You are currently offline, waiting for your internet to reconnect

Using Performance Monitor to Identify a Pool Leak

This article was previously published under Q130926
This article has been archived. It is offered "as is" and will no longer be updated.
A memory leak occurs when a memory pool allocates some of its memory to aprocess and the process does not return the memory. When this happensrepeatedly, the memory pool is depleted.

Finding a Pool Leak

To identify a pool leak:
  1. Find a trend that shows pool memory is being allocated, and the available amount of pool memory is continuously being depleted.
  2. Identify the process that is allocating the memory, but not returning it.

Using Performance Monitor to Identify a Pool Leak

The Memory, Objects, and Processes objects should always be selected whenyou are looking for a pool leak. All counters under each object should beselected. Other object counters can also be selected to help you identify aspecific problem. You then simply view all charted objects until one ormore objects show a trend that could be a pool leak and then investigatethe problem.
  1. By charting the memory resources, it should be clear that one or more memory pools are allocating memory and the available memory in one or more memory pools is being continuously depleted. When charted, a memory pool may display a continuously climbing stair step effect while the process leaking memory is running. However, during times of inactivity, it is common to see the charted line remain flat. The charted line will continue stair pattern the next time the process leaking memory is started and run.
  2. By charting the object counter Object - Threads, it should be evident that the thread count grows in a manner similar to the tagged pool memory allocs and bytes listed in step one. Depending on the amount of threads that are created, the object counter Object - Threads may jump to a high value immediately.
  3. The object Processes should help determine which process is causing the leak. Object counters Pool Nonpaged Bytes, Pool Paged Bytes, and Thread Count should all be selected. Chart all instances of these counters. The process leaking memory should chart in a manner similar to the pool memory that was charted in step one.

An Alternate Method for Identifying a Process that is Leaking Memory

Although Performance Monitor usually provides the necessary information todetermine which process is creating a pool leak, it does not always providethe information necessary to determine the exact cause of a memory leak.A trend can often be identified that shows a memory leak, but an exactprocess may not be identifiable as the cause of the memory leak.

If the process leaking memory is a service, you can identify theprocess using Control Panel (Services) and Performance Monitor:
  1. If the process has been running long enough to show signs of the memory leak, use Performance Monitor to chart the object counter Objects - Threads. The number of threads running will depend on many factors, but the number will grow larger as the process leaking memory continues to run.
  2. Run Control Panel and choose Services.
  3. Tile the windows so you can see both Control Panel and Performance Monitor.
  4. Using Control Panel, start and stop the services one at a time.
If the process that is leaking memory has been running long enough, therewill be a drastic reduction in threads when that process is stopped.

NOTE: The process leaking memory does not have to be a service to use thismethod. If the process leaking memory is a regular program, closing theprogram will also cause the thread count to drop.

Article ID: 130926 - Last Review: 12/04/2015 11:26:22 - Revision: 2.2

Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server, Microsoft Windows 2000 Professional Edition, Microsoft Windows 2000 Datacenter Server, Microsoft Windows NT Advanced Server 3.1, Microsoft Windows NT Server 3.5, Microsoft Windows NT Server 3.51, Microsoft Windows NT Server 4.0 Standard Edition, Microsoft Windows NT Workstation 3.1, Microsoft Windows NT Workstation 3.5, Microsoft Windows NT Workstation 3.51, Microsoft Windows NT Workstation 4.0 Developer Edition, Microsoft Windows NT Advanced Server 3.1

  • kbnosurvey kbarchive KB130926