Windows Server Troubleshooting - Counters

Click here to start saving with ING DIRECT!

Home | Up | Methodology | Architecture | Tools | Processor | Registry | File System | Network | Active Directory | Contents

Get the Book

Major Topics
File System
Active Directory
Other Topics
Page File
Cache Size
More Detail

eXpert Genealogy

Memory from

2003-2006 Team Approach Limited
All rights reserved

Important Memory counters.

  • Pages/sec - Values over 10 indicate thrashing, i.e. excessive paging
  • Available Bytes - Values consistently below 4 MB require more RAM
  • Committed bytes - Values significantly higher the total RAM need more RAM

Investigating Disk Paging

Use memory counters that report paging activity to identify memory shortages resulting in disk bottlenecks. Start by monitoring the memory counters and working set values. Confirm that hard page faults are occurring using the Memory\Pages/sec counter.

Counters Explained

Hard faults
Very slow
Retrieved from disk
Soft faults
Retrieved from memory outside of the working set

Nanoseconds vs Milliseconds - The memory is mightier than the disk!

Memory access times is measured in Nanoseconds. Disk access times in measured in Milliseconds. The difference factor is a million which means that disk access times are about a million times slower than memory access. If a memory access results in a hard page fault, the access will be a million times slower. Excessive hard page faults can result in a system that thrashes, i.e. almost no useful work gets done. The simple solution is to ensure sufficient memory to avoid hard page faults.

If hard page faults are occurring, monitor disk counters to assess how the disk is behaving during paging: whether it is busy with other work or with handling page faults. Monitor disk paging using the following steps and associated counters:

  1. To confirm hard page faulting use the following Memory and Process counters:
    • Memory\Pages/sec
    • Process (All_processes) \Working Set
    • Memory\Pages Input/sec
    • Memory\Pages Output/sec
  2. To understand the impact of page faulting on the disk, compare the number of reads and read bytes measured by the following counters:
    • Memory\Page Reads/sec
    • PhysicalDisk\Disk Reads/sec
    • PhysicalDisk\Avg. Disk Read Bytes/sec
Counter Description
Page Faults/sec the average number of pages faulted per second. This counter includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory.)
Pages Input/sec the rate at which pages are read from disk to resolve hard page faults. Hard page faults occur when a process refers to a page in virtual memory that is not in its working set or elsewhere in physical memory, and must be retrieved from disk. When a page is faulted, the system tries to read multiple contiguous pages into memory to maximize the benefit of the read operation.
Pages/sec the rate at which pages are read from or written to disk to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It is the sum of Memory\\Pages Input/sec and Memory\\Pages Output/sec.

Optimize memory by stopping unused services. i.e. Don't run programs that you don't need!
Because services run in the background, they are often forgotten. 

Counters for Analyzing Memory Usage

To monitor for Use this Object\Counter
Memory shortages Memory\Available Bytes or Available KBytes or Available MBytes
Process (All_processes)\Working Set
Memory\Cache Bytes
Frequent hard page faults Memory\Pages/sec
Process (All_processes) \Working Set
Memory\Pages Input/sec
Memory\Pages Output/sec
Excess paging with a disk bottleneck Memory\Page Reads/sec
Physical Disk\Avg. Disk Bytes/Read
Paging file fragmentation PhysicalDisk\Split IOs\sec
PhysicalDisk\% Disk Read Time
PhysicalDisk\Current Disk Queue Length
Process\Handle Count
Memory leaks; memory-intensive applications


Memory\Pool Nonpaged Allocations
Memory\Pool Nonpaged Bytes
Memory\Pool Paged Bytes
Process(process_name)\Pool Nonpaged Bytes
Process(process_name)\Handle Count
Process(process_name)\Pool Paged Bytes
Process(process_name)\Virtual Bytes
Process(process_name)\Private Bytes
Cache Manager efficiency


Cache\Copy Read Hits %
Cache\Copy Reads/sec
Cache\Data Map Hits %
Cache\Data Maps/sec
Cache\MDL Read Hits %
Cache\MDL Reads/sec
Cache\Pin Read Hits %
Cache\Pin Reads/sec
To identify cache bottlenecks, use Memory\Pages Input/sec with these counters.