Critical Impact


Performance Data High Kernel Memory Utilization In NonPaged Bytes Suspected Memory Leak

This alert condition indicates that system paged pool memory is leaking. If system paged pool memory is exhausted, a Windows Server may stop responding or become sluggish. A hard reboot may be required if the server stops responding.

Performance Data High Kernel Memory Utilization In PoolPaged Bytes Suspected Memory Leak

This alert condition indicates high kernel memory utilization in PoolPaged Bytes. Several factors may deplete the supply of paged pool memory. Enabling pool tagging and taking poolsnaps at different time intervals may help you to understand which driver is consuming paged pool memory. If the poolsnaps indicate that the MmSt tag (Mm section object prototype Page Table Entries (PTEs) is the largest consumer and paged pool memory has been depleted or the system is logging error event 2020, there is a high probability that there is a very large number of files that are open on a server. By default, the Memory Manager tries to trim allocated paged pool memory when the system reaches 80 of the total paged pool. Depending on the system configuration, a possible maximum paged pool memory on a computer can be 343 MB and 80 of this number is 274 MB. If the Memory Manager is unable to trim fast enough to keep up with the demand this issue can result. By tuning the Memory Manager to start the trimming process earlier (for example, when it reaches 60), it would be possible to keep up with the paged pool demand during sudden peak usage, and avoid running out of paged pool memory.

Performance Data System Is Low On PTE's

This alert condition indicates that the system is running low on Page Table Entries (PTEs). A page table is the data structure used by the Windows Virtual Memory Manager (VMM) to store the mapping between virtual addresses and physical addresses in memory. The performance counter Free System Page Table Entries is the number of page table entries not currently used by the system. From the process perspective, each element of virtual address conceptually refers to a byte of physical memory. It is the responsibility of the Virtual Memory Manager (VMM) in conjunction with processor memory management unit (MMU) to translate or map each virtual address into a corresponding physical address. The VMM performs the mapping by dividing the RAM into fixed-size page frames, creating system PTEs to store information about these page frames, and mapping them. System PTEs are small kernel-mode buffers of memory that are used to communicate with the disk I/O subsystem and the network. Each PTE represents a page frame and contains information necessary for the VMM to locate a page.

Last modified April 17, 2020