breaks down memory usage. Columns represent the state of pages in memory (Active, Standby, Modified, Transition, Zeroed, Free, Bad). Rows categorize memory by type (Process Private, Mapped File, Shareable, Page Table, Paged Pool, Nonpaged Pool, System PTE, Session Private, Metafile).

    • Use Counts: A summary of memory usage by type and state.

    • Processes: The working set size of each process.

    • Priority Summary: The size of standby lists, categorized by priority.

    • Physical Pages: Per-page usage for all physical memory.

    • Physical Ranges: Physical memory address ranges.

    • File Summary: A summary of file data in RAM, organized by file.

    • File Details: Individual physical pages used by files, organized by file.

Step 3: Apply solutions based on the scenario

Choose a solution based on the identified source of memory consumption.

Scenario 1: High memory usage by abnormal process

If a non-business-related or abnormally behaving process consumes excessive memory, terminate it.

In Task Manager or Resource Monitor, locate the memory-intensive process, right-click it, and select End Task. If you suspect the process is malicious, you can use the virus scan feature in Security Center.

The virus scan feature in Security Center is a paid service.
Important

Before ending a process, ensure you understand its function to avoid disrupting critical business services.

Scenario 2: Memory bottleneck from normal process

If a normal business process causes a memory bottleneck, consider upgrading the instance. In the console, upgrade the instance plan to a plan with more memory.

If a single business process consumes excessive memory, consider optimizing the process itself in addition to upgrading the instance plan.

Step 4: Monitor continuously

  • Set up alerts: Configure alert rules for the server's memory usage or available memory. For detailed instructions, see CloudMonitor.

  • Monitor continuously: Check the server's system metrics on the CloudMonitor dashboard.

    If monitoring shows occasional, brief memory spikes from a business process, you can configure a swap partition as a temporary mitigation. For detailed steps, see How to configure virtual memory for a Windows instance. For a permanent solution, consider upgrading the instance plan.

Related documentation

  • Use Microsoft's Process Explorer for more detailed information about process memory usage.

  • Use the Microsoft tool Poolmon to track kernel memory pool consumption by Pool Tag.