Reference Set

The Short Story

When a Windows process allocates memory, that amount of Virtual Address Space is committed (a bookkeeping event), but RAM is not assigned until the memory is accessed (read/written). For example, when a module is loaded, its code is not loaded into RAM and attached to the process (paged-in) until it is actually executed.

Thus, Virtual Address Space is allocated, but Virtualized RAM is demand-paged-in as it is accessed (read/written).

Here we focus mostly on tracing RAM usage as its corresponding code/data is paged-in on demand.

Tip

Please review the Windows Memory Cheat Sheet to better understand the various categories of Memory in Windows.

Quick Start

• Either download and unzip a recent Release, or clone the Repository: <> Code ↓

  Close as many applications as possible.
  

• MSO-Scripts\TraceMemory Start <option>

  Exercise the code.

• MSO-Scripts\TraceMemory Stop <option>

• MSO-Scripts\TraceMemory View <option> [-FastSym]
  <option>
  -Lean:   RAM page-in events (ReferenceSet), no stackwalk
  -Lite:   VirtualAlloc (Private Commit Charge), with stackwalk
  -Stats: Capture Memory Stats per process every ½ second
  -Snap:   Capture a Resident Set memory snapshot
    None:   All of the above, with stackwalk.
  

Note that Stop and View commands can be combined using -WPA:

• MSO-Scripts\TraceMemory Stop <option> -WPA [-FastSym]

List all options:

• MSO-Scripts\TraceMemory -?

Important

If the PowerShell script does not run, you can instead run the Batch script: MSO-Scripts\TraceMemory.BAT ...
See: What if I can't run PowerShell scripts in my environment?

The Long Story

Measuring RAM Usage

The most common ways to measure RAM usage in Windows are Working Set, Reference Set, and also Resident Set:

Working Set is a snapshot of the RAM currently in use by each process, according to the Windows Memory Manager.

• This value can rise and fall depending on application behavior and system-wide demands for physical RAM (trimming due to memory pressure).
  
• Working Set is measured by any of these tools: Task Manager, Process Explorer, VMMap, ETW/WPA Memory Stats

Reference Set is an accounting of RAM usage by each process over a time interval.
It is different from Working Set in several ways:

• It is unique to the Windows Performance Analyzer (WPA) as it analyzes ETW memory traces.
• It is not affected by working set "trimming" (paging out, usually due to memory pressure).
• It may attribute Windows OS Kernel memory usage to the process which initiated its use.
• Since it is based on memory paging events, it can be attributed to running code via stackwalk.

Resident Set is a snapshot which accounts for RAM usage of the entire system at once.

• It is captured via ETW as a single event at the end of the trace.
• See also: RAMMap

Windows Memory Sharing

When code modules or data files are loaded by multiple processes, the RAM containing the code/data may be shared across the processes.

Reference Set (WPA only)

• System View: RAM shared across processes is attributed only to the first process to access it within the trace.
  
• Process View: Whether RAM is shared across processes is not considered. It counts toward all processes which access/page-in the RAM.
  (Use WPA's View Editor to choose whether the System View or Process View columns are enabled.)

Working Set (WS)

• Private WS: RAM associated with Committed Virtual Memory which CANNOT be shared across processes, such as Heap, Stack, etc.
  
• Shareable WS: RAM associated with Committed Virtual Memory which CAN be shared across processes, such as code, read-only data, File-backed Sections, etc.
  
• Shared WS: The subset of Shareable WS which IS actually shared across two or more processes.
  

Commit Charge
The Commit Charge is not a measure of RAM usage but a measure of Committed Virtual Address Space charged to (backed by) the system pagefile.

• Shared Commit (ie. Shareable Commit Charge): The subset of the Committed Virtual Memory which consists of Pagefile-backed Sections. (This memory can be shared across processes by way of a handle. Any system-wide summation should avoid double-counting.)
  
• Total Commit (ie. Total Commit Charge): The entire subset of the Committed Virtual Memory which is backed by the system pagefile:
  • Private Commit Charge / 'Private Bytes': VirtualAlloc, Heap, Stack, etc.
  • Shareable Commit Charge / 'Shareable': Pagefile-backed Sections

See also:

• Commit Charge vs. Committed Address Space
• Windows Memory Cheat Sheet

Tracing and Screenshots

Reference Set

Run: TraceMemory Start [-Lean] ...

When modules and data files are loaded into memory, they immediately occupy the address space of the entire module/file. But RAM is consumed (paged-in) on demand, as the module/file is accessed (read, written, or executed). This is Reference Set.

More about Reference Set

• Memory: RAM Usage Deep Dive Video
• How Reference Set Tracing Works
  

RAM Usage - File Reference Set

Table of RAM usage associated with file-backed Virtual Memory such as code modules and memory-mapped data files.

