Methods of Monitoring Server Memory

This section is a brief review of the most important memory monitoring techniques. Windows NT Workstation Resource Guide includes a detailed discussion of some basic techniques for monitoring memory in Chapter 12, "Detecting Memory Bottlenecks," and Chapter 15, "Detecting Cache Bottlenecks." For more information on the tools discussed in this section, see Chapter 10, "About Performance Monitor," and Chapter 11, "Performance Monitoring Tools" in the Windows NT Workstation Resource Guide. Programmers can find additional memory optimizing techniques in the Win32 Software Development Kit.

Many performance monitoring tools measure system-wide and per-process memory use. These tools include Task Manager, Process Monitor (Pmon.exe), Process Viewer (Pviewer.exe), Process Explode (Pview.exe), PerfLog (Pdlcnfig.exe and Pdlsvc.exe), and Performance Monitor. PerfLog and Performance Monitor can measure memory use over time.

Here are a few guidelines for using Performance Monitor and PerfLog to monitor overall server memory use:

Monitor available memory. The server must maintain enough available memory to support the operating system and all applications and services it runs. Compare the total physical memory available to Windows NT to the available memory remaining when you are running all server services. To gather more reliable data, log this value over time, making certain to include periods of peak activity. The system attempts to keep available bytes at 4MB or more, but it is prudent to keep at least 5 percent of memory available for peak use.

To determine the physical memory available to Windows NT, double-click My Computer, and then click About Windows NT from the Help menu. Memory Available to Windows NT is displayed above the OK button. Total physical memory is also listed on the Performance tab in Task Manager. To start Task Manager, press ctrl+shift+esc.

To track available memory, use Performance Monitor or PerfLog to log the Memory: Available Bytes counter.

Monitor paging. Continuous high rates of paging indicate a memory shortage. Paging occurs when code or data requested by an application or service is not found in physical memory and must be retrieved from disk. The more memory the server has, the more data the system can store in memory and the more likely it is that the code or data requested is stored in memory. If required data is stored in memory, it does not need to be paged in from disk.

Paging is measured in several ways:

Numbers of page faults. Page faults occur when the system cannot find a requested page in the working set of the process that requested the page. The system also counts a page fault on file accesses if the requested page is not found in the file system cache.

To measure page faults on working sets and on the file system cache, use Performance Monitor or PerfLog to log the Memory: Page Faults/sec and Memory: Cache Faults/sec counters.

Disk reads due to page faults. All page faults interrupt the processor. Only hard faults, those that require reading from disk, delay system response. Monitor hard faults and compare the rate of hard faults to all page faults. In general, a sustained rate of more than five hard faults per second indicates a memory shortage.

To measure hard faults, use Performance Monitor or PerfLog to log the Memory: Page Reads/sec counter. Use the Memory: Page Faults/sec counter as an indicator of all page faults.

Monitor the file system cache. The file system cache is the working set of the file system. This cache is a reserved area in physical memory where the file system stores its recently used and frequently used data. By default, the system reserves about 50 percent of physical memory for the file system cache, but the system trims the cache if it is running out of memory. A large and effective file system cache is vital to IIS servers, which function like specialized file servers. This topic is discussed in more detail in "Monitoring the File System Cache" later in this chapter.

Monitor the size of the paging files. The paging files on disk back up committed physical memory. The larger the paging file, the more memory the system can commit. Windows NT creates a paging file on the system disk. You can create a paging file on each logical disk, and enlarge existing files.

To monitor the paging files, use Performance Monitor or PerfLog to log Process: Page File Bytes: Total.

Monitor the size of the paged and nonpaged memory pools. The system's memory pools hold objects created and used by applications and the operating system. The paged pool holds items that can be paged to disk. Items in the non-paged pool must remain in physical memory. The contents of the memory pools are accessible only in privileged mode. On servers running Internet Information Server, the IIS threads that service connections are stored in the nonpaged pool, along with other objects used by the service, such as file handles.

To monitor the pool space for all processes on the server, use Performance Monitor or PerfLog to log the Memory: Pool Paged Bytes and Memory: Pool Nonpaged Bytes counters. To monitor the pool space used directly by Internet Information Server, log the Process: Pool Paged Bytes: Inetinfo and Process: Pool Nonpaged Bytes: Inetinfo counters for the Inetinfo process.

These general monitoring techniques are useful for any Windows NT Workstation or Server. The following sections discuss techniques for monitoring components specific to the IIS service.