Recently ran into an issue when my PC with 16 Gbs of memory started using about 10Gb without any virtual machines running.
Task Manager and Process Explorer both showed decent consumption numbers that didn’t go out of norm, this got me curious, because about 5-6 Gbs were missing.
I remember another awesome sysinternals utility – RAMMap:
“Have you ever wondered exactly how Windows is assigning physical memory, how much file data is cached in RAM, or how much RAM is used by the kernel and device drivers? RAMMap makes answering those questions easy.”
I’ve been rather surprised by this and instantly remembered I had custom settings for the size and auditing for my windows security log. So turns out windows security log uses memory mapped file. Humanity prevails once again!