Memory issue

Question

Memory issue

Hram Admin 270

Hello!

On one of my DCs available memory drops from 7GB to <3GB during 4-5 minutes after reboot:
4-2

At 20:01 = 7007MB
At 20:06 = 2822 MB

I have a script that continiously monitors processes and logs the ones with the most memory consumptions - and these don't change except for the first script run after the server's restart:
4-1

I don't see any process(s) that consumes so much memory and don't see any related errors in the log either so

What can I do to find the culprit process(s)?

Regards,
Michael

MotoX80 37,156 Reputation points

2025-08-08T16:53:04.3566667+00:00

I have a script that continiously monitors processes

Please share your script so that we can see what you are doing.

Have you looked at RAMMAP?

https://learn.microsoft.com/en-us/sysinternals/downloads/rammap
Hram Admin 270 Reputation points

2025-08-11T13:43:16.5333333+00:00

MotoX80, thank you for the link - I didn't know about RAMMAP, - will try it!

The script (this is the single script in fact - just two sections of it) is rather simple - I read counter values and put them in the txt file:s

---------------- Process memory ---------------------------------------------------------

...

$DataTemp = Get-Counter -Counter "\Process(*)\Working Set - Private"

$Data = $DataTemp.CounterSamples |Sort-Object -Property CookedValue -Descending| select -First 5| Select @{label="Process";expression={($.InstanceName)}}, @{label="Memory_Used";expression={($.CookedValue)}}

if ($Error.Count -gt 0 -or (!$Data)) {Write-Output "$Date - Failed to retrieve the value for the PROCESS Working Set - Private object. The error was $Error[0].Exception.Message" >> $SubFolderTemp\Log.txt}

Else {

foreach ($element in $Data) {

If ((-Not ($element.Process -Match '^_t') -and (-Not ($element.Process -Match 'idle')))) {

$text += " " + $element.Process + "t" + "t" + "t" + ([math]::Round(((($element.Memory_Used)/1024)/1024))) + "r"+"`n"

...

---------------- Available RAM ---------------------------------------------------------

...

$DataTemp = Get-Counter -Counter "\Memory\Available MBytes"

$Data = $DataTemp.CounterSamples | Select @{label="Available_MBytes";expression={($_.CookedValue)}}

if ($Error.Count -gt 0 -or (!$Data)) {Write-Output "$Date - Failed to retrieve the value for the MEMORY Available MBytes object." >> $SubFolderTemp\Log.txt}

Else {

foreach ($element in $Data) {

$text += " " + "t" + "t" + "t" + $element.Available_MBytes + "r"+"`n"

...

Speaking frankly I posted the screenshots of the script's txt-files just because they were at hand - the Task Manager was displaying exactly the same results so the problem is not with script - I just don't understand which process consumes almost all memory...

By the way, you've already helped me with this script when I was working on it back in 2020:
https://learn.microsoft.com/en-us/archive/msdn-technet-forums/79bb1aeb-7fa9-424e-8bf4-bdd27fb4c44a

Thank you once again :)
MotoX80 37,156 Reputation points

2025-08-11T20:05:37.69+00:00

I think that Rammap is going to be your best bet. That Just be aware that it uses a lot of memory itself.
Hram Admin 270 Reputation points

2025-08-12T19:44:53.1366667+00:00

Ok, thanks a lot!

Now the memory consumption is only ~3 of 8 GB, don't know why - the only thing I changed is the scheduled task (I changed "Repeat every hour" to 24 schedules).

3 answers

Your answer

MotoX80 37,156 Reputation points

2025-08-08T16:53:04.3566667+00:00

I have a script that continiously monitors processes

Please share your script so that we can see what you are doing.

Have you looked at RAMMAP?

https://learn.microsoft.com/en-us/sysinternals/downloads/rammap
MotoX80 37,156 Reputation points

2025-08-11T20:05:37.69+00:00

I think that Rammap is going to be your best bet. That Just be aware that it uses a lot of memory itself.
Hram Admin 270 Reputation points

2025-08-12T19:44:53.1366667+00:00

Ok, thanks a lot!

Now the memory consumption is only ~3 of 8 GB, don't know why - the only thing I changed is the scheduled task (I changed "Repeat every hour" to 24 schedules).

Answer 1

Hram Admin 270

P.S. Process Explorer didn't reveal anything new...

Answer 2

Geoff McKenzie 950

HI Hram Admin,

My guess would be LSASS is using as much available RAM as it wants/needs to load the DIT and service requests. As this is a Domain Controller, they like RAM.

https://learn.microsoft.com/en-us/windows-server/administration/performance-tuning/role/active-directory-server/memory-usage-considerations

Have a look in task manager and/or perfmon for memory counters for LSASS.

Regards,
Geoff

Answer 3

Hram Admin 270

Geoff McKenzie, thank you for the very interesting article!!!

In this case the Security.evtx file seems to be cause of the issue: for I'am using the scripts that read Security log, the used memory increases with the increase of Security.evtx.

MotoX80, thank you very much for the RAMMAP - it helped a lot!!!

Regards,
Michael Firsov

Share via

Memory issue

3 answers

Your answer