It is difficult, if not impossible, to account for exact memory usage on
NT operating systems but by using Perfmon and select performance
counters you can get a fairly close accounting of memory usage.
To obtain the physical memory usage first determine memory usage by the
Operating System and Device Drivers by adding the following Memory
Object counters:
+ Pool Nonpaged Bytes
+ Pool Paged Resident Bytes
+ System Cache Resident Bytes
+ System Code Resident Bytes
+ System Driver Resident Bytes
------------------------------
= Total Bytes used by the Operating System and Device Drivers
Now that we know the memory usage by the Operating System and Device
Drivers we can use the Memory Available Bytes counter and simple
arithmetic to obtain the correct size of the Total Process Working Set size:
+ Total RAM installed in the computer
- Available Bytes
- Total Bytes used by the Operating System and Device Drivers (above)
-------------------------------------
= Total Process Working Set Bytes**
The Total Process Working Set Bytes can also be obtained from Perfmon's
Process(_Total) Working Set Bytes counter, but the value reported by the
counter will differ from the calculated value. Running processes share
memory pages, these shared pages hold shared DLLs, DLLs that can be used
by many different processes. Although the shared DLLs are only loaded
into memory once, the Total Process Working Set Bytes counter counts
every "usage" instance of shared DLLs. If a shared DLL is used by four
different applications the Total Process Working Set Bytes will count
the memory usage by the DLL four times, the DLL will be counted in each
of the individual Process Working Sets thus inflating the actual value
of the shared memory pages. The calculation above returns a more
accurate value for the Total Process Working Set Bytes.
To obtain RAM usage we simply sum up the two totals above:
+ Total Bytes used by the Operating System and Device Drivers
+ Total Process Working Set Bytes
---------------------------------------
= Total RAM Usage
In short, a quick but less accurate RAM usage figure can be obtained by
adding up the following four Perfmon counters:
+ Process(_Total) Working Set Bytes
+ Cache Bytes (Total System Working Set)*
+ Pool Nonpaged Bytes
---------------------------------------
= Total RAM Usage
+ Available Bytes
---------------------------------------
= Total RAM installed in the Computer
=======================================
As explained earlier, because of shared pages the total may differ to
the actual RAM installed.
* The Cache Bytes counter is the Total System Working Set, the Cache
Bytes counter is an aggregate of the following Memory Counters:
+ Pool Paged Resident Bytes
+ System Cache Resident Bytes
+ System Code Resident Bytes
+ System Driver Resident Bytes
----------------------------
= Cache Bytes or System Working Set Bytes
**The above calculations will yield a close estimate of memory usage on
NT operating systems, bear in mind that certain Operating System
components have no associated Memory Object Counters and obtaining
values for these items is difficult, in the above examples memory usage
by these components is accounted by default in the Total Process Working
Set Bytes calculations.
John
References:
http://wininternals.uw.hu/ch07lev1sec1.html
http://www.lund.com/support_docs/pggold/html/11 Chapter.html#wp1039979
The Perfmon Help Files
Perfmon counter explanations (from the Perfmon Help Files):
*Available Bytes* is the amount of physical memory, in bytes, available
to processes running on the computer. It is calculated by adding the
amount of space on the Zeroed, Free, and Standby memory lists. Free
memory is ready for use; Zeroed memory consists of pages of memory
filled with zeros to prevent subsequent processes from seeing data used
by a previous process; Standby memory is memory that has been removed
from a process' working set (its physical memory) on route to disk, but
is still available to be recalled.
*Pool Nonpaged Bytes* is the size, in bytes, of the nonpaged pool, an
area of system memory (physical memory used by the operating system) for
objects that cannot be written to disk, but must remain in physical
memory as long as they are allocated. Memory\\Pool Nonpaged Bytes is
calculated differently than Process\\Pool Nonpaged Bytes, so it might
not equal Process\\Pool Nonpaged Bytes\\_Total.
*Pool Paged Resident Bytes* is the current size, in bytes, of the paged
pool. The paged pool is an area of system memory (physical memory used
by the operating system) for objects that can be written to disk when
they are not being used. Space used by the paged and nonpaged pools are
taken from physical memory, so a pool that is too large denies memory
space to processes.
*System Cache Resident Bytes* is the size, in bytes, of the pageable
operating system code in the file system cache. This value includes only
current physical pages and does not include any virtual memory pages not
currently resident. It does equal the System Cache value shown in Task
Manager. As a result, this value may be smaller than the actual amount
of virtual memory in use by the file system cache. This value is a
component of Memory\\System Code Resident Bytes which represents all
pageable operating system code that is currently in physical memory.
*System Code Resident Bytes* is the size, in bytes of the operating
system code currently in physical memory that can be written to disk
when not in use. This value is a component of Memory\\System Code Total
Bytes, which also includes operating system code on disk. Memory\\System
Code Resident Bytes (and Memory\\System Code Total Bytes) does not
include code that must remain in physical memory and cannot be written
to disk.
*Working Set* is the current size, in bytes, of the Working Set of this
process. The Working Set is the set of memory pages touched recently by
the threads in the process. If free memory in the computer is above a
threshold, pages are left in the Working Set of a process even if they
are not in use. When free memory falls below a threshold, pages are
trimmed from Working Sets. If they are needed they will then be
soft-faulted back into the Working Set before leaving main memory.
