Microsoft provides various tools to analyze memory usage and memory issues in Windows, such as the built-in Task Manager, Resource Monitor, and Performance Monitor, and SysInternals tools such as RAMMap and PoolMon. This topic describes how to use the preceding tools. For more information, see the corresponding Microsoft documentation.
This topic uses Windows Server 2012 as an example. The user interface may vary across different operating system versions. The actual interface on your operating system takes precedence.
Task Manager
You can use Task Manager to monitor memory usage on a Windows system. It provides detailed information about memory-consuming processes. On the Performance tab, you can check the virtual memory usage. If the amount of committed virtual memory (Committed Bytes) is close to the commit limit (Commit Limit), the system experiences performance issues.
Remotely connect to the Windows server.
On the Windows desktop, open
> Task Manager.Click the Performance tab. On the left, click Memory to view memory usage.
Resource Monitor
You can use Resource Monitor to view detailed memory usage for each process.
Remotely connect to the Windows server.
In the search box on the taskbar, enter
Resource Monitor, and then open the application.Click the Memory tab to view the memory usage of each process. For each process, pay close attention to the value in the Commit (KB) column. Identify processes that consume a large amount of memory and determine whether their consumption is normal for your business needs.
Physical memory usage consists of the following parts.
Hardware Reserved: Memory reserved for hardware.
In Use: Memory used by processes, drivers, and the operating system.
Modified: Memory whose contents must be written to disk before it can be used for other purposes.
Standby: Memory that contains cached data and code that are not actively in use.
Free: Memory that does not contain any valuable data and is used first when processes, drivers, or the operating system need more memory.
Cache: When a file is opened, the system stores it in the cache for faster access. In Windows Server 2008 R2 and later, the system limits the amount of memory that can be used for the file cache. This ensures that enough physical memory remains available for applications, even when the cache is large.
Performance Monitor
Performance Monitor is an important tool for monitoring and collecting system resource consumption data in Windows.
Remotely connect to the Windows server.
In the search box on the taskbar, enter
Performance Monitor, and then open the application.In the upper-left corner, choose .
By default, Performance Monitor samples various system resources once per second.
Add counters and view their performance data.
Quickly add counters
To check system resource consumption in real time, click the
icon and add counters as prompted. 
On the Performance Monitor page, view the performance data for the added counters.
Add user-defined counters
In the navigation pane on the left, choose .
Hover over User Defined, right-click, select New, and then follow the on-screen instructions to add counters.
For example, add the Logical Disk, Memory, System, Processor, and Process counters to view the real-time resource status. You can also define the collection frequency by setting the sampling interval. For example, if the server has a memory leak that takes a long time to reproduce, set the sampling interval to 5 seconds. If the server frequently experiences high CPU usage, set the sampling interval to 1 second.
On the Performance Monitor page, view the performance data for the added counters.
RAMMap, Process Explorer, and Poolmon
RAMMap
RAMMap is a memory analysis tool from Microsoft. Sometimes, Task Manager may not show any processes with high memory usage, even when physical memory is fully utilized. This often indicates that the memory is being used by the underlying system. You can use RAMMap to view system memory usage that is not displayed in Task Manager.
Process Explorer
Process Explorer is a process management utility from Microsoft that provides more detail than the built-in Windows Task Manager. You can use Process Explorer to view detailed resource usage for each process, such as its consumption of various types of memory resources.
Poolmon
Poolmon is a free tool from Microsoft. The two core memory resources for the Windows kernel are the non-paged pool and the paged pool. Performance issues in the operating system often occur because these memory resources are exhausted. Although other tools can show overall resource consumption, Poolmon is required to identify the specific pool tag that is consuming the resources.
You can check the perfmon logs to find which pool tag is causing resource exhaustion. For example, if you find that the IoDn tag is exhausting the resources, you can use the following command to identify SafeDogFileGuard.sys as the cause. You can then resolve the issue by fixing the corresponding application.
findstr /m /l IoDn *.sysThe system displays output similar to the following.
