Skip to content

Instantly share code, notes, and snippets.

@mechalynx
Last active July 1, 2018 13:51
Show Gist options
  • Save mechalynx/ee2bffc8ef14889fe791531f529cbb54 to your computer and use it in GitHub Desktop.
Save mechalynx/ee2bffc8ef14889fe791531f529cbb54 to your computer and use it in GitHub Desktop.
Memory management

Memory management

When your PC runs out of space in real RAM it swaps out the parts of it that aren't being used much to the hard drive aka to "swap space". If this isn't done, either the process crashes or the OS crashes ("bluescreen").

Because HDD I/O operations have to be completed before code is allowed to continue (to preserve integrity, so you don't get race conditions) the OS will temporarily stop whatever is accessing that RAM. This is why programs go unresponsive or stutter when there's a lot of HDD activity related to them. In the case of swapping, this can cause other stuff to stutter and go unresponsive as well, since the memory being swapped may be theirs or they might be using the HDD.

When you're doing real-time stuff like games, you want to avoid swapping as much as possible obviously. This means making sure there is enough real RAM left for whatever you're doing. In order to ensure this, you need to end memory hog processes ahead of time.

For Windows, there's 2 easy ways to figure out what's consuming RAM and what's going on with it:

  1. you can use the Resource Monitor: Task Manager (Ctrl+Alt+Delete) -> Performance (Tab) -> Resource Monitor -> Memory (Tab)

  2. you can use Process Explorer: https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Process Explorer is distributed by Microsoft and it's legit. It's also friendly to anti-cheats so you don't need to worry about that. In any case, you can run it with regular user rights and run it through virustotal.com if you feel like it. I've used it on VAC-secured games, Blizzard games and all sorts of things and it's never caused problems. Keep in mind, there's Process Hacker which is a similar application, far more powerful (also legit), which has been known to trigger anti-cheats on occasion because it aggressively accesses process memory. But hey, if you somehow mess up and get that when I've given you the link to PE already, you got bigger problems than RAM usage :P

If you can't decide which to use, I recommend Process Explorer since it can give you real-time graphs in the system tray of memory usage, cpu usage etc. which come very much in handy when you're trying to figure out what's going on. Resource Monitor is useful to keep as a window because it's good at showing which files are being accessed and how active the hard drive is.

Some concepts

  • How much RAM you're using and how much is actually reserved for programs are different things, with the latter being either equal or more than used RAM. Total reserved memory is called "commit charge".

Example:

I have 4 GB of real RAM, 3.5 GB of which are being used, and a commit charge of 5.6 GB. That means, 2.1 GB of memory is reserved and is either virtual or on my hard drive, in swap space.
  • Memory pages have to be in real RAM before a process can release them. This is relevant because if you try to end a process and it has a handler for being killed, it will try to be polite and release RAM, which causes more swap because the OS has to put its stuff from swap space to RAM all over again, so the process can access them. If a process ends without getting a chance to release RAM (or if it doesn't care), the OS will release reserved memory wherever it is, even in swap space, directly. This is what usually happens if there's an exception and the process just ends abruptly.

  • Windows is garbage so it has all sorts of confusing, overlapping terms to refer to different types of reserved memory. In practice, it's simple though: big numbers are total reserved memory, small ones are what's in your real RAM. It's the latter we care to keep low, both if possible.

How to do it

By now it should be obvious what we're trying to do and how but I'll just go through some explanation just to make sure it's all clear. First we need to set up our monitoring tool(s) though. Use instructions relevant to whatever tool you've decided to use.

for Resource Monitor:

  • go to the Memory tab and right click on the column header to select the columns it'll show. Check all of them, there aren't all that many.

  • notice the graphs on the right side. The important ones are "Used Physical Memory" and "Commit Charge"

  • notice the bar below. What you can control is the green one that says "In Use". The rest you needn't be concerned with as it's managed by the OS and isn't relevant to us here.

