What is this vmmem program that is using up all my CPU and memory?

Date:July 17, 2018 / year-entry #163
Tags:tipssupport
Orig Link:https://blogs.msdn.microsoft.com/oldnewthing/20180717-00/?p=99265
Comments:    7
Summary:That's where your virtual machine resource usage goes.

Say you're minding your own business and you discover that this process called vmmem is using up all your memory and CPU. What is this guy and how do you make him stop?

The vmmem process is a virtual process that the system synthesizes to represent the memory and CPU resources consumed by your virtual machines. In other words, if you see vmmem consuming a lot of memory and CPU resources, then that means your virtual machines are consuming a lot of memory and CPU resources.

If you want to make it stop, shut down your virtual machines.

Bonus chatter: Strictly speaking, what it actually represents is the resources of the other virtual machines, since Windows itself is running in a virtual machine under the hypervisor. You may not be explicitly using the hypervisor, but some other features are built on top of the hypervisor.


Comments (7)
  1. Pepito de los palotes says:

    You mean Hyper-V virtual machines, right?

    1. I believe you are right. The bonus chatter hints about a bare-metal hypervisor. Hyper-V is the only one Microsoft has ever made. And since a Microsoft employee has written this, it is definitely about a Microsoft product. (Bonus chatter: This principle does not always hold about other company employees, even those whose competing products sell much stronger than Microsoft’s.)

  2. Joshua says:

    I suppose there’s no point killing vmmem.

    1. That would be like killing the “Idle cpu time” process

  3. Kazi says:

    As I can see in host’s task manager, CPU usage is assigned to vmmem, but RAM consumption is assigned to vmwp.exe. It doesn’t make sense for me. Why two processes per VM? One would be ideal, no?

    1. VMWP.EXE is a real process.

  4. Jonathan says:

    On my machine, I see a vmmem process consuming lots of memory (1.4GB private bytes, 350MB working set), but I have no Hyper-V machines running. The process runs as “NT VIRTUAL MACHINE\{some guid}” user. I even deleted all my Hyper-V machines – still vmmem remains.

    I presume it’s some implicit VM, like Windows Defender Application Guard uses to run Edge (and office?) – how can I determine that?

Comments are closed.


*DISCLAIMER: I DO NOT OWN THIS CONTENT. If you are the owner and would like it removed, please contact me. The content herein is an archived reproduction of entries from Raymond Chen's "Old New Thing" Blog (most recent link is here). It may have slight formatting modifications for consistency and to improve readability.

WHY DID I DUPLICATE THIS CONTENT HERE? Let me first say this site has never had anything to sell and has never shown ads of any kind. I have nothing monetarily to gain by duplicating content here. Because I had made my own local copy of this content throughout the years, for ease of using tools like grep, I decided to put it online after I discovered some of the original content previously and publicly available, had disappeared approximately early to mid 2019. At the same time, I present the content in an easily accessible theme-agnostic way.

The information provided by Raymond's blog is, for all practical purposes, more authoritative on Windows Development than Microsoft's own MSDN documentation and should be considered supplemental reading to that documentation. The wealth of missing details provided by this blog that Microsoft could not or did not document about Windows over the years is vital enough, many would agree an online "backup" of these details is a necessary endeavor. Specifics include:

<-- Back to Old New Thing Archive Index