What is the cause of a high CPU usage of 'system and compressed memory' in Windows 10?

Question

There is an observation to be made for Windows 10 on my laptop running with 24G memory available, and 2.5G used. There is no 'memory pressure'. Other questions have looked at memory consumption (which isn't the problem here). In all the related questions here and elsewhere, I havn't been able to find an adequate explanation to the issue of this exccessive cpu utilization over the last month or two after one of the Windows 10 updates.

I can accept that there is value in this service or process, but to run continually, and to use additional cpu resources, and as a consequence, use battery power less efficiently, that is the issue I am trying to resolve.

In some article on this site, it was suggested that I turn off SuperFetch, and set a registry entry for PrefetchParameters to 0. I did both and performed a reboot.

I reboot the machine, turn off screen saver, and start the task manager. After a few minutes, the service labeled as 'System and compressed memory' starts taking 5% of my cpu, consistently. My base cpu utilization is maybe 1%, which keeps the fan low. But when the 'system and compressed memory' service runs at the 5%, the fans ramp up. And just keeps running.

Sillyness. Why does that service need to be running consistently like that with no memory pressure? Any additional mechanisms I can try for turning it off or determining what it is actually doing? Are there logs file entries somewhere? Or an in-depth diagnostic tool?

how-to-disable-windows-10-memory-compression -- no real answers here

windows-10-system-process-taking-massive-amounts-of-ram

17993-windows-10-memory-compression

desktop-build-10525-and-windows-10-memory

www.techish.net/system-and-compressed-memory/

windows-10-build-1511-overheating-cpu-fan-always

Windows Performance Recorder - now need a link for info on how to interpret the info

scrub maintenance

Solution 1

Analyzing the ETL file with WPA shows, that the CPU usage doesn't come from system memory compression. It comes from ntoskrnl.exe!MiScrubMemoryWorker:

Line #, DPC/ISR, Process, Stack Tag, Stack, Count, TimeStamp (s), % Weight
8, , , ,    |    |    |- ntoskrnl.exe!MiScrubMemoryWorker, 79667, , 12,45
9, , , ,    |    |    |    ntoskrnl.exe!MiScrubNode, 79667, , 12,45
10, , , ,   |    |    |    ntoskrnl.exe!MiScrubNodeLargePages, 79667, , 12,45
11, , , ,   |    |    |    ntoskrnl.exe!MiScrubNodeLargePageList, 79667, , 12,45
12, , , ,   |    |    |    |- ntoskrnl.exe!MiScrubPage, 79663, , 12,45
13, , , ,   |    |    |    |    |- ntoskrnl.exe!RtlScrubMemory, 79653, , 12,45
14, , , ,   |    |    |    |    |    |- ntoskrnl.exe!RtlpGenericRandomPatternWorker, 38549, , 6,02

This is a function to test the memory for errors by filling / reading some patterns (ntoskrnl.exe!RtlpGenericRandomPatternWorker).

This is by design and happens when the idle maintenance task kicks up when your device is idle.

Solution 2

First, re. CPU usage: The "System and compressed memory" process (it's not a service) performs many functions. Just because you see it using CPU time does not mean it is doing work compressing memory contents. To find out, use Process Explorer to find the name(s) of the thread function(s) in the process that is (are) using CPU time. You'll need to configure symbols in Process Explorer to do this, as described in this answer.

The memory that is being compressed is memory that was

• part of the private working set of a process (i.e. shared with any other process); and
• modified while it was in that process; and
• subsequently lost from the process due to page replacement, and put on the Modified page list. (This algorithm has not been substantially changed for Windows 10. You're not getting any more page replacement then you used to.)

Now... if you don't have a pagefile, it will just stay on the modified page list (until the process ends). (Please note: Disabling your pagefile will not change the behavior so far described.)

If you do have a pagefile (which is, of course, highly recommended), the behavior differs between Windows 10 and prior versions.

• Prior to Windows 10, it would have soon been written to the pagefile and the physical pages would be moved to the Standby page list. This is done by a "modified page writer" thread in the System process.

• With Windows 10, it's first compressed (taking around half as much room as it used to) and stashed in the user mode address space of the System process (now called "System and compressed memory"). If necessary to free up memory it can then be written to the pagefile and released for other use. (Note that the benefits of space compression apply to pagefile space and I/O time too.)

So, really, this is a good thing. However much additional memory you see used by the System process, well, prior to Windows 10, about twice that much would have been on the modified page list or standby list. Certainly it will not take any more space than it used to.

You can (per my recent tests) disable this mechanism by getting rid of your pagefile, but this will not affect the page replacement behavior; modified private pages pushed out of processes will simply be ineligible from being freed for other use, and instead of being in the System process the memory (about twice as much of it) will just sit on the MPL.

