We are monitoring a server for a potential Nonpaged Pool memory leak. So we setup a cmd batch file to output to the Nonpaged Pool allocation every 10 mins. We also setup a perfmon counter log to capture Memory > Nonpaged Pool Bytes. As well as an alert when this counter goes over 185MB (specified in bytes).
The alert tripped yesterday. We coolected the poolmon log for the day as well as the perfmon counter log file. Now when I add all the bytes from each of the poolmon logs I get a total of ~170MB every time. However in Perfmon it is showing as 210MB for the same time period. It stays at this for a long time, so not a spike. Task Manager is also showing this ~210MB. Looking at poolmon logs the top consumers do not change much, but do change.
The batch file uses: POOLMON.exe -p -b -n %OUTDIR%\poolmon.%ISODATE%.log
Why is there a discrepancy between the two and which should I trust?
Any insight will be much appreciated!
Note: I have asked this question in Super User forum as well, but feel it is better suited to the Server Fault community. As this is related to an enterprise environment.