Legend

• Page Category
  
  • Image: Modules
    
  • MapFile: Memory Mapped Files   (Pagefile-mapped Section, see above: RAM Usage - Allocated)
    
  • MetaFile: Folders and Bookkeeping Structures on Disk
    
• Description: File Name and Path
  
• Access Stack: Stackwalk (execution path) leading to RAM being accessed and paged-in.
  
• Impact Size†: Difference in size between the end and the start of the trace (or of the current zoom window).
  

† See: Windows Memory Sharing: System View and Process View

RAM Usage - Allocated / Dynamic Reference Set

When memory is dynamically allocated, it immediately occupies the requested address space. But RAM is consumed (paged-in) on demand, as the data is read and written. This is Reference Set.

Table of RAM usage associated with dynamically allocated Virtual Memory via HeapAlloc, VirtualAlloc, etc.

Legend

• Page Category:
  
  • Win32Heap: Virtual memory used by the Windows Heap Manager.
    
  • VirtualAlloc: Lowest level Windows virtual memory allocator (generic allocations not associated with other subsystems).
    
  • PagedPool: Windows Kernel memory (often associated with Registry operations).
    
  • NonPagedPool: Windows Kernel memory which cannot page out (often associated with drivers).
    
  • PFMappedSection: Memory mapped against the system pagefile (with a shareable handle).
    
  • User/Kernel Stack: Committed virtual memory allocated by threads for their stacks.
    
  • CopyOnWrite/COW: Writable memory which is initially shared across processes until modified, at which point separate copies are created in RAM.
    
  • PageTable: Windows bookkeeping to manage virtual memory.
    
• Access Stack: Stackwalk (execution path) leading to RAM being accessed and paged-in.
  
• Impact Size†: Difference in size between the end and the start of the trace (or of the current zoom window).
  
• Size _Sum† : Sum total size of acquired RAM (independent of release) – the memory churn.
  
• Size _{Peak Outstanding}† : Peak size of acquired RAM, with the time stamp of the peak.

† See: Windows Memory Sharing: System View and Process View
  The System/Process Views will differ only in these shareable memory sections (above):
  ◦ PFMappedSection (pagefile-backed, memory-mapped section)
  ◦ Prefetcher (for optimizing process launch)
  ◦ Driver

See also: Reference Set: Important Column Definitions

Tip

Wherever you see lots of "n/a" in the Stack column, open the View Editor (Ctrl+E) and enable another Stack column: Access, Allocation, Impacting Stack

Commit Charge

The Commit Charge is the subset of the Committed Virtual Address Space which is charged to (backed by) the system pagefile. The sum total Commit Charge across the system cannot exceed the System Commit Charge Limit.

Commit Charge, being a class of address space, is only indirectly related to RAM Usage / Reference Set.
See: Commit Charge vs. Committed Address Space

Run: TraceMemory Start [-Lite] ...

Legend

• Commit Type:
  • Win32 Heap - The address space of the Windows Heap.
  • Virtual Alloc - The address space otherwise allocated through VirtualAlloc.
  • PFMappedSection - The address space memory-mapped against the system pagefile (with a shareable handle).
  • Copy on Write - The address space which is shareable across processes until modified, when a separate copy is created.
• Count/Size _Sum : The sum total count and size of commit charge memory allocations (the churn).
• Count/Size _{Peak Outstanding} : The aggregate count and size of unfreed commit charge allocations at their peak, with the time stamp.
• Commit Stack: The execution stack where the commit charge allocations occurred.
• Impacting Size: The difference in size between the end and the start of the trace, or of the zoomed view.

Memory Stats - ½ sec

Every ½ second capture statistics on the various categories of memory usage for all processes running on the system.

Run: TraceMemory Start [-Stats|-Lite] ...

Legend

• Process (pseudo-processes):
  • PagedPoolWs: Paged Pool kernel memory allocator - Working Set
  • SystemPteWS: System Page Table Entries (virtual memory bookkeeping) - Working Set
  • SystemCacheWS: System Cache Manager - Working Set
• Time: Timestamp of each measurement relative to the start of the trace.
• Virtual Size: The per-process, virtual address space committed or reserved (only relevant for 32-bit processes).
• Working Set: The amount of RAM claimed by each process (some of it may be shared across processes).
• Private Working Set: The amount of RAM claimed by each process that cannot be shared across processes.
• Commit: Private Commit Charge - a subset of committed virtual address space charged to (backed by) the system pagefile, in MB.
• Shared Commit: Shareable Commit Charge - mostly shareable, pagefile-backed sections, in Bytes.

Resident Set

The Resident Set is a snapshot of how physical RAM is currently employed on the system, whether within the process'es Working Set or otherwise. It is the set of memory pages that currently reside in physical memory / RAM.

