Microsoft provides various tools to analyze memory usage and memory issues in Windows, such as the built-in Task Manager, Resource Monitor, and Performance Monitor, and SysInternals tools such as RAMMap and PoolMon. This topic describes how to use the preceding tools. For more information, see the corresponding Microsoft documentation.
In this topic, Windows 2012 is used. The graphical interfaces vary based on the Windows operating system version.
Task Manager
In Windows, you can use Task Manager to monitor memory usage and view information about processes that consume memory resources. You can check the virtual memory usage on the Performance tab based on the Committed field (committed bytes/commit limit). If the committed bytes value of virtual memory is close to the commit limit value, performance issues may occur.
Connect to a Windows Elastic Compute Service (ECS) instance.
On the Windows desktop, choose
> Task Manager to open the task manager. Click the Performance tab. In the left-side navigation pane, click Memory to view the memory usage.
Resource Monitor
You can view the memory usage, including per-process memory usage, in Resource Monitor.
Connect to a Windows ECS instance.
In the search box on the taskbar in the lower-left corner of the Windows desktop, enter
Resource Monitorto search for and open Resource Monitor.Click the Memory tab to view the memory usage of each process. Check the Commit (KB) value of each process and find the process that consumes the largest amount of memory. Then, check whether the process runs as expected based on your business requirements.
The physical memory consists of the following parts:
Hardware-reserved memory: Memory that is reserved for hardware.
Memory in use: Memory that is used by processes, drivers, and operating systems.
Modified memory: Memory whose content must be written to a disk before the memory can be used for other purposes.
Standby memory: Memory that contains unused cache data and code.
Available memory: Memory that does not contain valuable data and is preferentially used when processes, drivers, and operating systems require more memory.
Cache: Memory that caches a file after the file is open to ensure that the file can be quickly read and written the next time the file is accessed. Windows 2008 R2 and later restrict the use of cache. Specific physical memory is not consumed by cache to ensure that physical memory is still available to meet application requirements when the cache is excessively large.
Performance Monitor
Performance Monitor is an important Windows tool for monitoring system resource consumption and collecting the corresponding statistics.
Connect to a Windows ECS instance.
In the search box on the taskbar in the lower-left corner of the Windows desktop, enter
Performance Monitorto search for and open Performance Monitor.In the left-side navigation pane, choose .
Performance Monitor samples data of all types of system resources once per second.
Add counters and view the performance data of the counters.
Quickly add counters
To check the usage of system resources in real time, click the
icon and add counters as prompted. 
In the Performance Monitor window, view the performance data of the counters that you added.
Add custom counters
In the left-side navigation pane, choose .
Right-click User Defined, choose New > Data Collector Set, and then add a counter based on your business requirements.
For example, you can add the Logical Disk, Memory, System, Processor, and Process counters to view the real-time running status of resources and define the sampling interval at which data is collected. For example, if memory leaks occur on an ECS instance and recur only after an extended period of time, set the sampling interval to 5 seconds. If the ECS instance frequently encounters CPU exceptions, set the sampling interval to 1 second.
In the Performance Monitor window, view the performance data of the counters that you added.
RAMMap, Process Explorer, and Poolmon
RAMMap
RAMMap is a memory analysis tool provided by Microsoft. If the monitor window of Task Manager does not display a process with abnormal memory usage but the physical memory is overloaded, memory consumption issues may occur at the underlying layer of the system. In this case, you can use RAMMap to view the consumed memory whose usage is not displayed in Task Manager.
Process Explorer
Process Explorer is a process resource manager provided by Microsoft. This tool provides more details than Task Manager. You can view the detailed resource usage of a process in Process Explorer. For example, you can view the memory usage of a specific process in Process Explorer.
Poolmon
Poolmon is a free tool provided by Microsoft. The core memory resources of the Windows kernel are called non-paged pools (non-paged buffer pools) and paged pools (paged buffer pool). When the preceding pool resources are exhausted, memory performance issues may occur in the operating system. If you need to query the resource consumption of a specific pool tag, you can use Poolmon to monitor the resource usage of the pool tag.
Query Perfmon logs to find the pool tag that caused resource exhaustion. For example, if the IoDn tag caused resource exhaustion, run the following command to find SafeDogFileGuard.sys, and then repair the application:
findstr /m /1 IoDn *.sysThe following figure shows a sample command output.
