Task Manager shows two kinds of Clash processes: clash-win64.exe (the core - does the work) and Clash for Windows.exe (the Electron UI). Identify which one is hungry first - the investigations differ entirely.
Core usage high (clash-win64.exe)
- debug log level left on: every connection emits reams of output, taxing CPU and disk. Back to
info. - Rule sets too many/too large: every RULE-SET stays in memory; usage scales with total rules. Drop unused providers - see the tuning checklist.
- Connection storms: BitTorrent or crawlers under TUN create thousands of connections, exploding matching and tracking costs. Find the source via the Connections page's process column and route it DIRECT with
PROCESS-NAME, or keep it off TUN. - url-test interval too small: dozens of nodes x a short interval = perpetual benchmarking. Keep intervals at 300 s or more.
UI usage high (Clash for Windows.exe)
- Camped on Connections/Logs: live-refreshing lists cost real rendering. Park on General when idle.
- Slow memory creep: the usual Electron long-run behavior; a restart releases it. Weekly restarts if it bothers you.
- Sustained high CPU: occasionally a reconnect loop after losing the core (core crash, 9090 occupied). Check the logs for connection failures to the controller, fix that, and it settles.
Healthy baselines
| Process | Normal range |
|---|---|
| Core memory | 50-150 MB (200+ with large rule sets) |
| UI memory | 150-300 MB |
| Idle CPU | Near 0% for both; brief spikes during benchmarks/heavy traffic |
Tip: "suddenly abnormal" without config changes points at some app spraying connections in the background - sort the Connections page by traffic and it jumps out. Far more productive than tweaking Clash parameters.