[ntp:questions] Ntpq.exe memory issue with windows 2019

David Woolley david at ex.djwhome.demon.invalid
Wed Oct 21 20:45:45 UTC 2020

On 21/10/2020 15:44, Sadique Urf Arbaz Sayyed wrote:
>   The process will hold the 24Kb but actually the process is not visible in Task manager or anywhere but in RamMap we see that the executed process still occupied the Page table memory.

Did you mean 24KB, or is that really 3KB?

Any memory leakage that persists after the process is no longer visible 
in the process table is down to the OS.

As already pointed out page table allocations are unlikely to be what 
that memory is.

I'm not familiar with the details of Window NT family memory use 
reporting, but the only legitimate carry over would be for cached pages. 
  Such pages are optimisations and don't deny memory to other processes.

Both Linux and Windows try and allocate nearly all their memory to 
something.  In the case of the Linux "free" command, it computes an 
available figure which is much larger than the free figure, by including 
memory that can safely be discarded.  If there isn't an OS bug, I wonder 
if you are seeing that effect.

One wild thought: is ntpq or one of its DLLs not position independent 
code?  I could speculate as to why Windows might keep relocated pages 
around in case the code is reloaded at the same address before the page 
gets reused for other reasons.  However, I don't actually know if 
Windows does something like that.

More information about the questions mailing list