Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are monitoring a server for a potential Nonpaged Pool memory leak. So we setup a cmd batch file to output to the Nonpaged Pool allocation every 10 mins. We also setup a perfmon counter log to capture Memory > Nonpaged Pool Bytes. As well as an alert when this counter goes over 185MB (specified in bytes).

The alert tripped yesterday. We coolected the poolmon log for the day as well as the perfmon counter log file. Now when I add all the bytes from each of the poolmon logs I get a total of ~170MB every time. However in Perfmon it is showing as 210MB for the same time period. It stays at this for a long time, so not a spike. Task Manager is also showing this ~210MB. Looking at poolmon logs the top consumers do not change much, but do change.

The batch file uses: POOLMON.exe -p -b -n %OUTDIR%\poolmon.%ISODATE%.log

Why is there a discrepancy between the two and which should I trust?

Any insight will be much appreciated!

Note: I have asked this question in Super User forum as well, but feel it is better suited to the Server Fault community. As this is related to an enterprise environment.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.