Memory - what to check?

[jivetolkein]

More of a general question as much as a specific HM one ...

I've never really been satisfied with my free memory checking. Often, OS or applications will balloon up to fill the available memory, using it as cache or buffers or whatever, so any kind of general 'check that 5% physical memory is free' isn't really all that useful. Sometimes it frees up, sometimes it doesn't, sometimes it's a problem, sometimes not. All I really need to know is that if there are performance issues I can point to a lack of RAM at peak times or in general, and justify an upgrade. A classic example is one of our DCs - it's not a FSMO role holder, essentially it sits there servicing logins and authentication and thats about it, yet still it'll red line over 640Mb of RAM, whats it doing with it?!

So what does everyone think is the most valuable measure over time to see if a server really is struggling with physical memory? One of the swap/paging counters? What about *NIX?

PS - implementation into HM gets bonus points

[KS-Soft Europe]

So what does everyone think is the most valuable measure over time to see if a server really is struggling with physical memory? One of the swap/paging counters?

You are right. Microsoft's implementation of memory management is not easy to understand at first sight.
Below are represented the counters, which are worth to be monitored, in my opinion.
Win32_OperatingSystem WMI class. The Win32_OperatingSystem WMI class represents an operating system installed on a computer running on a Windows operating system.
Useful Counters:
1. FreePhysicalMemory - Number, in kilobytes, of physical memory currently unused and available.
2. FreeSpaceInPagingFiles - Number, in kilobytes, that can be mapped into the operating system paging files without causing any other pages to be swapped out.
3. FreeVirtualMemory - Number, in kilobytes, of virtual memory currently unused and available.

Win32_PerfFormattedData_PerfOS_Memory WMI Class. The Win32_PerfFormattedData_PerfOS_Memory "cooked" data performance counter class represents calculated counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes.
Useful Counters:
1. AvailableMBytes - Amount of physical memory available to processes running on the computer, in megabytes. It is calculated by summing space on the Zeroed, Free, and Standby memory lists. Free memory is ready for use; Zeroed memory contains memory pages filled with zeros to prevent later processes from seeing data used by a previous process.

Win32_Process WMI class. The Win32_Process WMI class represents a process on an operating system.
Useful Counters:
1. WorkingSetSize - Amount of memory in bytes that a process needs to execute efficiently—for an operating system that uses page-based memory management. If the system does not have enough memory (less than the working set size), thrashing occurs. If the size of the working set is not known, use NULL or 0 (zero). If working set data is provided, you can monitor the information to understand the changing memory requirements of a process. This value is consistent with the MemUsage value in TaskMgr.exe
2. PageFileUsage - Amount of page file space that a process is using currently. This value is consistent with the VMSize value in TaskMgr.exe
3. VirtualSize - Current size of the virtual address space that a process is using, not the physical or virtual memory actually used by the process. Using virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and by using too much, the process might not be able to load libraries.

Please note: you may monitor all these counters using "WMI" test method: http://www.ks-soft.net/hostmon.eng/mfra ... ts.htm#wmi

Also You may use "Performance Counter" test method to monitor "Memory" performance object: http://www.ks-soft.net/hostmon.eng/mfra ... erfcounter

What about *NIX?

We already have a solution for *nix systems. If you open the "Script Manager", you will see the bunch of useful UNIX-specific scripts, that allows you to monitor memory on *nix systems using "Shell Script" test method: http://www.ks-soft.net/hostmon.eng/mfra ... m#chkShell
Of course, to use foregoing scripts you have to install "RMA for *nix" on the target machine: http://www.ks-soft.net/hostmon.eng/rma-unix/index.htm

Regards,
Max

[jivetolkein]

Thanks Max, great answer as always - I'll chew through the Windows counters on some known good and bad boxes - know of any good WMI references that you could point me too? Half the battle is knowing what to look at IMHO.

[KS-Soft Europe]

Thanks Max, great answer as always

Thank you. You are welcome.

know of any good WMI references that you could point me too?

WMI is an acronym for Windows Management Instrumentation. WMI is the Microsoft's implementation of Web-Based Enterprise Management (WBEM) - a new management technology that allows software to monitor and control managed resources throughout the network. Such managed resources include hard drives, file systems, settings of operating system, processes, services, shares, registry settings, networking components, event logs, users, groups, etc.
WMI allows monitoring of performance counters as well. Microsoft applications such as Exchange and SQL Server have WMI built-in. Many non-Microsoft applications utilize WMI and thus they could be monitored using Advanced Host Monitor as well. You may start here: http://www.microsoft.com/technet/script ... mifaq.mspx

The WMI clases, mentioned in my previous post described here:
Win32_OperatingSystem: http://msdn2.microsoft.com/en-us/library/aa394239.aspx
Win32_PerfFormattedData_PerfOS_Memory: http://msdn2.microsoft.com/en-us/library/aa394268.aspx
Win32_Process: http://msdn2.microsoft.com/en-us/library/aa394372.aspx

Usage within HostMonitor is pretty simple. You just should create a "WMI" test and use certain query to gather necessary information. Several examples:
select FreePhysicalMemory from Win32_OperatingSystem
select AvailableMBytes from Win32_PerfFormattedData_PerfOS_Memory
select WorkingSetSize from Win32_Process where Caption='explorer.exe'

You may use "WMI Explorer" utility to explore the full set of WMI management classes, objects and their properties, browse through objects and settings on remote machines, execute any WQL query and view the result set. http://www.ks-soft.net/hostmon.eng/wmi/index.htm

Regards,
Max