Memory Management

Figure 1: Windows XP Task Manager

Figure 2 Vista Task Manager

Figure 3 Windows 7 Version

 Figure 1 shows the Windows XP Task Manager, Figure 2 shows the Vista Task Manager
and Figure 3 shows the Windows 7 version. Some major differences between Windows XP,
Windows Vista and Windows 7 shown in Table 1.
Task Manager Windows XP Windows Vista Windows 7
features
Services tab No Yes Yes
Performance
details for memory
for memory NO Yes (overview only) Yes (detailed tab for
network, CPU, each)
disk
CPU usage per Yes Yes Yes
processor
Applications Yes Yes Yes
Processes Yes Yes Yes
Additional Yes, but limited: Yes (private working Yes (same as Vista)
columns for Mem Usage is set, many others)
processes working set, but no
private working set
 Table: 1

The services are a huge improvement for the Vista and Windows 7 Task Manager over
XP. Figure 1, there are processes listed as svchost.exe. Since this process is basically and
umbrella that other processes run under, it is difficult to see what the offending process really is.
In windows XP, use the task list command to break the processes out of svchost. Figure 4a, the
Task Manager shows svchost.exe process with a Product ID (PID) of 1144.

By clicking on the Services tab and sorting on the PID column (Figure 4b) in the Vista or
Windows 7 Task Manager, can easily see all the processes running under this svchost.exe.

The second item in the table is Performance Details. Figure 5 shows the Vista
Resource Monitor Memory view, which dynamically displays hard faults per second (for writing
to disk) and used physical memory (assuming this to be opposite of whats available). It also
includes network, disk and CPU displays. This provides a quick glance at process statistics
memory usage.
 Figure 4a svchost.exe

Figure 4b Windows 7 Task Manager

 Figure 5Vista Resource Monitor Memory

In the Memory table, one process, svchost.exe (secsvcs), has 1,061 hard faults, which
could be running low on memory, causing memory paging to the disk. It should be investigated.
Dynamically monitor for a few minutes to see the hard fault count increase quickly.

Figure 6 Windows 7 Task Manger features

 Figure 6 shows one of the most useful Windows 7 Task Manager features, Resource
Monitor. It shows a histogram of used physical memory, hard faults and the commit charge (this
is the memory being used by processes not just reserved). The Resource Monitor shows an easy-
to-read colored bar graph, which dynamically shows the memory allocation.

Windows memory management available memory can be used to start another

application or serve new demands for existing open apps. Available memory in Figure 6 is the
sum of the Standby and Free quantities. The Modified quantity is the modified page list pages
that are modified but have not been used for a while. This is a great to the problem of trying to
understand the memory terms in the Task Manager Performance tab. It is easy to match these up
with memory manager list.

Memory leaks are usually easy to diagnose if use the proper method and gather the right
data. When and application terminates, it is working-set memory pages are released to the Free
list, which are then zeroed and reused by other application. That is why, if running low on
memory, terminating some application will free up memory for others.

In Figure 1 shows a Windows XP Task Manger and the Mem usage column. This column
shows the working set memory for each process and is displayed by default. It is not useful for
memory leak detection because once the set hits maximum that Windows Memory Management
will allow, it will be trimmed and stay there. Go to View, Select Columns menu, and add the VM
Size (virtual memory) column. This will show the whole pictures of what is being used.
 Figure 7 default Working Set (Memory) and the Memory (Private
Working Set)

In windows 7, the columns are more clearly labeled. Figure 7 shows the default Working
Set (Memory) and the Memory (Private working Set) column. The Working Set column is
equivalent to the Mem Usage column in Windows XP, while the Private Working Set shows the
private pages, the modified pages, that would grow continually in the case of a memory leak.

The working Set pages would normally increase and decrease as the page trimming takes
place. Over time, a memory leak would gradually show an increase and not recover, possibly
resulting in the process hanging.