Have you ever had the situation where memory is disappearing and you don’t know where it is being used? Which program is using the memory, and is it paged out to disk or in RAM? That’s where RAMMAP comes in. It’s a great utility from the Sysinternals Team at Microsoft. Here’s an example of how I’ve used RAMMAP to diagnose things.
Below you see a system with 64GB of ram, of which most of it use being used up. If you used Task Manager you’d see that was the case, but not where it was going. You might see the processes listed and the RAM they are using but that only shows half the story. Running RAMMAP however shows that there is a type of memory usage called Mapped File and it’s using 21GB in total, of which 20GB is in the Active column – this means it’s actually in physical RAM.
If you then move to the File Summary tab, and sort it based on the Total column, you will see that the Windows.edb associated with the Windows Search service is using a fair chunk of that memory and most of it is in the Active column.
What happens then if we restart the Windows Search Services?
Well – after restarting the Windows Search service, and doing a refresh on RAMMAP, we see that the Mapped File setion shows that 19GB is now being pulled from the Standby memory instead of active. Also – the amount of total Active memory has dropped to 44GB (or so)
Correspondingly the windows.edb is showing the results on the File Summary tab too. Now this does not fix the particular issue with Windows Search, but I’m using this more as an example of what you can do overall with this utility and situations where I’ve used it myself.
Where can I download RAMMAP?
Direct from Microsoft here
Hope this helps you as much as it has me over time!
Thanks wayne