Solution 3

I had a similar problem after recently upgrading to Windows 10. My mouse would all of a sudden start stalling, i.e. jerking as I moved it across the screen which made it very difficult to use.

I checked CPU usage in Task Manager and noted that the problem occurred when the "System and Compressed Memory" process started consuming from 5-15% of the CPU. I ran Process Explorer and checked the threads and like Raymond I noticed that the main culprit was CcWriteCopyWontFlush with an offset of 0xb50. A bit of Googling led me to this page. I tried installing the Windows symbols as some suggested here, but it never helped me resolve the offset.

The problem was also sporadic. I would work for a few hours and then it would start appearing for a few minutes, on and off, driving me crazy. Rebooting would cure it for a while and then it would return.

From the answers here I decided to hunt down the drivers on my PC, so I started with Device Manager and that's where I got my answer. When the problem occurred, my Device Manager window would constantly go blank and refresh, like every second or two. It was essentially unreadable. More Googling suggested an external USB device connecting and reconnecting. I tied it down to my Samsung phone which I charge from my PC every day via a cable connected to a USB port. I also use the PC and MyPhoneExplorer to sync up my phone with Outlook so I have a couple of drives mapped to my phone's internal and external RAM, using Samsung's drivers for the PC. I could see these drives appear and disappear frequently in Device Manager.

My phone is a Galaxy S2 and is about 4 years old and I've had connection issues on the microUSB port for well over a year. That may account for the sporadic nature of the problem, or it may be the crappy Samsung PC drivers for my phone. If it were just the cable I don't know why rebooting cures the problem for a while, so it's still a bit of a mystery, but at least I know the source and I can fix it.

Disconnecting my phone is the easiest way to solve the problem, and I'm about to ditch it anyway since it's so old. So I'm wondering if Raymond also had a Samsung device driver with similar software running on his PC. Raymond, if you're still checking in, let me know.

As I mentioned the cable has been crappy for a while, since well before the upgrade from Windows 7 to Windows 10, and the Samsung software has always been awful, but in Windows 7 the flakiness didn't affect my other operation of the PC. In Windows 10, it made the mouse so jerky, that it became close to unusable. I had an extremely hard time trying to land on a target, and I think the keyboard was also being affected too with key presses being missed. It's strange how these factors interrelate and I don't know what to suggest to Microsoft about improving Windows 10, but I now feel like Windows 10 is a bit "delicate". Use with caution.

Solution 4

It may be the "Killer Network Manager" software. If you uninstall it, the issue goes away, but so does network as it uninstalls the network adapter drivers as well. The good new is, there is a fix.

First, go to http://www.killernetworking.com/support/driver-downloads/item/killer-suite and download the new version, but do not install it yet. Just save it and know where the file is located.

Then, uninstall the current version through the control panel. You will have to restart the computer. Once the computer is back up, run the new software installer. The new version that was released January 2016, doesn't seem to have that same issue.

I think the old version of the software has a memory leak causing this issue.

Just a FYI, the "Killer Network Manager" software is part of Qualcomms Aethos Killer Wireless-AC / Wireless-N and wired E2200 / E2400 network cards. Without the software, you have no internet.

View more solutions

Comments

[Moab]

Yeah, I have never understood why Windows uses the pagefile when there is plenty of memory, disabling the pagefile may solve your issue, I would like to know.

[magicandre1981]

Possible duplicate of Windows 10, 'System' process taking massive amounts of RAM

[Jamie Hanrahan]

@Moab: The perception that Windows "uses the pagefile when there is plenty of memory" comes from a mistaken label on Windows XP's task manager - they labeled the graphs "PF usage" when it should have been "commit charge". If you user PerfMon to examine the actual pagefile usage you'll generally find it far smaller than expected.

[magicandre1981]

capture a trace of the CPU usage. Install the WPT from Win10 SDK: dev.windows.com/en-us/downloads/windows-10-sdk, run WPRUI.exe, select CPU, Disk, VirtualAlloc, ResidentSet and capture 1-2 minute of the SYSTEM usage and save it into a ETL file. Zip the ETL + the NGENPDB folder into a 7z/RAR file, upload the compressed file to OneDrive, create a share link and post the share link here

[Raymond Burkholder]

@magicandre1981: thank you for offering a possible methodology. The file can be found at oneunified.net/files/rpb.20160102.WPR.7z . If you see something, would you be able to post your methodology? I'm sure lots of other posts around could make use of the technique. ... again thanx.

[Mateen Ulhaq]

For me, it was a process restarting over and over. Prey was running/killing multiple times per second.

[Raymond Burkholder]

In process explorer, without debug symbols loaded, I do get something: ntoskrnl.exe!CcCopyWriteWontFlush+0xb50 Will more detail come out of it if I add symbols? There are 12 instances, with one claiming 12.5% cpu. It belongs to the system process.