Run: TraceMemory Start [-Snap] ...
        TraceMemory Stop
        TraceMemory View -Snap

Legend

• MMList
  • Active: RAM currently in use by one or more processes, or by Windows. Working Set
  • Modified: RAM containing modified data which awaits being written to its backing store / data file.
  • Standby: RAM not currently in use by a process, but containing cached code or data which may soon be (re)used.
• Page Category
  • Image: RAM in use to instantiate a Module (.exe/.dll) in memory.
  • CopyOnWriteImage: RAM usually representing writable global data of a module which forks a local copy when modified.
  • MapFile: RAM in use by a memory section which is mapped‡ against and reflects a data file on disk.
  • COWMapFile: RAM in use by a memory section mapped† against a data file on disk which forks a copy when modified.
  • PFMappedSection: RAM in use by a shareable memory section mapped‡ against the system pagefile.
  • COWPFMappedSection: RAM in use by a shareable memory section mapped‡ against the system pagefile which forks a copy when modified.
  • Win32Heap: RAM in use within memory allocated by the Windows Heap Manager.
  • VirtualAlloc_PreTrace: RAM in use by generic virtual memory allocations when the trace started.
  • VirtualAlloc: RAM paged into generic virtual memory allocations as tracing proceeded.
  • PagedPool: RAM in use by the OS Kernel memory manager which may page in and out.
  • NonPagedPool: RAM in use by the OS Kernel memory manager which cannot page out.
  • UserStack: RAM in use by the thread stacks of user-mode processes.
  • KernelStack: RAM in use by the thread stacks of the OS Kernel.
  • Prefetcher: RAM in use by the prefetcher to load the files: WINDOWS\Prefetch\*.pf
  • MetaFile: RAM in use for filesystem bookkeeping.
• Description: The name of the loaded module or mapped file,
• Page Priority: Priority for working set trimming
• Pinned: Pinned pages of RAM cannot be trimmed / paged out.

‡ See: File-Backed and Page-File-Backed Sections and File Mapping

Important

For the Resident Set view to work correctly, you must launch WPA with -Snap: TraceMemory View -Snap ...
If launching WPA directly, the Resident Set is part of the rundown, so omit the switch: -cliprundown
More info, run: WPA -? "Event Tracing for Windows"

See also:

• Interpret Resident Set Data Using WPA
• RAMMap

Virtual Allocations

The Virtual Allocations tab tracks activity of the Windows base memory allocator, VirtualAlloc, to fulfil dynamic allocations of committed virtual address space.

This is the same ETW data provider and WPA view as generated by the TraceHeap script. See: TraceHeap: Virtual Allocations

Tip

These commands are similar in the data they collect and display:
TraceMemory Start -Lite   |   TraceHeap Start -Lean
TraceMemory Stop -Lite   |   TraceHeap Stop
TraceMemory View -Lite   |   TraceHeap View -Lean

The script TraceMemory <command> -Lite also displays memory statistics (every 500 ms) and a subset of the Commit Charge consisting of the Windows Heap / VirtualAlloc.

---

What is "Commit"?   Commit Charge vs. Committed Address Space

There is potential for confusion surrounding these two terms, as both may be referred to as "Commit."

• Committed Address Space: Every 4 KB page of the address space of a process will be in one of three states:
  • Committed: Allocated & accessible. Generally associated with a loaded/allocated memory object: Module/Image, Mapped File, Virtual Memory Allocation. When accessed (read/written), the corresponding data will be demand-paged-in to occupy the address space.
  • Reserved: Not free to allocate and cannot be accessed (until explicitly committed).
  • Free: Cannot be accessed, and is not associated with any memory object. Available to be committed or reserved.
• Commit Charge: the subset of the Committed Address Space which is charged to (backed by) the system pagefile.

Important

This totality of the Commit Charge across all processes cannot grow to be greater than the available System Commit Charge Limit, which is the sum of the size of the System Pagefile(s) plus the size of usable Physical RAM. Else the Windows Virtual Memory Allocator will throw Out-Of-Memory errors.

Consider the worst case scenario for the Windows Memory Manager:
Every committed memory region across all processes gets fully paged-in and modified (if writeable).
Then it all gets paged-out.
Q: Where does it all page-out to?
A: The part of it which would page-out to the system pagefile is the Commit Charge: the subset of the Committed Address Space which is charged to (backed by) the System Pagefile.

If the Commit Charge were to grow without bounds then eventually there could be nowhere for it to page-out to, resulting in a blue-screen virtual memory failure. For this reason the system-wide bookkeeping happens at allocation-time to prevent over-committing.

Examples:

• The Windows Heap constitutes part of the Commit Charge, since its virtual memory is charged to (backed by) the system pagefile.
• The runtime code in a module is not part of the Commit Charge, since its virtual memory is backed by the corresponding .exe/.dll file.
• A memory-mapped data file is not part of the Commit Charge, since its virtual memory is backed by the corresponding data file on disk.
• A pagefile-backed section constitutes part of the Commit Charge, since it is backed by the system pagefile.

See Also

• Windows Memory Cheat Sheet
• Memory Footprint Optimization