Windows

Investigate memory usage with Windows 7 Resource Monitor

Greg Shultz shows you how to use the detailed information displayed in Windows 7 Resource Monitor to investigate memory usage.

In last week's blog post, "Learn How to Use the Windows 7 Resource Monitor for Effective Troubleshooting," I introduced you to the Resource Monitor tool's powerful features and explained how you can use it to get a better understanding of how system resources are used by processes and services. I also indicated that you can use Resource Monitor to delve into specific problems, such as investigating memory usage.

In this edition of the Windows Desktop Report, I'll show you how to use the detailed information displayed in Windows 7 Resource Monitor to investigate memory usage.

This blog post is also available in PDF format in a TechRepublic download.

Memory basics

Without getting too technical, let's take a moment to briefly look at memory management in Microsoft Windows 7. Doing so will help you to interpret the information displayed on the Memory tab.

To begin with, Windows 7 operating system's memory manager creates a virtual memory system that is made up of available physical memory and a page file system on the hard disk. Using this virtual memory system allows the operating system to allocate fixed-length blocks of memory, called pages, that are contiguous in both physical memory addressing and virtual memory addressing.

Getting started

To get started with Resource Monitor, click the Start button, type Resmon.exe in the Start Search box, and press [Enter]. When you see the Resource Monitor user interface, select the Memory tab, as shown in Figure A.

Figure A

The Memory tab in Resource Monitor provides detailed information about Windows 7's memory usage.

The Processes table

On the Memory tab, the Processes table, shown in Figure B, lists all the currently running processes and breaks down each process' memory use in several categories.

Figure B

The Processes table breaks down each process' memory use in several categories.

Image

Of course, the Image column shows the process' executable file name. As you can see, Processes that represent applications are easy to identify. For example, it's easy to tell that the notepad.exe process corresponds to Notepad. Processes named svchost.exe represent various services being run by the operating system. You can find the name of the service enclosed in parenthesis adjacent to each instance of svchost.exe shown in the Image column.

PID

The PID column shows the process' Process ID number, which is simply a number that uniquely identifies a process while it runs.

Commit

The Commit column shows the amount of virtual memory in kilobytes that the operating system has reserved for a process. This number includes the amount of physical memory that is in use as well as any pages that have been saved in the page file.

Working Set

The Working Set column shows the amount of physical memory in kilobytes that is currently in use by the process. The working set can be broken down into Shareable and Private categories of memory.

·       Shareable

The Shareable column shows the amount of physical memory in kilobytes that is currently in use by the process and is shared with other processes. Sharing sections or pages of memory for common processes saves memory space because only one copy of the page is required. More specifically, one copy of the page is physically in memory and it is then mapped to the virtual address space of other processes that need access. For example, system DLLs, such as Ntdll, Kernel32, Gdi32, and User32, share memory among all processes.

·       Private

The Private column shows the amount of physical memory in kilobytes that is currently in use by the process that is not shared with other processes. This number provides you with a pretty accurate measure of the amount of memory that a particular application needs in order to run.

Hard Faults/sec

The Hard Faults/sec column shows the average number of hard page faults per second that have occurred in the last minute. If a process attempts to use more physical memory than is currently available, the system must write, or page, some of the memory contents to disk. If the process later needs and accesses the memory contents that exist on the disk, it is called a Hard Fault.

Watching Hard Faults

Now that you have a good idea of the memory information presented in the Processes table, let's take a look at what to look for if you want to monitor memory usage. As you load applications and work with files, the operating system's memory manager monitors the Working Set of each process and watches for requests for additional memory resources. As the Working Set of a process grows, the memory manager balances the process' demand for more memory against requests from the kernel and other processes. If available address space becomes scarce, the memory manager must scale back the size of the working set. This typically means paging some of the memory contents to disk.

If that page must be read back from the disk, it causes a Hard Fault. While Hard Faults are a pretty normal occurrence, multiple Hard Faults typically require additional time so that the system can read pages from the disk. When Hard Faults occur too frequently, the resulting disk reads will decrease system responsiveness. If you have ever been working on your system and suddenly everything seems to run in slow motion and then just as suddenly comes back to regular speed, chances are good that your system is busily swapping memory around so that it can continue working.

As such, if you notice an excessive number of Hard Faults related to a particular process on a regular basis, chances are your system needs more physical memory.

To more closely watch processes that are encountering a large number of Hard Faults, you can use the Filtering system built in to Resource Monitor. Select the check box adjacent to that process, and it will move to the top of the list. You'll then see those Hard Faults appear in orange in the graph.

(Keep in mind that there are many other factors that come in to play when it comes to memory usage and that monitoring Hard Faults isn't the only or the best way to monitor memory use. However, it does provide you with a good starting point.)

The Physical Memory table

While the Processes table provides you with a more granular view of memory usage, the Physical Memory table gives you a global view. The main feature of the Physical Memory table is a bar graph that lets you see a unique view of memory usage, as shown in Figure C.

Figure C

Physical Memory table's bar graph provides you with a global view of win 7's memory usage.

As you can see, each section of the bar graph is labeled and represents a list of pages of memory. As you use your system, the memory manager is at work in the background moving memory back and forth between these lists in order to maintain a delicate balance between using physical memory and the hard disk in order to allow your system to work efficiently and effectively. Let's take a closer look.

Hardware Reserved

Beginning on the left, in gray, is the Hardware Reserved list, which shows the amount of memory reserved for hardware. This list represents the amount of memory that the various hardware devices installed in your system have reserved so that they can communicate with the operating system. Of course, memory reserved for hardware is essentially locked and as such is not available to the memory manager.

Typically, the amount of Hardware Reserved memory ranges from 10MB to 70MB but can vary depending on the system's hardware configuration and might be several hundred MB. Examples of components that can affect the amount of memory reserved include:

  • System BIOS
  • Motherboard resources, such as I/O advanced programmable interrupt controller (APIC)
  • Sound cards or any other devices that require memory-mapped I/O
  • PCI Express (PCIe) bus
  • Video card
  • Various chipsets
  • Flash devices

(Some folks have reported inordinately huge amounts of memory being allocated to the Hardware Reserved list. While I haven't encountered this situation myself and can't verify the suggested solution, many have reported that upgrading the system BIOS firmware solved the problem.)

In Use

The In Use list, shown in green in Figure C, represents the amount of memory being used by the operating system, drivers, and the various running processes. In Use memory is calculated by adding the sizes of the Modified, Standby, and Free values and subtracting this from the amount of recognized memory, which is listed as Total in the section just below the graph. The Total memory is calculated by subtracting any Hardware Reserved memory from the Installed RAM.

Modified

Shown in orange, the Modified list represents the pages of memory that contain data that has been modified but not been accessed for a while. As such it is not technically in use but can still be pulled into service quickly if needed. If memory in the Modified list has not been accessed in a long time, the memory manager will write the page to disk and then move it to the Standby list.

Standby

The Standby list, which is shown in blue, contains pages that have been removed from process working sets but are still linked to their respective working sets. As such, Standby list is essentially a cache. However, memory pages in the Standby list are prioritized in a range of 0-7, with 7 being the highest. Essentially, a page related to a high-priority process will receive a high-priority level in the Standby list.

For example, processes that are Shareable will be a high priority and pages associated with these Shareable processes will have the highest priority in the Standby list.

Now, if a process needs a page that is associated with the process and that page is now in the Standby list, the memory manager immediately returns the page to that process' working set. However, all pages on the Standby list are available for memory allocation requests from any process. When a process requests additional memory and there is not enough memory in the Free list, the memory manager checks the page's priority and will take a page with a low priority from the Standby list, initialize it, and allocate it to that process.

Free

The Free list, shown in light blue, contains pages of memory that have not yet been allocated to a process or were previously allocated but returned to the memory manager when the process ended. (While "not yet been allocated" and "previously allocated" memory both show in the Free part of this bar graph, the "not yet been allocated" pages are actually part of another list called the Zero Page list. These are so-called because they have been initialized to zero and are ready for use when the memory manager needs a new page.)

The question of Free memory

Now that you have a good idea of how the memory manager in Windows 7 works on a global level, let's take a few minutes to discuss a common misconception with Windows 7's memory management scheme. As you can see in Figure C, Free memory is the second smallest list in the graph. The misconception is to look at that small value and think that Windows 7 is a memory hog and that a system cannot run effectively when there is hardly any Free memory.

