System running out of memory RRS feed

  • Question

  • I have deployed a Windows Embedded Standard 7 on a x64 machine. My answer file includes the File Based Write Filter and my system has 8GB RAM installed. I have excluded some working folders for a specific software and other than that no big change would happen in the system. I have set the overlay size of FBWF to be 1GB.

    Now my problem is that after the system works for some time, the amount of free memory starts to decline and after around 7-8 hours the available memory reaches a critical amount and the system is unusable and I have to reset the system manually. I have increased the size of the overlay to 2GB but this happens again.

     Is it possible that this problem is due to FBWF? If I set the overlay size to be 2GB the system should not touch any more than that 2GB so I would never run out of memory with 8GB installed RAM. am I right?
    Wednesday, February 11, 2015 12:33 PM

All replies

  • I was in a similar situation. In my case there was a scheduled tasks that periodically performs the Performance Assessment (WINSAT.EXE), and it's disk test filled up may RAM overlay.

    Wednesday, February 11, 2015 2:26 PM
  • You can use FBWFMGR.exe to see what is filling up memory - Fbwfmgr.exe /overlaydetail. .NET optimization (NGEN) runs in the background and files up memory with optimized libraries. / / Book Author - Pro Guide to WE8S, Pro Guide to WES 7, Pro Guide to POS for .NET

    Wednesday, February 11, 2015 4:34 PM
  • The server I'm talking about is in a remote location I will go and check it today but I want to have full knowledge before resolving the issue.

    My question is that  when I set the overlay size to be 2GB and my RAM is 8GB, how is that possible that my RAM will be filled entirely until it reaches a critical value?

    Thursday, February 12, 2015 5:56 AM
  • If we understood right: It's not the overlay only that get's filled up - you meant your ENTIRE system memory (in meaning of all of the 8GB) get's filled up? Does the problem only occour when UWF is actively protecting volume(s)? Assuming, that is the case:

    When looking at the predecessors of UWF - EWF and FBWF, the limit for overlay only applied to the FBWF. I made a quick test: UWF protects volume w/o any exclusions, overlay size is 512MB, than tried to exceed the overlay by copying huge files in Windows Explorer -> copy operation will be blocked.

    Assuming, the problem only occours when UWF is active, you may follow Jeans suggestion to find out what will fill up UWFs overlay. As per documentation, you should ensure following:

    • No page files in the protected volumes
    • Disable System Restore
    • Disable Prefetching
    • If possible move locations with massive write accesses to non-protected locations (e.g. the browser cache)

    • Edited by Willi K Thursday, February 12, 2015 8:55 AM Corrected assumption that UWF may exceed overlay when no exclusions defined
    Thursday, February 12, 2015 8:14 AM
  • First of all, I am grateful for your kind answers :)

    I am just back from the server location. What I saw was that the entire 8GB RAM was not filled up and almost half of it was shown as free in task manager, BUT windows was giving critical memory message and even running a simple lightweight program was impossible. I saw that a schedule.exe process (part of our custom software) was replicated more than a hundred times in the list of processes and I think that this was the source of the problem. The point is that this .exe file is located in an unprotected folder inside C: drive. 

    you pointed that "No Page Files in the protected volumes" is a requirement. How can I check this? I am not sure if I have met this requirement, but I don't know how to actually verify it.

    Thursday, February 12, 2015 12:17 PM
  • Willi - WES7 - Not WES8/WEI8.1 - No UWF / / Book Author - Pro Guide to WE8S, Pro Guide to WES 7, Pro Guide to POS for .NET

    Thursday, February 12, 2015 5:10 PM
  • If FBWF is disabled, do you see any issues?

    What creates the schedule.exe process to run? / / Book Author - Pro Guide to WE8S, Pro Guide to WES 7, Pro Guide to POS for .NET

    Thursday, February 12, 2015 5:13 PM
  • Oh, sorry, you're right - I messed this with something I'm corrently doing at my site.
    Friday, February 13, 2015 7:46 AM
  • You told about "unprotected folder" in C:, this lets me assume that you use the File Based Write Filter (FBWF). Regarding page file note this article. Follow this article to find out if your system uses page file via control panel.

    This setting is stored in the "PageFiles" registry entry in the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management key.

    You can initially try if your system works fine without having a page file, if not, try to move the page file to a non-protected partition. You may add page file to the FBFW's exclusion list, but I'm not sure if this is the right way.

    Friday, February 13, 2015 8:55 AM
  • Would you please take a look at my situation and give me a possible diagnosis:

    1- I have "File Based Write Filter" on Windows Embedded Standard 7 x64 SP1.

    2- The installed RAM is 8GB and size of overlay of FBWF is set to 2GB.

    3- When the system is giving the critical memory message the conditions are as follows:

    a) The consumed memory in task manager is somewhere around 4 to 4.5 GB out of 8GB

    b) A process schedule.exe (from our software) is running more than a hundred time and is consuming memory,

    but its .exe file is located inside an unprotected folder.

    c) executing fbwfmgr.exe /overlaydetail is reporting that only 135MB of overlay volume is full!

    Memory consumed by directory structure: 35.6 MB
    Memory consumed by file data: 135 MB

    d) The CPU usage is normal

    I don't know what exactly is full? Memory has free space, FBWF overlay volume has free space, then which memory is full?

    p.s.: I checked my answer file and paging file is disabled as required.

    • Edited by Paul_FA Saturday, February 14, 2015 7:18 AM
    Saturday, February 14, 2015 7:16 AM
  • I see. As suggested by Sean Liming, check out what happens if FBWF is disabled, but I don't think that FBWF is the problem. Set your focus on schedule.exe - find out what it does and why it get loaded so often.

    Saturday, February 14, 2015 12:14 PM