  • check out the Disk tab if you want. It shows filesystem activity and it's useful even if you're using Process Explorer. If your PC is swapping, you'll notice pagefile.sys (Page File) being accessed, as well as a high percentage in "Highest Active Time". Keep in mind that Resource Monitor shows averages, so even though Write and Read speeds may not be zero in the rows, it doesn't mean the file is still being read or written to.

for Process Explorer:

  • right click on the column header to select columns, go to the Process Memory tab and select these:

    • Private Bytes
    • Peak Private Bytes
    • Working Set Size
    • WS Private Bytes
  • system tray graphs are optional but recommended. you can turn them on from the Options menu -> Tray icons. The ones relevant to this are Commit History and Physical Memory History. I/O History can help tell when the PC is swapping.

  • notice the graphs at the top, hover over them to see which is which. History graphs are useful because you can still see what happened a moment ago. It's important when you have to tab out or when a process is killed or when it's starting to use RAM.

From this point and on I'll avoid referring to the specific tool as you can see the same information on both. Just keep in mind that while Process Explorer lets you kill processes and process trees from the same window, Resource Monitor doesn't have this functionality and you'll have to use the Task Manager to kill processes, should that be necessary.


Take a look at how much RAM is in use by each process and note how much used and free RAM you have. At this point, you should try to find out how much free RAM you actually need. An example would be running Overwatch and starting a full game to make sure it has to load everything, then checking Overwatch's memory usage - it's the big number we're interested in, however much that is (in my case Overwatch uses 2.5-3 GB of RAM but I run on all low, so you'll need to test for your own case).

Knowing how much you need, sort the existing processes by each memory type if there's too many processes (though usually a casual inspection will reveal memory hogs), and see which ones seem to be using a lot. Every PC is different so you'll have to find out what the process is by either googling or guessing. Both tools have many ways to reveal more information when you're trying to identify what something is.

Things to look out for are:

  • Applications you're not using but are using a lot of RAM, in the hundreds of MB. Browsers fall under this category. Just close them. Firefox lets you start up with the same tabs as before and, to my knowledge, so does Chrome.

  • Drivers like AMD's ReLive and whatever Nvidia has (I think it's Shadowplay). Those tend to use a lot of RAM without actually doing anything, unless you're explicitly and consciously using them. Another good example is AMD's control panel, which is written in the stupidest way possible and somehow manages to use hundreds of MB just for a simple UI.

  • Don't bother with processes that are clearly related to whatever game or application you're using. For Overwatch, leave any Blizzard processes alone, for Steam leave any Steam processes alone.

  • Sometimes, if you're running for long enough, explorer.exe can end up using a lot of RAM due to indexing. Just close any Explorer windows that have huge amounts of files in them, especially if there's thumbnails.

  • Overlays. The Steam overlay normally doesn't use much RAM but you may want to turn it off. Other overlays can be avoided so do so if you feel you're not using them.

Chances are that if you haven't done this before, you'll see lots of weird things you don't recognize that'll make you worry. Don't worry, it's very unlikely there's bad stuff there, even if the names are stupid (because Microsoft loves naming things in ways that sound suspicious, thanks Microsoft, owe you one).


Some tips:

  • You don't strictly need to have 100% free RAM to run things sometimes. Chances are some stuff that's in RAM isn't being used much and the swapping process will move those to swap space first. It won't move them back unless they're used again, which is why you can end up having seemingly more free RAM after you run a memory hog and close it, as if it cleaned up your RAM or something. It didn't, it just pushed things out of RAM and into swap and they haven't been put back yet. This is a best-effort thing, not a matter of getting things perfectly ideal.

  • Alt-tabbing fullscreen applications causes memory churn, which can cause swapping. If you can, avoid alt-tabbing or run in a window. If you're using something like Discord, try using the overlay or mobile app instead of alt-tabbing. If you have a second screen, use it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment