1

We are monitoring a server for a potential Nonpaged Pool memory leak. So we setup a cmd batch file to output to the Nonpaged Pool allocation every 10 mins. We also setup a perfmon counter log to capture Memory > Nonpaged Pool Bytes. As well as an alert when this counter goes over 185MB (specified in bytes).

The alert tripped yesterday. We coolected the poolmon log for the day as well as the perfmon counter log file. Now when I add all the bytes from each of the poolmon logs I get a total of ~170MB every time. However in Perfmon it is showing as 210MB for the same time period. It stays at this for a long time, so not a spike. Task Manager is also showing this ~210MB. Looking at poolmon logs the top consumers do not change much, but do change.

The batch file uses: POOLMON.exe -p -b -n %OUTDIR%\poolmon.%ISODATE%.log

Why is there a discrepancy between the two and which should I trust?

Any insight will be much appreciated!

Jacques Thomas
  • 11

1 Answers1

0

Task Manager shows the total address space assigned to the pool. This includes free regions within the pool. Poolmon is only showing allocations. The difference reflects the total size of additional allocations that could be made without expanding the pool's virtual (and, for nonpaged pool, physical) allocation.

Jamie Hanrahan
  • 24,326