Windows memory analysis tools

Task Manager

Use Task Manager to monitor memory usage and view detailed information about memory-consuming processes. On the Performance tab, check the system's virtual memory usage by comparing the Committed Bytes value to the Commit Limit. If the Committed Bytes value is close to the Commit Limit, the system may experience performance issues.

1. Remotely connect to the Windows server.

2. On the Windows desktop, open Task Manager.

3. Click the Performance tab and select Memory from the left pane to view memory usage.

   In the memory details area, note the Committed value (for example, 2.1/9.9 GB), which shows the current committed memory relative to the system's total Commit Limit.

Resource Monitor

Use Resource Monitor to view memory usage, especially for individual processes.

1. Remotely connect to the Windows server.

2. In the search box on the taskbar, enter Resource Monitor and open the application.

3. Click the Memory tab to view the memory usage of each process. For each process, focus on the Commit (KB) value to identify processes that consume large amounts of memory and determine whether this usage is expected for your workload.

   Physical memory usage consists of the following components:

   • Hardware Reserved: Memory reserved for hardware.

   • In Use: Memory used by processes, drivers, and the operating system.

   • Modified: Memory whose contents must be written to disk before it can be repurposed.

   • Standby: Memory that contains cached data and code that is not actively in use.

   • Free: Memory that contains no valuable data. This memory is used first when processes, drivers, or the OS need more memory.

   • Cache: When a file is opened, the system stores it in the cache to speed up future reads and writes. In Windows Server 2008 R2 and later, the system limits this cache's usage to ensure that sufficient physical memory remains available for applications, even if the cache is large.

Performance Monitor

Performance Monitor is an essential tool for monitoring and collecting system resource consumption data in Windows.

1. Remotely connect to the Windows server.

2. In the search box on the taskbar, enter Performance Monitor and open the application.

3. In the upper-left corner, choose Monitoring Tools > Performance Monitor.

   By default, Performance Monitor samples various system resources once per second.

   

4. Add counters and view their performance data.

   Add counters

   1. To check system resource consumption in real time, click the icon to add the counters.

      This icon is the green + (Add Counters) button on the Performance Monitor toolbar.

   2. On the Performance Monitor page, view the performance data for the added counters.

   User-defined set

   1. In the navigation pane on the left, choose Data Collector Sets > User Defined.

   2. Hover over User Defined, right-click, select New, and then follow the on-screen instructions to add counters as needed.

      For example, you can add counters for Logical Disk, Memory, System, Processor, and Process to view real-time resource status and define the collection frequency by setting the sampling interval. A 5-second interval is recommended for a memory leak that is slow to reproduce, while a 1-second interval is better for frequent high CPU usage.

      Common performance counters to add include \Processor(_Total)\% Processor Time, \Memory\Available KBytes, \Process(*)\% Processor Time, \Process(*)\IO Data Bytes/sec, \Process(*)\Private Bytes, \Process(*)\Thread Count, and \Process(*)\ID Process. For the log format, select Binary.

   3. On the Performance Monitor page, view the performance data for the added counters.

RAMMap, Process Explorer, and Poolmon

findstr /m /l IoDn *.sys

C:\Windows\System32\drivers>findstr /m /l IoDn  *.sys
FINDSTR: Cannot open SafeDogFileGuard.sys