Finding Windows NT Memory Leaks

  • Section(s): Miscellaneous
  • Published on Apr 20, 2004.
  • Last Modified on Apr 20, 2004.
  • Last Modified by Wayne Maples.
  • Rated 4.4 out of 5 based on 5 votes.
  • Start PMON from NT Resource Kit.
  • Monitor paged / non-paged pool usage. If these increase over time, there is a memory leak.
  • Monitor commit counters. If this increases over several hours, there is a probable leak.
  • Monitor the Commit Charge column. The process with the leak will increase.
Depending on the severity of the leak, you may have to monitor once/hr for several days.

To release the leaked memory, use Resource Kit utility:

empty { PID | progname }

where PID is Product Identification number. EMPTY frees the working set of a task or process

Microsoft TechNet related articles:

How to Use Dh.exe to Troubleshoot User-Mode Memory Leaks
How to Use Poolmon to Troubleshoot Kernel Mode Memory Leaks
Using Performance Monitor To Identify A Pool Leak
MS-DOS-Based Apps Starting Non-MS-DOS-Based Apps
WM_DDE_EXECUTE API Causes a Memory Leak in the WOW Subsystem
SetTimer() API Causes Memory Leak in the WOW Subsystem
Memory Leak in Ntfs.sys
Memory Leak in SERVICES.EXE Causes Performance Degradation

There are many examples. Many are fixed in various service pack releases. Many are not. If your box gets sluggish or unreliable, this is an area worth checking.

About Wayne Maples

Share this article


Article not looking right or info is missing? Let us know so that we can fix it: .


Receive all the latest articles by email!

Receive Real-Time & Monthly WindowsNetworking.com article updates in your mailbox. Enter your email below!
Click for Real-Time sample & Monthly sample

Become a WindowsNetworking.com member!

Discuss your network issues with thousands of other network administrators. Click here to join!

Community Area

Log in | Register

Readers' Choice

Which is your preferred Data Recovery solution?