Tag Archives: Memory

How to measure Windows 2008 Memory usage

The counters you use to monitor Windows 2008 R2 RAM are the same with what you use to monitor Win 7.

  • If you want the best performance, use Total – Free as the sizing.
  • If you want a more cost effective solution, use Total – Free – Standby.
  • Keep % Committed to below 80%
  • Ensure pagefile.sys is not larger than the physical RAM. If Windows increase it, it’s a sign of it’s not having enough RAM.

To avoid repeat of blog, you can see the details recommendation here.

Windows 2008 R2 manages memory slightly differently to Windows 7 x64. While it is based on the same kernel, the difference is visible from what a small test that I conducted. I encourage you to perform your own real world test, not synthetic, in your environment.

Windows uses both the physical memory and virtual memory concurrently. The challenge is, if you look at the actual metrics, it is not clear how it actually prefers one over the other. In my case, Windows still had >300 MB of physical memory (on Standby and Free) yet Windows used the virtual memory extensively already. The paging file usage was >50% and it had increased the pagefile.sys size by 10%. Performance, at least from the UI, was however still good. This is different to Windows 7 x64, where the performance visibly dropped. Windows 7 in fact gave warning messages. Windows 2008 R2 just continued running well as if it had no memory shortage. The screenshot below showed the Standby actually dropped to 46 MB and Free dropped to a mere 8 MB in Windows 2008.

Windows 2008 running MS AD - 5 windows patch no warning whatsoever

Windows 7 64 bit, on the other hand, gave warning when it still had plenty of RAM. See the screenshot below. From the Task Manager, you can see that it only used 6.15 GB, meaning I still had 1.85 GB of physical RAM. From the Resource Monitor, I had 1709 MB Available RAM (Standby RAM + Free RAM). Plenty of physical RAM, as I disabled the paging file. Yet, Windows already gave a warning message, suggesting me to close an application. It suggested that I closed Windows Explorer.

0 Windows gave error message even though I have 1 GB free

I ignored it, since I had plenty of RAM. I opened a small application, which I knew would fit easily. I chose MS Paint. To my surprise, Windows 7 did not tolerate it. It opened MS Paint, but it gave an error. In fact, beyond giving warning, some applications actually crashed. In my case it was both MS Word and Google Chrome.

0 Hit issue - Word hit issue, Chrome hit issue

Another difference between Windows 7 x64 and Windows 2008 R2 is SuperFetch is disabled in the later. In fact, the service is hidden from the Services list. In Windows 7, it is not hidden. It is automatically disabled when Windows 7 detects it runs on SSD.

10 Windows7 superFetch disabled

Back to the Windows 2008. Since the memory is running low, it makes sense to increase. I changed it from 3 GB to 4 GB, and continued the update/patching process. Since I have more RAM, I also update Java at the same time. Notice the RAM is healthier now.

MS AD with 4 GB RAM - patch n Java

The next screenshot was after Java was installed, and it’s now doing Windows updates installation. While the Free Memory was low, the Standby Memory was acceptable. If you want to be conservative, you can increase it to 5 GB. For my use case, 4 GB is good enough.

MS AD with 4 GB RAM - patch - better 2

I hope you find the information useful. Follow this to see how to use vRealize Operations End Point to monitor Windows memory.

Right-sizing Windows 7 RAM

Right-sizing RAM is certainly a common requirement, as we know VM tend to be oversized. However, we need to be careful when reducing RAM. Reducing RAM on VM based on information at the hypervisor level can result in poor performance. You need to have in-guest level data.

I did a set of test on a physical desktop to see Windows memory behaviour. I did it on physical so we know for sure there is no hypervisor impacting any reading here.

I have 64 bit Windows 7 on a physical desktop with 4 GB RAM. For a test on 8 GB RAM, see this as the result is not the same, even though the workload is similar.

Screenshot #1

1 - Win 7 - after boot - stable - 0 page fault

  1. I boot up the machine, and let it idle for a few minutes to ensure all start up programs have finished running. I want them to “settle down”…
  2. Modified (orange), means memory that is no longer in the Working Set of a process, but it has been modified. Windows needs to write to the page file before releasing it to the Standby pool. See this for more details.
  3. The screenshot shows that Windows 7 64 bit uses 1296 MB of RAM (162 + 1055 + 79). The Standby Memory means it contains cached data that is no longer actively in used. How does Windows define “actively in used” is not clear. If a block of RAM is not used in the past 1 minute, is it active? How about 10 minutes? 1 hour? The next few screenshots will clarify that.
  4. We have 674 MB of Standby and 2126 of Free as you can see above.

Screenshot #2

2 - Win 7 - after opening lots of files and apps - CPU

  1. I then launched a lot of common apps, and open lots of files. I opened 13 large PowerPoint files and 10 Adobe PDF files. You can see in the screenshot, the task bar is full of documents.
  2. Naturally, CPU and Disk would spike, so I let them settle down first. My focus here is RAM.
  3. The screenshot is taken after Windows settles down.
  4. You notice CPU has gone down. My desktop has 4 cores, and 2 cores are actually parked. You can see that the only CPU-consuming process is the Resource & Performance Monitor itself, and the Desktop Window Manager, as it has to redraw the screen.
  5. Both PowerPoint and Adobe has gone down to 0%, as they are done opening files.