But just the opposite is true, in the case of Windows 7's memory management scheme, Free memory is wasted memory. The more memory that Windows 7 keeps in play, the better. By keeping memory full and juggling pages between the various lists along with using its Standby priority system, Windows 7 improves efficiency and does its best to keep memory pages from hitting the page file where Hard Faults and sluggish performance are more likely to occur.

Watching memory use

Do you want to see Windows 7's memory management scheme in action? To do so, restart your system. As soon as you get logged in, launch Resource Monitor, select the Memory tab, and immediately take note of the size of each of the lists shown on the Physical Memory bar graph.

Then begin loading applications -- lots of them -- the bigger, the better. As each application is loading, switch over to Resource Monitor and watch the size of the lists on the Physical Memory bar graph change. Once you have loaded as many applications as you want, begin closing them. As each application is closing, switch over to Resource Monitor and watch the size of the lists on the Physical Memory bar graph change.

Once you go through this exaggerated scenario, you'll have a good, front-row idea of how Windows 7's memory management scheme works on your system. Now that you know what to look for, you can use Resource Monitor to keep tabs on memory usage as you use your system during the course of a normal computing session.

What's your take?

What do you think about using Resource Monitor to keep tabs on memory usage? As always, if you have comments or information to share about this topic, please take a moment to drop by the TechRepublic Community Forums and let us hear from you.

Stay on top of the latest Microsoft Windows tips and tricks with TechRepublic's Windows Desktop newsletter, delivered every Monday and Thursday. Automatically sign up today!

About

Greg Shultz is a freelance Technical Writer. Previously, he has worked as Documentation Specialist in the software industry, a Technical Support Specialist in educational industry, and a Technical Journalist in the computer publishing industry.

26 comments
Rajdeep218
Rajdeep218

A very informative article.

A small note  to those, who found  faults in sentence  formations and the grammar. ....How many " informative " articles of yours  are available on the net ? Rise  up to the occasion to  digest whatever you can, instead of  finding faults !! 

kkmo13
kkmo13

i have 8 total gigs in my computer and is says there is 4 gigs of it given to hardware help?

jackob49
jackob49

thanks again Greg, as always you sparked my memory usage. Regards

cazzycool
cazzycool

Good overview, An example of what I have is: 1mb allocated to hardware, 3082mb in use 5mb modified, standby 995mb and free 13mb right now. underneath it says: Available 1008mb Cached 1000mb Total 4095mb Installed 4096mb I get freezing up problems and go slows all the time, everything takes forever, do I need more memory? [img][/img]

gr71cj5
gr71cj5

Thank you for the basic level of insight. Is there a more in depth article that would explain why all memory "In Use" is not accounted for in the Processes window, even when "Commit, Working, Shareable, & Private" are displayed and how to find what processes are using that memory? Example: I have 16GB in unit, RM shows 9.4 "In Use", 2.8 "Available", yet total of all memory in the "commit" column only comes to 527.3 MB. What is using the other 8.9GB of memory? Even if I add up all columns like they were unique amounts the total is still a small fraction of this "In Use" amount. Thank you, Glenn

telliamed
telliamed

1. In the Processes table, shouldn't the Commit value be always greater than the Working set? 2. Is there a way to find the total number of Hard faults (and not the per sec rate) for a process? 3. Is there a way to find how much swap is being currently used? 4. If there is sufficient physical memory in the system (e.g. 16GB) there shouldn't be any swapping/hard faults happening in the system. But it is still happening. Why is it so? Under what circumstances does Windows decide to swap even when there is free memory in the system? 5. Linux provides a sysctl (swappiness) to control the usage of swap and cache ("standby + modified" in Windows). Does Windows provide a similar mechanism? Thanks for an insightful article; now at least I understand what each term means.

simclardy
simclardy

I just learned a good deal about the resource monitor and memory. Thanks.

benw
benw

Thanks for the very informative article. I never knew there was a Resource Monitor in Windows 7 and your explanation of each column was very helpful.

fisico
fisico

La verdad bastante ilustrativo, entiende uno mejor el proceso del manejo de la memoria, muy bueno felicidades.

