How to control memory usage on a Windows 2000/XP system with LoriotPro

This document explains the setting of thresholds on Windows memory usage.  It also explains how to configure and display line graph of this usage. We will define events on physical memory usage, virtual memory usage, paging file changes.

Warning: The SNMP objects used in this how to come from our Windows perfmib.mib file. Our examples will not work with any other mib available on the Internet. The configuration and installation of this MIB is explained in the How to add SNMP performance monitoring to WIndows 2000 / XP

You should download the set of file including the perfmib.mib file from this page. We do have a working perfmib.mib before continuing.

Windows memory performance object description

We will see the roles of each memory performance object and how to control and graph them.

On window the total Memory and current usage could be seen in the task Manager accessible from the CTRL/ALT/ DEL  command.

The Physical Memory gives statistics on RAM usage and availability. Fist value is the Total physical memory (523 808 Ko in our upper screenshot), installed on your computer.

The physical memory Available represents the amount of free memory that is available for use. Common values are 128 Mbytes, 256 Mbytes, 512 Mbytes, 1024 Mbytes.

The System Cache is the current physical available memory used to map page of open files. Frequently accessed files are loaded in this cache and accessed from there. The concept of file caching speeds up the file access.

The virtual memory concept is used by the operating system to extend (virtually) the physical memory and thus to run more programs by swapping unused memory zone (page) to a disk file. The physical memory is extended by using a file on the hard disk (called paging file or swap). The Paging File is configured under Windows from the following window.

The Commit Charge is the memory allocated to programs and the operating system. Because of memory copied to the paging file (virtual memory) the value listed under Peak may exceed the maximum physical memory.

The Kernel Memory is the memory used by the operating system kernel and device drivers.

Paged is memory that can be copied to the paging file, thereby freeing the physical memory. The physical memory can then be used by the operating system.

Nonpaged is memory that remains resident in physical memory and will not be copied out to the paging file.

A view of the Windows memory organization:

Calculating the memory usage thresholds

As we previously said, these performance objects could also be collected with SNMP requests if our perfmib.mib is installed and if the SNMP service is activated on the Windows.

The first object to control is the physical memory usage.

In the MIB, the total physical memory object has the object name hrmemorysize.

The OID numeral format is 1.3.6.1.2.1.25.2.2. Corresponding to :

iso(1).org(3).dod(6).internet(1).mgmt(2).mib-2(1).host(25).hrstorage(2).hrmemorysize(2).

This is a standard mib 2 value in the Host resource mib.

The Physical Memory  Available has the following OID in our perfmib.mib file: ms-mem-availablekbytes

 microsoft(311).software(1).systems(1).os(3).winnt(1).performance(1).memory(7). ms-mem-availablekbytes(29)

We define the threshold on the physical memory available. Here the value of the object indicates the remaining physical memory. We define arbitrary a threshold on the remaining available memory when it reaches a value less than 20 % of the total available physical memory.

On ms-mem-availablekbytes at 20 % of hrmemorysize

Our system has 512 Mbytes of Ram, the threshold will be 104  000 Kbytes.

The next table show various value of the threshold for various memory sizes.

	OID	condition	Threshold values of 20 % of Memory size
			256 Mbytes	512 Mbytes	1024 Mbytes
	ms-mem-availablekbytes	Inferior	52000 Kbytes	104 000 Kbytes	208 000 Kbytes

Some Microsoft with paper says that available memory should stay consistently below 4 Mbytes on a workstation or an application server, and 1 Mbytes on file server. It is possible to use these values as thresholds.

The next object to control is the Virtual memory usage.

This object is given with the Commit Charge (K) OID

For the Total the OID is ms-mem-committedbytes

For the Limit the OID is  ms-mem-commitlimit

The Total indicate the current virtual memory used, the limit indicate the maximum virtual memory available without modifying the size of the paging file (swap).

We define a control on the commit charge (the usage of the virtual memory)

On ms-mem-committedbytes at 80 % of ms-mem commitlimit

In our example:

1 311 440 896 is the limit in bytes (be careful the value is in Kbytes in windows) the threshold will be 1 049 152 716

It is also useful to know if the paging file size change (the Windows configuration could allow the dynamic extension of the Paging file.

By setting a threshold on the ms-mem-commitlimit, we will detect any change made to the paging file size. The size could slightly vary between each startup.The threshold could be set at 10 % more than the current value.

The next counter to control is the Memory Pages/sec (ms-mem-PagesPerSec).

 This is a primary counter to observe when excessive physical memory usage occurs, generating excessive paging.  This is the number of pages read from or written to disk to resolve hard page faults.  (Hard page faults occur when a process requires code or data that is not in its working set or elsewhere in physical memory, and must be retrieved from disk).

The Microsoft recommended value for this threshold is 20 Pages/s. This value could be higher depending of the overall system speed (disk, processor, memory). The best is to read the value during a normal charge period for the system and set a threshold 20% upper this value.

Setting a threshold on the ms-mem-pagespersec at 20 is a good way of verifying that the disk and paging process are working fine.

Setting the thresholds for alarm generation

We attach a Bulk Threshold Plug-in to our host and configure it. Example is below for entering the first threshold.

The setting of the value in the Bulk threshold Plug-in is done below:

Graphing the memory statistics

To have a view of the physical memory usage, we could use our line graph Plug-in.

The setting is simple; attach the Plug-in to the host in the directory

Open the graph and choose Setup->Graph Polling Properties

Enter both OID:

ms-mem-availablekbytes and hrmemorysize

Select the No Differential mode; this will display the collected value as is.

You should get this type of graphic, plotting in green the currently available physical memory and in red the maximum available memory (here 512 Mbytes).

Warning: the return value by Ms-mem-availablekbytes is instantaneous. If your polling interval is to long you will miss peak usage of the memory.

We could also add a line graph on the virtual memory, typically the same graph, called Paged file usage history, in the task manager from Windows.

What to do when you reach the threshold

Verify that no process is using memory extensively. (memory leak)

Schedule tasks to run evenly (backup)

Increase the paging file size, spread paging file on different disk.

Increase the memory size, add RAM.

End of document