Investigating Memory Shortages

Your system can develop a memory shortage if multiple processes are demanding much more memory than is available or you are running applications that leak memory. Monitor the following counters to track memory shortages and to begin to identify their causes.

• Memory\Available Bytes indicates how much physical memory is remaining after the working sets of running processes and the cache have been served.

• Process (All_processes )\Working Set indicates the number of pages that are currently assigned to processes. When there is ample memory, then the working set structures can fill with pages that are not currently needed to do work but that were needed in the past and might be needed in the future. Because there is no memory shortage, the working set structures are not trimmed. As a result the working set approximates pages that have been referenced in a longer period of time. However, when memory is in short supply, the working set might be trimmed. As a result, the working set in that case approximates the number of pages referenced in a much shorter period of time.

• Memory\Pages/sec indicates the number of requested pages that were not immediately available in RAM and had to be read from the disk or had to be written to the disk to make room in RAM for other pages. If your system experiences a high rate of hard page faults, the value for Memory\Pages/sec can be high.

To maintain a minimum number of available bytes for the operating system and processes, the Virtual Memory Manager continually adjusts the space used in physical memory and on disk. In general, if memory is ample, working set sizes can increase as needed. If the memory supply is barely adequate or very close to the amount required, you might see the operating system trim some working-set sizes when another process needs more memory—at startup, for example. Figure 6.4 illustrates this situation.

Figure 6.4 Working Set Values of Processes as One Process Starts Up

If the value for Memory \ Available Bytes is consistently below the system-defined threshold and the value for Memory \ Pages/sec spikes continuously, it is likely that your memory configuration is insufficient for your needs. To confirm that a high rate of paging is related to low memory, see "Investigating Disk Paging" later in this chapter.

Note

You might see a low value for Memory\Available Bytes, which is not caused by a memory shortage, in the following situations:

-
During large file-copy operations such as a system backup. In this case, you can verify that the copy operation is the cause by monitoring Memory\Cache Bytes as well. You should see Memory\Cache Bytes rise as Memory\Available Bytes falls. Otherwise, you need to investigate the cause as described in this chapter.

-
The Maximize Data Throughput for File Sharing option is selected in the File and Printer Sharing for Microsoft Networks Properties dialog box. This allocates a large system cache, which might not be appropriate for how your computer is used. For more information about how this setting should be configured, see "Optimizing Your Memory Configuration" earlier in this chapter.

-
The working sets of processes have become smaller and there is no demand for pages for other purposes. In this case the number of available bytes might be low but there is no need to trim working sets and there are few if any page faults.

To identify processes associated with low-memory conditions, examine memory usage by specific processes, and determine if a process is leaking memory as described in "Investigating User-Mode Memory Leaks" and "Investigating Kernel-Mode Memory Leaks" later in this chapter.

If available memory is consistently low (2 MB or less), the computer becomes unresponsive because it is occupied exclusively with disk I/O operations. During paging due to low memory, the processor is idle while waiting for the disk to finish. Therefore, it is important, especially on server computers, to investigate and correct the cause of a low-memory condition. Notice which processes are running as well as the sizes of their working sets as you monitor memory counters. The processes might need to be updated or replaced if they are contributing to memory shortages and you do not want to acquire additional memory.

For information about how to address a memory shortage, see "Resolving Memory and Cache Bottlenecks" later in this chapter.