dsgoodrich
dsgoodrich

After noting all the grammatical errors in just the first two paragraphs, I stopped reading the article. Since it is clear the author lacks a basic grasp of the written word, it leads me to question his knowledge of the subject. I would have expected more from a TechRepublic writer

richard
richard

You say "Some folks have reported inordinately huge amounts of memory being allocated to the Hardware Reserved list. While I haven?t encountered this situation myself and can?t verify the suggested solution, many folks have reported that upgrading the system BIOS firmware solved the problem" On my system, I have 1027MB Hardware Reserved. I assume this is due to the twin 512MB video cards, and therefore am not surprised to see it. Surely I would have thought that values in this range are not too uncommon? I have 4GB installed on Win7 32bit - with 1GB of video, I can only access 3GB, but it is at least there if I go 64bit.

captgreg
captgreg

My new installation of 7 crashes in Resource Monitor when it hits the media exam stage. I think it worked once just after I installed an ATI graphic card to add a monitor.

sysabod
sysabod

Hi Greg:i found a strange scene that every time from booting the os, i launched my visual studio 2010,many(nearly 100) hard faults occurs, but my machine obviously have sufficient memory to meet the program,actually 2GB memory is installed.Also,if i close it and launch it again,the program runs efficiently with only zero or one hard faults So how to resolve this?

gak
gak

Or is there any other reason why MS, in its everlasting wisdom, made resource Monitor an administrative task?

MagusWRM
MagusWRM

So "Hard Faults/sec" is the access to virtual memory per second? Well, my Windows is in Portuguese, and the translation is something like "severe faults" ("Falhas Graves" in portuguese), bad translation... shame on you, micro$oft's translators.

bwills80
bwills80

My Hardware reserve sits at 3149 MB. I think it is because I run Windows Virtual WinXP on my Win 7 machine. I think this is how Win7 reserves space to run Windows Virtual WinXP Mode. I set my virtual WinXP memory at 1500 MB.

Mark W. Kaelin
Mark W. Kaelin

Have you tracked changes in your system memory resources using the Resource Monitor? What did it reveal? What do you think about using Resource Monitor to keep tabs on memory usage?

jdbarras
jdbarras

This is a technical article. Your comment would be relevant if this was, say, howtospeakenglish.com. Your mother was a hamster, and your father smelled of elderberries. Now, go away before I taunt you a second time-ah. By the way, your last sentence is missing the period. It made it difficult to understand your comment. Had that mistake been made at the beginning of your post, I would have had to stop reading it. Since it is clear you lack a basic grasp of the written word, it leads me to question your rank in the grammar police. If I had to guess, I would say that you're the rookie that makes the coffee runs for the proper grammar policemen. Brush up cadet!

1Rab
1Rab

Boo Hoo. I thought it was an informative piece.

Mark W. Kaelin
Mark W. Kaelin

While the first sentence in the first paragraph is arguably too long and could be split into two separate sentences, I would not consider it grammatical error. As an editor for TechRepublic I have to walk the fine line to keep from inserting my voice into another author's written word. Sometimes this means we run afoul of the "grammar police" and get comments like yours. This is a technical site, so our emphasis is always on the technical facts of a blog post. We tend to have a relaxed approach to stringent grammatical laws that do not add to the technical understanding of a topic.

darkstate
darkstate

Obviously you are not a regular because if you were, You would surely know the author has a great grasp of knowledge he tries to share with people. He gets my praise and I always look forward to his articles. All great people have an off day now and again, Its part of being human you know.

tenorman12
tenorman12

My system only shows 1MB of hardware reserve. according to all what I read here this is very small. Do I need more physical memory installed? I only have one and a half gigs of memory. Windows runs very smoothly with this.

gak
gak

Yes, you will see all 4 gigs with 64 bit. With 32 bits all you can use is about 3 gigs, with or without video cards.

oldfield
oldfield

Since launching vs2010 on first use is thowing hard faults it is most likely asking for shared memory already available to an existing process but never used. The shared memory got paged out from the other process - then got paged back once you launch vs2010 - since it is now actively used. This is quite likely with MS products as they are designed to share common libraries. If you launch it a second time then you don't get the page faults since win 7 will not have paged this memory out. How to resolved this - is not "solvable" - it is meant to do that. If it used its own private library (not shared) then it would have to creat it anyway - and page load is much quicker than just starting from scratch.

gak
gak

If you do not have integrated graphics or other integrated chips that use system memory, it is OK. Hardware will reserve its memory anyway, so do not worry.