Windows Server 2012 High Memory Usage

memorymemory usagewindows-server-2012

Within the last couple weeks, I noticed Windows Server 2012 is using all available memory. Usually this server sits at around 6.5-7GB (of 8) and will occasionally reach 7.5GB but drops back down fairly quick. For about the last 1-2 weeks, it's been consistently maxing out memory. It started after a restart (had been on about 14-21 days) and some updates were installed.

Compressed RMP from RAMMap: https://files.pceasies.com/SERVER.7z

Process Explorer screenshot: https://files.pceasies.com/memory_usage.jpg

Not sure anything cut off from the screen cap is useful since I've tried closing running programs and that doesn't help. Driver locked at ~2.5GB is Hyper-V VMs. It seems to be related to the working set of System (the kernel?) being so high, but beyond that I'm not sure.

Let me know what else would be helpful.

Best Answer

I think the issue was related to VSS (Volume Shadow Services).

After some poking around with

  • Process Explorer
  • Process Monitor
  • Task Manager
  • Resource Monitor
  • poolmon
  • handles
  • Event Viewer
  • vssadmin (was taking a long time to list info and failing on some commands)

I saw VSS pop up in a couple different places. There were quite a few error log entries regarding VSS that appeared to stem from parts of Acronis leftover. I used the cleanup tools from their website and manually removed a couple leftover registry keys. In addition, there were some old, manual scheduled jobs setup to create shadow copies that were no longer needed. It appeared these jobs were trying to run too frequently and weren't able to complete. I suspect moving a lot of files around and being off for an extended period of time created a lot of work for VSS to do and it wasn't able to finish. Then the tasks to create new shadow copies would queue up on top of it encountering errors (possibly related to Acronis leftovers).

Since I've cleaned up that and removed unnecessary scheduled tasks, it appears to have stabilized again and is running as expected.