Hi Rob,
A bit technical but this is part of the
Inventoria is making multiple calls to IRP_MJ_DIRECTORY_CONTROL within a matter of a second. RP_MJ_DIRECTORY_CONTROL is being called with “NotifyChangeDirectory” which Microsoft defines as “Indicates a request for notification of changes to the directory. Usually, instead of satisfying this request immediately, the file system driver holds the IRP in a private queue. When a change occurs to the directory, the file system driver performs the notification, and dequeues and completes the IRP.” Inventoria only needs to make a SINGLE request for each directory, if nothing is happening in any of the directories at the time of the IRP_MJ_DIRECTORY_CONTROL, the IRP is placed in a private queue and waits for a change event in one of the directories. Now since these IRP_MJ_DIRECTORY_CONTROL operation is being generated at a astronomical rate, if IRP’s were being place on the private queue without fulfilling the previous IRP for the same directory this would start to fill the private queue fast, and what kind of memory would this private queue used, NONPAGED MEMORY. This is exactly what appears to be happening.
As Inventoria eats up non-paged memory, every other program will have less memory to work with; if left running Inventoria will hang Windows. Windows need non-paged memory to swap memory, switch task, etc, once the non-paged memory is gone so is Windows. As Windows starts to run out of memory, Windows will start swapping memory to disk and that will slow things down! If a file in one of these directories gets updated, I am not sure what would happen when all the IRP for that directory/file get fired at once, maybe crash Inventoria?
Gunner