GodfreyTim-4410 avatar image
0 Votes"
GodfreyTim-4410 asked cooldadtx commented

How to interpret the Virtual Size values in PSLIST and Process Explorer

On a Windows 10 system, Process Explorer and PSlist64 report over 100 processes with Virtual Size over 2151700000 K (2 petabytes, each or > 200 petabytes total). Then there is a break in size (when sorted in descending VM size), and the VM values continue with values like 50,000,000 K (50 TB).

Are these 2 Petabyte values accurate and realistic? Maybe in a 64 bit environment, this is not impossible, but it seems odd.
I observe that all the values seem to be of the form 2^31 + X where X is a value that could be considered a "reasonable value" of a few GB. Is it possible there is some type of high bit "tag" of 0x80000000 on some, which is not accounted for in the display of VM values?

I'm trying to diagnose a progressive "resource exhaustion" situation, where Windows eventually starts filling the log with Event ID 2004 "Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: OUTLOOK.EXE (7376) consumed 655523840 bytes, WavesSvc64.exe (13124) consumed 513835008 bytes, and streem.exe (12428) consumed 481574912 bytes." Concurrently, the Physical Memory use reported by t ProcExp and Resource Monitor goes above 95%. This causes system instability and failure. After rebooting the physical memory used is about 30% (12 G of 32G installed) which slowly starts to grow again over a day or two.

While 655 GB of virtual memory for Outlook is huge, these numbers are far smaller than the VM values reported in PSLIST and ProcExp for processes such as svchost.exe, msedgewebview2.exe, and Teams.exe which are in the petabyte range as described above.

Does anyone have any information on how Virtual Memory values in Sysinternal tools are interpreted?


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Castorix31 avatar image
0 Votes"
Castorix31 answered GodfreyTim-4410 commented

It is 2TB, not Petabytes (you can check with Process Hacker)

Those 2TB are explained at How Control Flow Guard Drastically Caused Windows 8.1 Address Space and Behavior Changes

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks for the link - that is very helpful and explains the 2 TB values. It is surprising this goes back to changes made in Windows 8.1.

0 Votes 0 ·
cooldadtx avatar image
0 Votes"
cooldadtx answered cooldadtx commented

Virtual size isn't really useful. From way back in 2010 this column just shows the virtual memory address space so it represents what is available, not what is being used. Here's the docs.

The working set shows how much memory is actively being used (in physical memory). It is discussed here. If you are running out of physical memory then working set is where you want to look. It is one of the columns that I have in my PE view.

If you have a memory leak in your app then working set will go up as will private bytes. Private bytes is how much memory the process has asked for but not necessarily being used. For example if a process (or the language runtime) requests 1MB then private bytes goes up by 1MB. However, at least in the case of language runtimes, the process may then use that allocated memory to create smaller objects. If you are leaking memory then this will grow over time.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

II agree that VM space shouldn't matter as long as the memory management and paging is working properly. However the Event ID 2004 message "Windows successfully diagnosed a low virtual memory condition...." specifically says virtual memory. Is it a different type of virtual memory that is becoming low?
This issue can and does bring down the system.
ProcExp shows numbers like "749,096 K" in Private Bytes.

0 Votes 0 ·
cooldadtx avatar image cooldadtx GodfreyTim-4410 ·

Yes virtual machine means different things. Even in Windows it is inconsistent. Depends on whether you're including committed, paged, etc. It's complicated. Some people try to compare PE to Task Manager and find different results because they are using different sets of data.

If you are running out of VM then that means your working set and/or private bytes is exceeding the limits of physical memory + paging file.

A private bytes of 749,000K is 750MB which is pretty big but it depends on what the app is doing. If you have a lot of them then that could be an issue.

0 Votes 0 ·