I am trying to track down a memory issue and don’t really know how to find
out how much memory is being used…
I do !memusage and get the following:
kd> !memusage
loading PFN database
loading (100% complete)
Compiling memory usage data (99% Complete).
Zeroed: 18795 ( 75180 kb)
Free: 332 ( 1328 kb)
Standby: 48838 (195352 kb)
Modified: 362 ( 1448 kb)
ModifiedNoWrite: 2 ( 8 kb)
Active/Valid: 62639 (250556 kb)
Transition: 2 ( 8 kb)
Unknown: 0 ( 0 kb)
TOTAL: 130970 (523880 kb)
Building kernel map
Finished building kernel map
Scanning PFN database - (100% complete)
Usage Summary (in Kb):
Control Valid Standby Dirty Shared Locked PageTables name
…
82059130 4 0 0 0 0 0 mapped_file( $Directory )
00000000 20 0 0 8 0 0 PagedPool
-------- 2556 35808 1068 ----- ----- 220 pagefile section (3e01)
-------- 3632 0 0 ----- ----- 192 pagefile section (e89c)
-------- 7988 0 0 ----- ----- 232 pagefile section (c21a)
-------- 20 0 0 ----- ----- 20 pagefile section (39)
-------- 1128 0 0 ----- ----- 92 pagefile section (e67f)
-------- 412 0 0 ----- ----- 112 pagefile section (de0d)
-------- 3392 0 0 ----- ----- 104 pagefile section (1133a)
-------- 476 0 0 ----- ----- 76 pagefile section (1e778)
-------- 1024 0 0 ----- ----- 116 pagefile section (131c2)
-------- 2912 0 0 ----- ----- 176 pagefile section (123e6)
-------- 804 0 0 ----- ----- 88 pagefile section (e3c1)
-------- 760 0 0 ----- ----- 56 pagefile section (1304b)
-------- 556 0 0 ----- ----- 84 pagefile section (1264b)
-------- 444 0 0 ----- ----- 64 pagefile section (e583)
-------- 1808 0 0 ----- ----- 112 pagefile section (13058)
-------- 576 0 0 ----- ----- 64 pagefile section (12ce4)
-------- 580 0 0 ----- ----- 76 pagefile section (1ef0c)
-------- 64 0 0 ----- ----- 52 pagefile section (13f63)
-------- 392 0 0 ----- ----- 52 pagefile section (14655)
-------- 252 0 0 ----- ----- 36 pagefile section (12b33)
-------- 64 60 112 ----- ----- 40 pagefile section (e72a)
-------- 440 88 100 ----- ----- 96 pagefile section (19b83)
-------- 1004 0 0 ----- ----- 120 pagefile section (12252)
-------- 156 0 0 ----- ----- 120 pagefile section (b587)
-------- 184 0 0 ----- ----- 36 pagefile section (6938)
-------- 140 0 0 ----- ----- 48 pagefile section (dcaa)
-------- 8 0 0 ----- ----- 8 pagefile section (538c)
-------- 164 0 0 ----- ----- 44 pagefile section (fb10)
-------- 164 0 0 ----- ----- 96 pagefile section (11f18)
-------- 168 0 0 ----- ----- 88 pagefile section (e97a)
-------- 76 0 0 ----- ----- 36 pagefile section (f871)
-------- 92 0 0 ----- ----- 52 pagefile section (12591)
-------- 44 0 0 ----- ----- 36 pagefile section (d65f)
-------- 8 0 0 ----- ----- 8 pagefile section (e7d6)
-------- 100 0 0 ----- ----- 76 pagefile section (fc93)
-------- 8 0 0 ----- ----- 8 pagefile section (175a8)
-------- 68 0 0 ----- ----- 64 pagefile section (11a54)
-------- 44 0 0 ----- ----- 40 pagefile section (11bcc)
-------- 100 0 0 ----- ----- 64 pagefile section (11f25)
-------- 60 0 0 ----- ----- 24 pagefile section (13f26)
…
-------- 88500 0 0 ----- 0 ----- driver ( Paged Pool )
-------- 944 80 160 ----- 0 ----- driver ( Kernel Stacks )
-------- 0 0 0 ----- 0 ----- driver ( NonPaged Pool )
It looks to me that I am out of nonpaged memory, but doing !poolused I get
the following (sorted by used nonpaged)
kd> !poolused
Sorting by Tag
Pool Used:
NonPaged Paged
Tag Allocs Used Allocs Used
NtFL 16 122048 103 4120 LogSup.c , Binary: ntfs.sys
Rx?? 9 138368 513 35721216 Rdr2 rdbss.sys stuff
NtFs 3574 144112 4164 251096 StrucSup.c , Binary: ntfs.sys
Ntfn 3599 144552 0 0 SCB_NONPAGED , Binary: ntfs.sys
WEBD 4 185472 0 0 UNKNOWN pooltag ‘WEBD’, please
update pooltag.txt
Ntf0 3 196608 3499 157272 general pool allocation ,
Binary: ntfs.sys
Thre 400 256000 0 0 Thread objects , Binary: nt!ps
Irp 672 260384 0 0 Io, IRP packets
CcSc 884 275808 0 0 Cache Manager Shared Cache Map ,
Binary: nt!cc
Ntfr 6069 389384 0 0 ERESOURCE , Binary: ntfs.sys
LSwr 128 406528 0 0 raw work context
MmCm 94 533504 0 0 Calls made to
MmAllocateContiguousMemory , Binary: nt!mm
File 3975 616280 0 0 File objects
Ddk 1310 848952 9 544 Default for driver allocated
memory (user’s of ntddk.h)
Devi 289 1397456 0 0 Device objects
LSwi 1 2568192 0 0 initial work context
TOTAL 40515 11069664 632318 180022576
This says I am only using 11MB of nonpaged, and 180mb of paged.
Sorted by used paged I get
Disp 0 0 12 11041952 UNKNOWN pooltag ‘Disp’, please
update pooltag.txt
Rx?? 9 138368 513 35721216 Rdr2 rdbss.sys stuff
MntA 9 4032 571986 64061296 UNKNOWN pooltag ‘MntA’, please
update pooltag.txt
What it MntA?
My main question is how do I determine how much memory I have in the memory
dump, and how to find who is using it. I keep getting 0xc0000044
(insufficient quota) and 0xc000009a (insufficient resources) errors opening
files (ZwCreateFile).
Thanks,
Rob