Question about Windows kernel memory pools

Posted on 2009-02-13
Last Modified: 2012-05-06
Hi -

I am trying to understand something about the paged and nonpaged pools.
When I run poolmon.exe I see a number representing the total amount of
memory used in the pools(Pool N: and P:).  In general these numbers match
pretty well with TaskManager or ProcExp.  Now, I would expect if I added the
total number of bytes from the "Bytes" column (doing Paged and Nonp
separeately), that the number would match (within reason) the numbers
provided in the summary at the top.  However, I noticed that in many cases
these numbers are off (especially Paged) by sometimes hundreds of MB.

For example, on my system right now, if I total the bytes column of poolmon
for paged and nonpaged respectively, I get:

Paged 57198744 bytes (55858K)
NonP 25078840 bytes (24491K)

The total in the summary information shows:

InRam Krnl: 3616K    P:147112K
Pool        N:39772K   P:147756K

Can someone explain why there would be quite a difference in these numbers?  How can I account for the extra memory in the pools?


Question by:MikeG24
    LVL 76

    Expert Comment

    Paged means the memory space can be/has been swapped out and stored on disk until needed.

    I'm not really sure where you are heading or am I misinterpreting your question?  Look at Paged memory management as a 500 page loose leaf binder.  When you need a page of information, you open the binder and pull the page. While you have access to 500 pages, you will often have one or two in hand.

    Author Comment


    Where I am heading is this:  The kernel has a two pools of memory (internal to the kernel) to act as a scratch pad for kernel mode drivers.  The nonpaged pool is for used by drivers that need to access memory at an IRQL above the page fault level (cannot page).  The paged pool is a more general pool of pageable memory, but still is limited to kernel mode access. This space is limited, for the nonpaged pool, on x86 this size limit is 256MB (only 128 MB if booted with /3GB), the paged pool can be larger, around 500 MB.  This is not to be general memory that can be used in user mode.  Anyway, poolmon is a utility that can monitor this memory if pool tagging is enabled (by default it is on Windows Server 2003).  The tag provides a way of identifying which drivers is using the memory within each pool.  Here is an example of the output of poolmon:

     Memory: 2086960K Avail: 1065936K  PageFlts:3984437   InRam Krnl: 3616K P:147112K
     Commit: 830804K Limit:4018620K Peak: 846376K            Pool N:39772K P:147756K

     Tag  Type     Allocs         Frees    Diff   Bytes    Per Alloc
      waR Nonp         29        29         0       0          0        
        ( Paged        23        23         0       0          0        
     8042 Nonp          4         0         4    3944        986        
     ACPI Nonp         19        19         0       0          0        
      AEC Paged         3         3         0       0          0        
     AECd Nonp          7         7         0       0          0        
     AECi Nonp          7         7         0       0          0        
     ASCC Nonp          2         0         2     432        216        
     AcdN Nonp          2         0         2    1072        536        
     AcpA Nonp        100        97         3     192         64        
     AcpB Paged        40        36         4    1664        416        
     AcpD Nonp        593       488       105   36680        349    
    (this list goes on for about 1400 lines)

    What I am asking is why the sum of the "Bytes" column for each type does not eqaul the corresponding total in the summary at the top.  And if I cannot attribute the memory use to one of these items listed, who else is using it?  Or is it pool memory that was in use, still considered in use, but not attributed to any driver? (orphaned?)

    Does that make it more clear?
    LVL 38

    Expert Comment

    A memory leak is determined by the >>>difference (diff)<<< between allocations and frees of the memory. The memory leak can either be in the page or non-paged areas of the memory. Memory leaks are not defined as difference between paged and non-paged memory spaces. So, those will not really match up right.

    If you suspect you have a memory leak, can we get the stop error or information on your Blue Screen of Death?


    Author Comment

    Thanks for the info Chief.   What I am really trying to understand is how I can account for all of the memory in the kernel pools.  In the paged pool I cannot account for about 91898K (147756-55858); in the nonpaged pool I cannot account for about 15281 (39772-24491).  Where did it go?  Who is using it?  Why isn't accounted for by something with a pool tag?
    LVL 76

    Accepted Solution

    The difference could be a function of freed previously used memory.
    I believe that to save the overhead of releasing resources and then getting them back, the memory is released as far as not being used, and will be allocated to a new process as needed.
    Release and requests additional space wastes cycles.
    I guess a best example would be a print job. i.e. if you had to allocate and reclaim memory after each print job, you will be wasting resources unnecessarily. Leaving the previously allocated space, allows for a quicker allocation should another print job or other resources need additional space.
    LVL 38

    Assisted Solution

    This is a beautiful blog that might help you find the sizes of your pools.

    This explains that your paged pool and non paged pool are determined at boot up as a finite value. Anything your kernel doesn't used is still assigned to the pool, but may not be used.

    Arnold is right. Some of this memory pool will be reclaimed after the pool frees itself. So, these pools are dynamic in nature on how it allocates and frees, but the size of the pool is statically set upon bootup.

    Author Comment

    Thanks for the responses.  It came to my attention that the version of poolmon.exe was a tad old - Windows server 2003 support tools.  I have subsequently downloaded Support Tools for Windows 2003 SP2 and the results look much close now (not hundreds if MB off!)

    I will accept the last two comments as possible solutions, since they could help others.

    Author Closing Comment

    Thanks for the input!

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    Join & Write a Comment

    Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
    When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now