Various embodiments discussed herein enable intelligent resource leak detection and associated user interface. In some aspects, if a kernel sends a tracing event (e.g., an ETW event) after a process or application has been requested to be shut down but before the process has actually been shut down, a resource leak can be detected. This is because the application should have requested the reference indicator to be removed in memory before the tracing event, as opposed to the kernel acting alone without an application request to remove the reference indicator. If a reference indicator has not been requested to be removed by the time this tracing event occurs, then it is indicative of the application never having sent a request to remove the reference indicator, which is indicative of a resource leak.