Windows Server Troubleshooting - Memory

Click here to start saving with ING DIRECT!

Home | Methodology | Architecture | Tools | Memory | Processor | Registry | File System | Network | Active Directory | Contents

Get the Book

Major Topics
Other Topics
File System
Active Directory
More Detail
Page File
Cache Size

eXpert Genealogy

Memory from

2003-2006 Team Approach Limited
All rights reserved

Memory shortage is the most common cause of performance problems. Memory shortage problems are easily solved by adding more memory. Applications constantly demanding more memory is another common problem. This condition is known as a memory leak. Adding more memory will not solve problems caused by a memory leak. The additional memory will simply delay the symptoms.  A memory leak is a bug in an application that must be fixed by the programmer.

Memory Management
Each process in Windows has 32-bits of addressability which gives it an address space of 4GB. The address space is simply the total amount of addresses available to access virtual memory. The actual amount of physical memory used by a process is its working set.  The Memory Management Unit divides the process memory requirements into 4K pages and allocates these pages into physical memory.

Process 1 Virtual Memory

Physical memory

Free page 3
System addressable memory 4GB System, page 1
  Process 1, page 4
  Process 2, page 1
Application addressable memory 2GB Process 1, page 2
  System, page 3
0 Free page 1
  Virtual to  Physical Mapping Process 1, page 1
Process 2 Virtual Memory System, page 2
System addressable memory 4GB      Virtual Memory Manager Process 2, page 3
  Free page 2
  Process 2, page 2
Application addressable memory 2GB Process 1, page 5
  System, page 4
0 Process 1, page 3

Swap memory to pagefile



If there is insufficient physical memory, pages are temporarily stored in the page file, pagefile.sys. The pages will be swapped from the page file into physical memory as they are needed and swapped out to the page file to provide physical memory for other memory allocations.

The SysMon Working Set counter is the current size, in bytes, of the Working Set of this process.  If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If memory pages are needed, they will then be faulted back into the Working Set before leaving main memory. To force the working sets to be trimmed, run the Resource Kit CLEARMEM command.

Terminology Description
Paging Moving pages to or from a working set
Working set Process pages located in physical memory
Page fault Page is not in the working set and must be retrieved
Hard page fault Page is retrieved from the page file
Soft page fault Page is retrieved from memory outside of the working set
Reserved memory Memory allocated but not yet used
Committed memory Memory allocated to a process
Available memory Memory that is not committed or reserved
Commit limit Physical memory plus the current space in the page file
Nonpaged pool Windows managed memory area for objects that will not be paged out
Paged pool Windows managed memory area for objects that can be paged out

Investigating Memory Shortages

Your system can develop a memory shortage if multiple processes are demanding much more memory than is available or you are running applications that leak memory. Monitor the following counters to track memory shortages and to begin to identify their causes.

  • Memory\Available Bytes indicates how much physical memory is remaining after the working sets of running processes and the cache have been served.
  • Process (All_processes)\Working Set indicates the number of pages that are currently assigned to processes.
  • Memory\Pages/sec indicates the number of requested pages that were not immediately available in RAM and had to be read from the disk or had to be written to the disk to make room in RAM for other pages. If your system experiences a high rate of hard page faults, the value for Memory\Pages/sec can be high.

Identify processes with high memory usage by using the histogram view to compare the working sets of all processes. The histogram view provided an ideal way of identifying processes with a large working set.

Memory Extensions

Windows is a 32-bit OS and thus has a 4 GB address space limitation. Windows designers divided the memory space in half, giving 2 GB for each application and using the other 2GB to address the OS. Over time application writers have found that this 2 GB limit is a problem. Microsoft now has two solutions to this problem.

  1. 4GT Four GB Tuning
    • Specially designed applications can address up to 3 GB of memory. The machine should have at least 2 GB of physical memory and be started with the /3GB option in the BOOT.INI file.
  2. PAE Physical Address Extensions X86
    • Intel has designed the PAE X86 standard to allow machines to have up to 64 GB of physical memory. 4GT allows software using the AWE Address Windows Extensions to access this memory.


DCOM applications are designed on a Client/Server model. Memory intensive applications may run better if they are split across more that one server. The transfer of the data may introduce a security concern. The utility DCOMCNFG or the Component Services snap-in are used to configure the multi-server environment.

Client                Component