Screenshot #3

3 - Win 7 - after opening lots of files and apps - RAM stable

  1. After verifying that CPU has settled down, I verify the RAM.
  2. Unlike CPU, we have a very different situation here for RAM. This is key to explaining why you cannot just downsize RAM without consulting application team.
  3. Windows now use 2553 MB. Much higher than 1296. Obviously the executables of PowerPoint, Adobe, Excel are in the RAM.
  4. The Free Memory has gone down from 2126 to just 469 MB.
  5. The Standby Memory increases from 674 to 1074. This is the 23 ppt/pdf files that were opened and after that not touched by. All I did was just opened them. So from here we can tell that “active” is a relatively short time, it’s in seconds or minutes. In my subsequent observation, it is actually in seconds.

Screenshot #4

4 - Win 7 - after forcing powerpoint to draw all slides by going into slide sorter view and scroll - same with adobe - RAM increase

  1. Based on screenshot #3 (not #4), I could conclude whether PowerPoint or Adobe read the entire files. I think it reads more than the first page or the first slide, but probably not all. I knew from other tests that 1 MB of powerpoint file translates to 15 MB in RAM. I still have 469 MB of Free RAM, while I think it should be lower.
  2. So I forced PowerPoint to read the entire content of almost every files. What I did what go to each file, change to “Slide Sorter” view, wait until PowerPoint redraws all slides, scroll down, wait until it redraws, repeat until the last slide is drawn. This ensures PowerPoint read every slide, and brought it to RAM. I did the same thing some of the Adobe file.
  3. The Free RAM dropped from 469 MB to just 9 MB. It’s interesting it does not go down to 0. This is showing Windows memory management. The Standby remains high, from 1074 to 953. This is a proof that “active” is a relatively short time.

Screenshot #5

5 - Win 7 - after idling for 40 minutes - RAM is still high because there is no pressure to release

  1. I let my desktop idle for 40 minutes. Naturally, Windows went to sleep mode after a while. I wanted to see the effect of sleep mode on RAM.
  2. When I brought up Windows from Sleep mode, I checked the RAM. Screenshot #5 shows that it’s hardly change. The Free RAM remains low, Standby is about the same, and In Use is about the same.
  3. It looks like Windows treat executables differently than it does data. I think the In Use Memory is the apps, and not the data. However, I’m not 100% sure here.
  4. It is confirmed that Sleep does not flush the RAM content.
  5. I am not able to check page fault as Resource Monitor does not have it. But when I use PerfMon, I can see paging.
  6. You can see paging at vCenter if you separate the page file into its own vmdk file. This is something you should consider as standard. You can then use vRealize Operations to monitor for abnormal behaviour. For example, the VM owner complains that the VM became slower since last weekend change. You do not see any significant difference in memory, CPU, Disk or network utilisation. Your ESXi host was healthy too, delivering very low contention. However, vRealize Operations shows abnormal behaviour in the vmdk file that hosts the page file (and only the page file). It has much higher read and write. From here you can at least say that there is excessive paging. This topic is covered in depth here.

Screenshot #6

6 - Win 7 - after closing all apps - RAM is cleared

  1. I closed all apps. As expected, the memory got back to near the original situation, when I had no apps open.

Screenshot #7

7 - Win 7 - after launching PowerPoint and open 8 MB file

  1. I launch PowerPoint again, but this time only open 1 file (8 MB). I do not launch other apps.
  2. Notice the Standby Memory remains the same. So Windows keeps it, and uses the Free Memory instead. This makes sense.

Screenshot #8

8 - Win 7 - Standby and Free do not reduce even if we use more than 4 GB

  1. I launched Visio installer and OpenOffice installer. Total 560 MB file.
  2. I also launched Word, Adobe, etc.
  3. I notice Windows Free Memory did touch 0 MB for 1 second, and then Windows keeps it above it. You notice in the screenshot that the Standby Memory actually goes up by around 500 MB.
  4. This confirms that Standby is adjusted in seconds, not minutes. This means Active is in seconds too.

Screenshot #9

9 - Win 7 - Closing installer software removes 500 MB from RAM

  1. I closed both the installer programs.
  2. The Active memory (In Use) remains the same.
  3. The Free Memory goes up by around 500 MB, while Standby drops by 500 MB.
  4. This means we know the installer was in the Standby Memory.

Screenshot #10

10 - Win 7 - Closing 25 MB of ppt files frees up 380 MB

  1. I closed 25 MB worth of PowerPoint files.
  2. The Standby remains the same, so we know the files were not in Standby. They were in “In Use”, as it drops and the Free Memory goes up by 380 MB.


  1. Memory tends to stay even though it is not used. It is much more stable than CPU. This is because Windows does not know when it will be used again, so it just keeps the pages there, just in case. This makes sense. So the RAM remains idle.
  2. Because they are idle, the Hypervisor (VMkernel) will think they are not used. Remember the hypervisor has no visibility inside the Guest OS memory list. The VM Memory Usage counter in vCenter will give you a low number. It is based on what the hypervisor estimates as active. If you are sizing based on this, it can impact performance, as it can force paging inside Windows.
  3. For Windows, you need to use the Free Memory counter, In Use counter, and Standby counter to give a more accurate picture.
For performance, include Standby as that's serving as cache. 
For cost, exclude Standby.