I was going to post up some stuff about using Poolmon and Memsnap, but you might as well just read the overview, syntax and example pages for these tools from the Technet site! Just make sure you enable gflags first on a Windows 2000 box, which requires a reboot before it becomes active. If you need to determine which specific instance of the allocation routine is causing the leak, see Using the Kernel Debugger to Find Kernel-Mode Memory Leaks.Just so it's easier for me to find, here is the technet site that covers all the Support Tools Addressing the LeakĪfter you have determined which pool tag is associated with the leak, this might reveal all you need to know about the leak. If it tends to allocate memory faster than it frees it, its memory use will grow over time.
#Poolmon.exe location free#
Typically, after an application reaches a stable running state, it allocates memory and free memory at roughly the same rate. How much of the tag was freed up in this time? By comparing screen shots, determine which tag's bytes are increasing. Take a screen shot and copy it to Notepad. Press B to sort the display by maximum byte use. If you do not know, do not press P and both kinds of pool are included. If you have determined that the leak is occurring in non-paged pool, press P once if you have determined that it is occurring in paged pool, press P twice. To find a memory leak with the PoolMon utility, follow this procedure: Using the PoolMon Utility to Find a Memory Leak Sorts tags by the difference between allocations and frees.
![poolmon.exe location poolmon.exe location](https://i1.wp.com/lokna.no/wp-content/uploads/2013/11/image4.png)
Repeatedly pressing P cycles through each of these options, in that order.Ĭauses the display to include the paged and non-paged totals across the bottom. Limits the tags shown to nonpaged pool, paged pool, or both. It takes a few seconds for each command to work. Press the letter associated with each command in order to re-sort the data. PoolMon has command keys that sort the output according to various criteria. The display is updated automatically every few seconds.
![poolmon.exe location poolmon.exe location](http://woshub.com/wp-content/uploads/2018/10/check-nonpaged-pool-usage-with-poolmon-exe-tool.png)
The columns show pool use for each pool tag. The PoolMon header displays the total paged and non-paged pool bytes.
![poolmon.exe location poolmon.exe location](https://danieladeniji.files.wordpress.com/2013/09/specifylocation.png)
On Windows Server 2003 and later versions of Windows, pool tagging is always enabled. You must restart Windows for this setting to take effect. Start GFlags, choose the System Registry tab, check the Enable Pool Tagging box, and then select Apply. GFlags is included in Debugging Tools for Windows. On Windows 2000 and Windows XP you must first use GFlags to enable pool tagging. Enable Pool Tagging (Windows 2000 and Windows XP)
#Poolmon.exe location full#
For a full description, see PoolMon in the WDK documentation.
#Poolmon.exe location driver#
This tool is included in the Windows Driver Kit (WDK). PoolMon (Poolmon.exe) monitors pool memory usage by pool tag name. If you suspect there is a kernel-mode memory leak, the easiest way to determine which pool tag is associated with the leak is to use the PoolMon tool.