How to detect a kernel-mode memory leak in Windows kernel drivers with Application and Change Control

技術的な記事 ID: KB85956
最終更新: 1/15/2020

環境

McAfee Application and Change Control (MACC) 7.x, 6.x
Microsoft Windows (all supported versions)

概要

The information in this article is useful when troubleshooting third-party paged pool and non-paged pool tags within Windows drivers identified as a potential memory leak source. The pool tags are identified using tools such as PoolMon, Debugging Tools for Windows, and pooltag.

Using the PoolMon utility to find a memory leak:

(Windows 2000/XP only) On Windows 2000 and Windows XP, you must first use GFlags to enable pool tagging. On later versions of Windows, pool tagging is always enabled. GFlags is included in Debugging Tools for Windows. Start GFlags, click the System Registry tab, select Enable Pool Tagging, and then click Apply. You must restart Windows for this setting to take effect. For more details, see https://msdn.microsoft.com/en-us/library/windows/hardware/ff549557%28v=vs.85%29.aspx.
Start PoolMon.
Choose the kind of pool to include:
- If you have determined that the leak is occurring in non-paged pool, press P once.
- If you have determined that the leak is occurring in paged pool, press P twice.
- If you do not know, do not press P and both kinds of pool are included.
Press B and sort the display by maximum byte use.
Start your test.
Take a screenshot and copy it to Notepad. Create one every 30 minutes. By comparing screenshots, determine which tag's bytes are increasing.

Using the WinDbg (Debugging Tools for Windows) utility to find a memory leak:

Download and install the Debugging Tools for Windows.
(Windows 2000/XP only) On Windows 2000 and Windows XP, you must first use GFlags to enable pool tagging. On later versions of Windows, pool tagging is always enabled. GFlags is included in Debugging Tools for Windows. Start GFlags, click the System Registry tab, select Enable Pool Tagging, and then click Apply. You must restart Windows for this setting to take effect. For more details, see https://msdn.microsoft.com/en-us/library/windows/hardware/ff549557%28v=vs.85%29.aspx.
Configure the system to generate a complete memory dump. For instructions to create a memory dump, see KB56023.
Wait for the low memory symptoms to occur: System unresponsive, applications failing or stuck, or Task Manager showing high kernel memory (paged or non-paged) use.
Crash the system manually to generate a complete memory dump. For instructions to force a system crash, see KB85853.
Submit the dump file to Technical Support for analysis.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

影響を受ける製品

Application and Change Control 7.0.x
Application and Change Control 6.5.x
Application and Change Control 6.2.x
Application and Change Control 6.1
Diagnostic Data Collection

言語:

この記事は、次の言語で表示可能です:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

How to detect a kernel-mode memory leak in Windows kernel drivers with Application and Change Control

環境

概要

関連情報

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

How to detect a kernel-mode memory leak in Windows kernel drivers with Application and Change Control

環境

概要

関連情報

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title