irp non-paged pool leak

[Guest]

I'm running XP SP2, and experiencing a non-paged pool leak of about 150 MBs a
day. The pool will fill up after about 42 hours leading to a BSOD
(0x000000f4). Poolmon is indicating the tag IRP is allocating ~20 bytes
constantly and never freeing it. It's probably a driver, but I can't get any
closer than that to finding out which one. I also monitored the leak in safe
mode with no networking and it still leaks there. Could anyone perhaps help
narrow it down more?

 

[Guest]

Memory leaks are almost always the issue with a system that tries to run XP
forever with never rebooting.

 

[John John]

How do I determine a driver name from a pool tag?
http://www.jsifaq.com/SF/Tips/Tip.aspx?id=7102

You might also be able to identify the leaky driver with Drivers.exe, a
Windows 2000 Resource Kit utility, search for it on the Microsoft site.
Restart you machine and as soon as the machine is started take a
snapshot with Drivers.exe and redirect the output to an output file.
Then at given intervals resnap the drivers and append the output to the
file. By examining the results you might be able to find the culprit.
You don't need an excessive amount of snapshots, you should see a
pattern emerge with a few snapshots, if the pool is exhausted in about
42 hours then a snapshot at about every four hours should show the pool
leak pattern. You can use Task Scheduler to do the snaps, just have it
run a little batch file every x hours. The syntax for drivers.exe is
simple:

drivers.exe >>c:\leaky.txt

The second column (Code) is the Non Paged Pool usage. The output file
is easier to read and sort with Lotus or Microsoft Word or Excel.

John

 

[Guest]

unfortunately drivers.exe isn't showing anything that is using an abnormal
amount of memory, in addition, the total for the non-paged pool is well below
what poolmon is reporting. so whatever is taking it is not showing up.