A primer on swap files

In this Daily Feature, Jeff Davis provides a brief history of the swap file, as well as some tips for managing the swap file to improve performance.

When you’re troubleshooting a Windows system that runs slowly, or frequently hangs up or “freezes,” one component of your Windows configuration might be to blame—the swap file. Here’s a brief history of the swap file, along with some tips for managing the swap file to improve performance.

When memory runs low, swap data out
In general, your system uses the swap file as an extension of RAM—essentially using that file as virtual memory. In Windows 3.x, 95, and 98, the so-called “swap” file is a file named Win386.swp. Under Windows NT, that file is named Pagefile.sys.

The benefit of using virtual memory is, of course, that you can run more programs simultaneously than what available RAM would otherwise allow. When Windows itself or an application you’re running requires more memory than is available on your system, Windows frees up memory by “swapping” some of the data out of RAM and writing it to your hard drive. So, when you and your users see the hard drive light come on every now and then, it’s probably Windows writing data into, or pulling data out of, the swap file.

The size of the swap file can increase or decrease, depending on demand. When it comes to fine-tuning system configuration for optimum performance, one of the questions a tech support professional asks is, “Should I worry about managing the swap file, or should I let Windows take care of it?” The answer to that question depends on several factors, including:
  • The version of Windows you’re running.
  • The amount of memory available on the individual system.
  • The applications you’re running on that system.

Viewing and setting swap file parameters
To view or change the current settings for your swap file under Windows 9x, right-click My Computer and select Properties. When the Properties window appears, click Performance. Then, click the Virtual Memory button.

The procedure for checking swap file settings under Windows NT is similar, but you don’t need to click a Virtual Memory button. Instead, you’ll see the size of your swap file in the Virtual Memory pane. To make changes to it, click Change.

One guideline by which many tech support professionals abide is the “multiple of memory” rule. Although results vary depending on the amount of RAM and the speed of the hard drive in an individual system, the most common practice for determining the size of the swap file is to multiply the amount of RAM by about 2.5. So, if the system has 32 MB of RAM, you might set the swap file to 80 MB. (The problem with that rule, of course, is that systems with a relatively small amount of RAM need more room for virtual memory swapping than systems with tons of RAM.)

Figure A shows the Performance tab of the System Properties dialog box under Windows NT. Click the Change button in the Virtual Memory section to display the virtual memory options, shown in Figure B.

Figure A
Use Control Panel’s System tool to view or change your virtual memory settings.

Figure B
The Virtual Memory dialog box lets you fine-tune the amount of space set aside for your paging file.

Deleting and defragging pagefile.sys
Sometimes system performance is sluggish because the swap file gets fragmented. Just like accessing any other file, if Windows has to thrash the disk in order to piece together the swap file, it’s going to take longer, and the chances increase that an error will occur.

One way to defrag the swap file is to delete it and let Windows create a new one. However, you can’t delete the swap file while you’re running NT. But you can delete that file when you boot up under another operating system.

In many cases—particularly when you’re troubleshooting a system that’s been misbehaving—you don’t want to delete the old swap file. Here’s one workaround for Windows 9x workstations. First, you’ll need to make sure Windows is set to utilize a minimum swap file size that’s at least as large (in megabytes) as your defragged swap file (in megs).

After you’ve changed the size, shut down your workstation and restart the machine in DOS mode. Rename your swap file (Win386.swp) to something else. Restart your workstation again in Windows. Defrag the drive where the swap file resides. Reboot in the workstation DOS mode again, delete the new swap file Windows made, and rename the old file back to Win386.swp. Then, reboot Windows.

The Windows 98 PageFile_Call_Async_Manager Service
With Windows 98, Microsoft introduced a new feature intended to resolve memory utilization and performance issues present in Windows 95: the PageFile_Call_Async_Manager Service. Although you can disable this service, Microsoft warns that you’ll cause your Windows 98 system to “perform as Windows 95 does, at some cost in overall system performance.” Follow this link to read about this new service in Microsoft’s KnowledgeBase article Q223/2/94.

However, if you want to implement this feature, you can do so with a little work. This tweak, specifically for Windows 98, involves disablingthe PageFile_Call_Async_Manager Service by adding the line

to the [386Enh] section of the System.ini file.

Even though Microsoft doesn’t recommend you make this change, this tweak can be of real value in many Windows 98 systems with 128 MB of RAM or more. That’s because workstations with this amount of RAM don’t use swap files as heavily as machines with less RAM. This tweak will probably improve system performance by reducing the overhead in swap file maintenance activities that you don’t really need.

Treating Pagefile.sys as a security risk
Sometimes the swap file contains information that, if allowed to get into the wrong hands, could compromise system security. To configure NT to treat Pagefile.sys as a security risk, use the NT Registry Editor (Regedt32) to edit the following key:
\Session Manager\Memory Management

Add a value named ClearPageFileAtShutdown as type REG_DWORD to the key (the default value is 0). When you set the value to 1, inactive pages in Pagefile.sys will be filled with zeros. NT can't clear all pages because some are still active during shutdown; however, this process will make hackers' jobs much more difficult.

By the way, editing the registry is a task you shouldn’t take lightly. Always make sure you have reliable backups before you edit the registry, and take your time. A damaged registry can render a system unusable.

Recommended reading for virtual memory management
Any time you add memory (RAM) to a machine, and whenever a machine begins to exhibit such signs as slow processing or frequent lockups, take a look at your swap file. If that file is approaching the maximum fixed size, or if it’s fragmented, you may be able to revive that machine by adjusting the virtual memory settings.

TechProGuild provides a number of excellent articles to help you configure your systems for optimum performance and a minimum of memory bottlenecks. In “Configuring and managing virtual memory paging files,” contributor Ivan Mayes presents an excellent summary of how to manage virtual memory on your NT server for maximum performance. Ivan points out the value of the often-overlooked, but extremely useful, troubleshooting tool, the Windows Task Manager.

Next, take a look at Brien Posey’s “Turbo-charging Windows NT.” In that article, Brien explains how simply adding more RAM can make a drastic difference in the way your system performs. Finally, Support Republic community editor Bill Detwiler wrote an article titled ”Speed up the Windows NT paging file” that provides some additional tips for improving the process of swapping memory in and out of memory under NT.

Jeff Davis is the senior technical writer for a Louisville, KY-based application service provider. He has over 10 years of experience as an IT manager and developer.

The authors and editors have taken care in preparation of the content contained herein but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for any damages. Always have a verified backup before making any changes.

Editor's Picks

Free Newsletters, In your Inbox