JBJBWindows NT 4.0 has a virtual-memory system that combines physical memory, the file system cache, and disk into a flexible information storage and retrieval system. The system can store program code and data on disk until it is needed, and then move into physical memory. Code and data no longer in active use can be written back to disk. In this way, processes benefit from the combined space of memory and disk. But when a computer does not have enough memory, code and data must be written to and retrieved from the disk more frequently—a slow, resource-intensive process that can become a system bottleneck.
The best indicator of a memory bottleneck is a sustained, high rate of hard page faults. Hard page faults occur when the data a program needs is not found in its working set (the physical memory visible to the program) or elsewhere in physical memory, and must be retrieved from disk. Sustained hard page fault rates—over 5 per second—are a clear indicator of a memory bottleneck. To monitor hard fault rates and other indicators of memory performance, log the System, Memory, Logical Disk and Process objects for several days at an update interval of 60 seconds. Then use the following Performance Monitor counters, described in this chapter:
Object | Counter | |
Memory | Page Faults/sec | |
Memory | Page Reads/sec | |
Memory | Page Writes/sec | |
Memory | Pages Input/sec | |
Memory | Pages Output/sec | |
Memory | Available bytes | |
Memory | Nonpaged pool bytes | |
Process | Page Faults/sec | |
Process | Working set | |
Process | Private Bytes | |
Process | Page File Bytes | |