Firing up procmon to monitor C:\pagefile.sys (first "Filter > Enable advanced output", then "Filter > Filter... > Path is C:\pagefile.sys" to show reads and writes from pagefile) there's a write to pagefile from System (showing as IRP_MJ_WRITE) almost exactly every second, and the only process to ever read from the pagefile in the last 15mins has been palemoon - as depicted in Yet Another Attachment.
I don't know if there are any tools available to verify whether or not its PM that is actually responsible for this activity since TTBOMK windows doesn't provide any easy access to this sort of thing. It's dead easy on linux - assuming only a single instance of palemoon running (it'll fail if there are multiple PIDs) you can just run the following command to report how much has been swapped:
Code: Select all
root@krikkit:~# grep VmSwap /proc/`pidof palemoon`/status
VmSwap: 848 kBI've disabled my page file in the anticipation that if PM is swapping out, killing the page file will prevent this behaviour; but this'll require a reboot, and I'm likely weeks away from another reboot (barring crashes or hardware gremlins) so if anyone else is able to entertain firing up procmon to see if they've got anything resembling the same issue (and maybe also think about disabling their page file if they've got enough RAM to play with and don't mind a reboot and potential problems due to lack of page file) then I'd love to hear back from someone.
Thanks for the kind words CodeLurker - I'm definitely no guru (and I don't want to cause a ruckus for what might be an issue unique to my system and throwing red herring's everywhere) but I hope some other people might find the info useful. As you say, sporadic bugs are the worst (I had one at work that took 3yrs to get to the bottom of because it only occurred every 3 months or so and I'm happy to report that both the vendor and Microsoft were both entirely useless in assisting with debugging it).