[Daniel B]

@RaymondBurkholder You might get more information by looking at the threads’ stack.

[Raymond Burkholder]

@DanielB: yes, that was from the Threads tab in the pop up from looking at properties of the System process at PID 4 in Process Explorer. Clarification: the stack button doesn't show anything, but the Module button indicates it is from the file ntkmlmp.exe dated 2015-11-22. Which I think Is the approximate date this extra cpu thingy started.

[Daniel B]

That’s just the date a Windows update last affected this file. It’s a system component, after all.

[Jamie Hanrahan]

@RaymondBurkholder The "StartAddress" display without symbols configured is just not useful. When you see a symbol name (like "CcCopyWriteWontFlush") plus an offset ("+0xb50"), the symbol name is almost certainly wrong. What you want is e.g. ntoskrnl.exe!ExpWorkerThread, with no offset displayed. Oh...you will see offsets for modules for which MS doesn't supply symbols - almost always these are third-party drivers. They are displayed as moduleName+offset, like nvhda64v.sys+0x30ac. We can't get symbols for those, but the module name alone is often helpful in debugging cases.

[Raymond Burkholder]

From the other answer, I installed the Win 10 SDK and associated tools. In there, I think I saw debug stuff. In Process Explorer, there is a way to load debug symbols. It asks to browse to a directory. You wouldn't happen to know off hand which directory? Even with symbols loaded, not sure it would be helpful, but might be easy to try.

[Jamie Hanrahan]

The directory is where to find a file called dbghelp.dll. This dll provides code that helps ProcExp interpret the symbol file. This would be C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll , or ...\x86\dbghelp.dll if you're on a 32-bit system (the SDK always installs into \Program Files (x86), regardless). If you can't find it there, just search \Program Files (x86) for dbghelp.dll, and use the one in the path that includes x86 or x64 according to your CPU architecture.

[magicandre1981]

forget ProcessExplorer, this only shows the snapshot. WPR sums all calls up and here you see the real cause. Read my answer, your CPU usage has nothing to do with memory compression ;)

[Raymond Burkholder]

Thank you for that. That sheds some light on the activity. Now that you mention the word idle, two comments can be made. 1) The ETI file you evaluated was made while I was active on the console, and the cpu was around 10% to 15% for 'system and compressed memory', and finally ended. So I was able to capture some kind of activity. And you've evaluated it to idle maintenance. 2) in the next comment....

[Raymond Burkholder]

2) As I write this, 'system and compressed memory' is running at 0.1%. After I don't do anything for a while, 'system and compressed memory' will go to 5%. If I collect ETI from the time I stop doing anything, till the time (several minutes later) it goes to 5%, can the ETI file be evaluated at specific time frames to determine activity at that later time point? [because the 5% is at idle time, and when I move the mouse or touch the keyboard, the activity stops, so I can't catch it manually].

[Raymond Burkholder]

I might be able to answer my own question. Am watching the ETL with WPA link.

[Raymond Burkholder]

I was able to confirm that the same thing was happening at other times. Thank you for mentioning the tool! I am just going to let things run now for a while and see if it finally finishes.

[Raymond Burkholder]

For closure, on Win 10, I went to: Start->Control Panel->Administrative Tools->Task Scheduler Task Scheduler Library->Microsoft->Windows->MemoryDiagnostic There are two line items. Running of the task may be dependent upon log events. I'm not sure if they just have to exist, or if they trigger upon entry into the log. I disabled the RunFullMemoryDiagnosticEntry. I no longer see the 5% to 12% utilization after a few minutes delay. In the properties of the Task, on the settings tab, in may be possible to adjust things to not run very often. .... testing for another time.

[magicandre1981]

nice to hear that it solves your issue.

[Mokubai]

Without the driver you have no internet. You can get the driver without all the pointless guff and bloatware that the manufacturer thinks you need. The bottom of the page you linked gives you a driver-only download link of killernetworking.com/support/driver-downloads/standard-drive‌​rs

[zihotki]

To add to the comment, I had 2 tasks defined - RunFullMemoryDiagnostic and ProcessMemoryDiagnosticEvents, the most important is the second one. It had 4 triggers enabled - "Log: System, Source: Application Popup", "Log: Application, Source: Application Error" and two remaining. Disabling the 2 triggers solved my problem, issue was that some apps I'm developing write to Event Log errors and that causes memory checks. Two remaining triggers are completely system related so it's better to not to disable them

[magicandre1981]

ok a troll downvoted it. Yes, xperf/WPR/WPA is Level 500 expert stuff so not for you uneducated idiotic troll facepalm

[Legends]

@RaymondBurkholder Aaaaa how quiet it runs now. It ran with high cpu for a couple of years and cut down CPU lifetime by 30%, but not anymore. Every time I leave my laptop, my fan starts to rotate after being idle a couple of minutes Thanks!