Skip to content

Monitoring Windows Processes

Instances

Memory Behavior

Page File Use

Windows gives each process a 2G (or 3 if the see /3G) virtual address space. When a page within this space is actually used it is referred to as "committed" -- meaning the page is mapped to a location in RAM and in the page file. Pages that are committed are accounted for in the "Page File Bytes" counter for processes in perfmon, this value is a good measure of how much of the available virtual memory (RAM plus Page File) the process is using.

The "Page File Use" rule is the maximum number of committed bytes a process may accumulate before an alert is generated. The rule may be expressed as a number of bytes [N] or a percentage [%] of the Committed Bytes Limit (The total amount of virtual memory availale on the system before the page file would have to be extended).

Working Set

Each process has a number of pages of it's memory that are in RAM (as opposed to residing in the page file). These are the pages the process uses most. Some pages are shared among other programs and some pages are private. When a program's private working set becomes too large, it may be using more of it's fair share of RAM, causing other programs' pages to be ejected from memory and placed in the page file. While it's perfectly OK to have revenue generating programs use all the physical RAM, it is not good to have utilities or nuiscense programs (such as screen savers) that may compete with revenue generating applications using too much RAM. The "Working Set (Private)" parameter sets the maximum number of bytes that can make up the working set before an alert is generated. The rule may be expressed as a number of bytes [N] or a percentage [%] of the available RAM.

Private Bytes

Private bytes are the number of bytes of memory that a program uses that are not shared with other programs. Slow growth in private bytes is a good indicator of a memory leak. The "Private Bytes" parameter is the maximum number of private bytes a program can accumulate before an alert is raised. It can be expressed as a number of bytes [N] or a percentage of the Committed Bytes Limit (The total amount of virtual memory availale on the system before the page file would have to be extended).

CPU Behavior

Handles

Workload Automation and Orchestration