What's going on with my Pagefile?

This is a follow-up to our Processes consuming high amounts of virtual memory post from January.

Pagefile issues are something we deal with frequently on the Performance Team.  We have had several cases in the past few months of customers reporting pagefile.sys files exceeding their custom size Maximum Size value.  The most likely cause of the Pagefile growing beyond the configured setting is if the system's paging file requirements exceed the current setting and the virtual memory of the system is depleted.  In that case an application pop-up will occur (Event ID 26) and you will be notified that the virtual memory is depleted and Windows is increasing the size of the Paging file:

“Windows - Virtual Memory Minimum Too Low : Your system is low on virtual memory.  Windows is increasing the size of your virtual memory paging file.  During this process, memory requests for some applications may be denied.  For more information, see Help.”

Reasons for the depletion may vary,  but can usually be attributed to a process or group of processes that are allocating large amounts of virtual memory.  If you recall from our previous post on the /3GB switch each process gets up to 2gb of user-mode virtual memory by default (unless you’re using the /3GB switch).  So, if each process is consuming all of its virtual memory and the combination of physical and Pagefile size is insufficient to handle both virtual memory and kernel memory allocations, the system will need to increase the size of the Pagefile to compensate.

Ironically, the reports of pagefile growth reported recently are not caused by a process or processes consuming virtual memory.  The symptoms we have seen come from servers that have large amounts of physical memory (more than 4GB, typically 16GB or more). Immediately following a reboot the paging file grows beyond the Maximum Size value specified in the Custom Size option for Virtual memory paging file settings. In some cases the pagefile.sys would grow to 10-15GB and consume all of the remaining free space of the system drive.  In one case, the server had 20GB of RAM installed, and despite the Pagefile size being statically set to 4,096MB the file grew to over 13GB.  I suspect it might have kept growing - except that it ran out of free space on the drive! 

When this occurs there are no event IDs written nor errors displayed complaining about Virtual Memory depletion. When looking at Task Manager – Virtual Memory for processes or the Virtual Memory values in Perfmon we would not see any processes consuming virtual memory or any other indications as to what would cause the pagefile growth.

So how do you resolve this issue?  In the majority of cases we have seen lately, the culprit is actually outdated anti-virus software.  Updating the anti-virus software including its associated filter drivers resolved the issue.  To verify that anti-virus software is causing the problem you would need to disable the services and drivers associated with the anti-virus.  If the problem no longer occurred following a reboot, then you would need to contact your anti-virus manufacturer to get the latest supported updates.

We will be posting in the future regarding more general concepts surrounding pagefile sizing and tuning ...

- Aurthur Anderson