80% memory utilization on server- is this just caching?

Question

Memory utilization is very high on this 2008 R2 server, but I think it might just be caching RAM- performance on the server is fine and CPU utilization is very low. It is running DFSR which I believe claims a lot of RAM.

So here is what I see in task manager:

Looking a the processes it doesn't look like it adds up to 3.25 gigs.

Here is what RamMap shows me:

I can see nonpaged pool is claiming a considerable chuck. This is RAM that is a program like DFSR is using for caching correct?

My pagefile.sys is 3.92 gigs if that info is at all helpful.

Do I have anything to worry about or is there something else I could check?

Solution

You have a kernel memory leak. The nonpaged pool is 2.5GB. You can use poolmon to see which driver is causing the high usage.

Install the Windows WDK, run poolmon, sort it via P after pool type so that non paged is on top and via B after bytes to see the tag which uses most memory.

Now look which pooltag uses most memory as shown here:

Now open a cmd prompt and run the findstr command to see which driver uses this tag:

Now look at the file properties, find the driver version and look for an update.

Comments

[Geoffrey McCosker]

It was already high before I ran RamMap of course.

[David Schwartz]

Is this a virtual machine or is this running on bare metal?

[Geoffrey McCosker]

Now that I think about it the server is supporting a bit more users than our other servers with identical configurations. I'll give procmon a go and see if I can identify the services on the server that's under heavier load. This is a DC and a file server supporting about 40 users.

[Geoffrey McCosker]

Followed this issue to find it was a bug in the OS exposed by anti-virus software: serverfault.com/questions/701324/tracking-down-a-memory-leak‌​/…