Question

We have a .NET service using ~30MB of memory at startup. (VM ~= Mem usage)
I wanted to dump the process and find out what is holding those 30MB.

The CDB debugger generating the mini-dump increased mem usage by 100MB.
From the dump I could see those 100MB were image memory (DLLs)

-------------------- Usage SUMMARY --------------------------
    TotSize (      KB)   Pct(Tots) Pct(Busy)   Usage
    2d07000 (   46108) : 02.20%    28.45%    : RegionUsageIsVAD
   761ac000 ( 1935024) : 92.27%    00.00%    : RegionUsageFree
    64b0000 (  103104) : 04.92%    63.62%    : RegionUsageImage
     900000 (    9216) : 00.44%    05.69%    : RegionUsageStack
       9000 (      36) : 00.00%    00.02%    : RegionUsageTeb
     380000 (    3584) : 00.17%    02.21%    : RegionUsageHeap
          0 (       0) : 00.00%    00.00%    : RegionUsagePageHeap
       1000 (       4) : 00.00%    00.00%    : RegionUsagePeb
       1000 (       4) : 00.00%    00.00%    : RegionUsageProcessParametrs
       2000 (       8) : 00.00%    00.00%    : RegionUsageEnvironmentBlock
       Tot: 7fff0000 (2097088 KB) Busy: 09e44000 (162064 KB)

The mem usage is left high, long after the debugger detached.
I want to know what is casing this image load / memory raise?

Thanks.

Answer 1

“Typically, unused pages are not part of the working set, just of the address
space. When you are creating a full dump, all the pages in the address space
are read-in, and written to disk. As long as the size of the dump is basically equivalent to the size of the address space of the process, what you describe is expected.”

I got the answer from Ivan Brugiolo & Pavel Lebedinsky.