Syscall-Monitor icon indicating copy to clipboard operation
Syscall-Monitor copied to clipboard

Recording callstacks consumes too much memory

Open hzqst opened this issue 7 years ago • 0 comments

The memory consumption went 25 ~ 30MB per 50000 events when commented CallStack(ba); in bool CMonitorWorker::ParseMessage(PUCHAR data), while it went 50 ~ 60MB per 50000 events when CallStack is recorded. It almost cost 150% memory than the event itself, since one event cost 100 bytes at average and the std::vector<CCallStack> cost 24 + 8 * number of CCallStack which is commonly 10~15 = 144 bytes. I am going to find a way to cut the std::vector's size down. And is there anybody know how the Process Monitor saving all these events? it cost only 50MB with 500,000 events recorded.

hzqst avatar Apr 21 '17 09:04 hzqst