Using Performance Monitor to Identify a Pool Leak

A memory leak occurs when a memory pool allocates some of its memory to a process and the process does not return the memory. When this happens repeatedly, the memory pool is depleted.

Finding a Pool Leak

To identify a pool leak:

1. Find a trend that shows pool memory is being allocated, and the available amount of pool memory is continuously being depleted.
2. Identify the process that is allocating the memory, but not returning it.

Using Performance Monitor to Identify a Pool Leak

The Memory, Objects, and Processes objects should always be selected when you are looking for a pool leak. All counters under each object should be selected. Other object counters can also be selected to help you identify a specific problem. You then simply view all charted objects until one or more objects show a trend that could be a pool leak and then investigate the problem.

1. By charting the memory resources, it should be clear that one or more memory pools are allocating memory and the available memory in one or more memory pools is being continuously depleted. When charted, a memory pool may display a continuously climbing stair step effect while the process leaking memory is running. However, during times of inactivity, it is common to see the charted line remain flat. The charted line will continue stair pattern the next time the process leaking memory is started and run.
2. By charting the object counter Object - Threads, it should be evident that the thread count grows in a manner similar to the tagged pool memory allocs and bytes listed in step one. Depending on the amount of threads that are created, the object counter Object - Threads may jump to a high value immediately.
3. The object Processes should help determine which process is causing the leak. Object counters Pool Nonpaged Bytes, Pool Paged Bytes, and Thread Count should all be selected. Chart all instances of these counters. The process leaking memory should chart in a manner similar to the pool memory that was charted in step one.

An Alternate Method for Identifying a Process that is Leaking Memory

Although Performance Monitor usually provides the necessary information to determine which process is creating a pool leak, it does not always provide the information necessary to determine the exact cause of a memory leak. A trend can often be identified that shows a memory leak, but an exact process may not be identifiable as the cause of the memory leak.

If the process leaking memory is a service, you can identify the process using Control Panel (Services) and Performance Monitor:

1. If the process has been running long enough to show signs of the memory leak, use Performance Monitor to chart the object counter Objects - Threads. The number of threads running will depend on many factors, but the number will grow larger as the process leaking memory continues to run.
2. Run Control Panel and choose Services.
3. Tile the windows so you can see both Control Panel and Performance Monitor.
4. Using Control Panel, start and stop the services one at a time.

If the process that is leaking memory has been running long enough, there will be a drastic reduction in threads when that process is stopped.

NOTE: The process leaking memory does not have to be a service to use this method. If the process leaking memory is a regular program, closing the program will also cause the thread count to drop.