Sometimes, a quick and easy fix is all you need to fix your Windows memory management problems. Other times, you'll...
need to dig deeper, and that's when certain Windows 7 Task Manager features can help.
Windows XP, Windows Vista and Windows 7 all have the Task Manager application built in, as well as a performance tab, but the options are much different in Vista and Windows 7. They have the Resource Monitor button in their Task Manager features, which provides additional information.
Windows 7 Task Manager features vs. XP, Vista
|Task Manager features||Windows XP||Windows Vista||Windows 7|
|Performance details for memory, network, CPU, disk||No||Yes -- overview only||Yes -- detailed tab for each|
|CPU usage per processor||Yes||Yes||Yes|
|Additional columns for processes||Yes, but limited: "Mem Usage" is working set, but no private working set||Yes -- private working set, many others||Yes -- same as Vista|
The Services tab is a huge improvement for the Vista and Windows 7 Task Manager over XP's. In Figure 1, there are processes listed as svchost.exe. Since this process is basically an umbrella that other processes run under, it is difficult to see what the offending process really is. In Windows XP, we had to use the tasklist command to break the processes out of svchost. Note that in Figure 4a, the Task Manager shows svchost.exe process with a Product ID (PID) of 1144.
By clicking on the Services tab and sorting on the PID column (Figure 4b) in the Vista or Windows 7 Task Manager, we can easily see all the processes running under this svchost.exe.
The second item in the table is "Performance Details." Figure 5 shows the Vista Resource Monitor Memory view, which dynamically displays hard faults per second (for writing to disk) and "used" physical memory (assuming this to be opposite of what's available). It also includes network, disk and CPU displays. This provides a quick glance at process statistics for memory usage. We can see the disk is very busy, so by expanding the Disk table, we can find additional detail on processes and see which ones are responsible for disk usage.
Dynamic memory monitoring with Windows 7 Task Manager
In the Memory table, one process, svchost.exe (secsvcs), has 1,061 hard faults, which could be running low on memory, causing memory paging to the disk. It should be investigated. Dynamically monitor memory for a few minutes to see the hard fault count increase quickly.
Windows 7 is my favorite for analyzing memory resources. Figure 6 shows one of the most useful Windows 7 Task Manager features, Resource Monitor. It shows a histogram of used physical memory, hard faults and the commit charge (this is the memory actually being used by processes -- not just reserved). The Resource Monitor shows an easy-to-read colored bar graph, which dynamically shows the memory allocation.
As mentioned in the previous article on Windows memory management, available memory can be used to start another application or serve new demands for existing open apps. Available memory in Figure 6 is the sum of the Standby and Free quantities. The Modified quantity is the modified page list -- pages that are modified but have not been used for a while. This is a great solution to the problem of trying to understand the memory terms in the Task Manager Performance tab. It's easy to match these up with memory manager lists.
Detecting memory leaks with Task Manager features
Memory leaks are usually fairly easy to diagnose if you use the proper method and gather the right data. When an application terminates, its working-set memory pages are released to the Free list, which are then zeroed and reused by other applications. That's why, if you're running low on memory, terminating some applications will free up memory for others.
In addition, the app will move pages to the Standby list when they have not been used for some time. These pages could eventually end up in the Free list as well. However, a misbehaving app that does not release its pages when they have been idle is said to have a memory leak. There are a variety of causes, but basically the app keeps using more and more memory and not giving any up, and it may not release the pages on termination.
The screen shot in Figure 1 shows a Windows XP Task Manager and the Mem Usage column. This column shows the working set memory for each process and is displayed by default. It is not useful for memory leak detection because once the set hits the maximum that Windows Memory Management will allow, it will be trimmed and stay there. Go to View -- Select Columns menu, and add the VM Size (virtual memory) column. This will show the whole picture of what is being used.
To find a memory leak, boot the machine and start the process suspected of a leak. Monitor the VM Size column. A leak will continue to show an increase in memory allocated to the process and will not recover, except by stopping the process or a reboot of the machine. This is usually done in Performance Monitor by enabling the memory counters, but it can be done quickly with Task Manager as a first step.
In Windows 7, the columns are more clearly labeled. Figure 7 shows the default Working Set (Memory) and the Memory (Private Working Set) column that I added. The Working Set column is equivalent to the Mem Usage column in Windows XP, while the Private Working Set shows the private pages -- the modified pages -- that would grow continually in the case of a memory leak.
Note that this must be observed over time, so if you charted it, the Working Set pages would normally increase and decrease as the page trimming takes place. Over time, a memory leak would gradually show an increase and not recover, possibly resulting in the process hanging.
Using Performance Monitor -- now called Resource Monitor -- memory counters can be observed. You can use Working Set counters and the Available memory counter to identify a process over time. This can be saved in a file and easily observed.
Windows 7 Task Manager features for memory analysis
Windows 7 made significant improvements in the Resource Monitor function of Task Manager. Referring to Figure 6, we can make several observations, again using the knowledge gained from Part 1 of this series.
- Available Memory, shown in Task Manager, consists of the Free list, Standby list and Zero list. The Windows 7 Task Manager shows the three lists in graphical form.
- If the Standby list is high, then you are making good use of memory -- lots of stuff is being cached.
- If the Free list is low, that's good. Some think that means they are out of memory, but it gets populated primarily by processes being terminated. So, unless you are terminating a lot of processes, this should be near zero, as shown in Figure 5 for Windows 7, and similarly in Vista. Note that the only way to see these lists in XP is to use the Windows kernel debugger.
- Looking at page fault activity doesn't prove you need more memory unless there are a lot of reads of the same file. This can be determined by using SysInternals' Process Monitor.
- The Commit Limit or Commit Charge, shown in Task Manager, is the total amount of private virtual memory that is available on the computer -- the sum of the page file size and RAM. If the Commit Limit is low, your applications will have less memory for your data and could hit "System is running low on virtual memory" errors. This can be corrected by increasing the page file size or adding more RAM, but increasing the page file will probably not produce better performance.
- While XP, Vista and Windows 7 can run without a page file, there will be a small performance hit, and applications could easily run out of memory.
The Windows 7 Task Manager makes memory diagnosis simpler, and Windows memory management can be done at a glance without setting up the Windows Resource Monitor counters. These counters can be used to dig deeper when needed. Task Manager's Resource Monitor also provides at-a-glance performance analysis for disk, network and CPU.
About the author:
Gary Olsen is a solution architect in Hewlett-Packard's Technology Services organization and lives in Roswell, Ga. He has worked in the IT industry since 1981 and holds an M.S. in computer-aided manufacturing from Brigham Young University. Olsen has authored numerous technical articles for TechTarget, Redmond Magazine and TechNet magazine, and he has presented numerous times at the HP Technology Forum. He is a Microsoft MVP for Directory Services and is the founder and president of the Atlanta Active Directory Users Group.