1

I have some 32-bit Win2K3 servers running an application that fails now and then apparently due to heap fragmentation. (Process virtual bytes grows, private bytes does not) I do not have access to the source code or build process of this application.

graph

I have modified the boot.ini file on one of these servers to include /userva=2560, half way between the normal mode of operation and the /3GB option. Normally it takes weeks to reach the point of failure, but I'd like to see right away whether this has actually had any effect.

As I understand it, this option limits the kernel to the remaining address space (1536MB instead of 2048), but does not necessarily give an application the extra address space, depending on the flags in the application's PE header.

How can I determine whether the O/S is allowing a particular application, running in production, to access address space above 2GB? Additionally, what's the best way to monitor the system to ensure that the kernel is not starved for address space, and more generally how should I go about finding the optimal value for this setting?

2 Answers 2

1

Two things, first you still need the /3GB flag according to the KB.

Second, given the leak is so slow why bother, you should be rebooting every month, or at most two simply to apply security updates.

0

Kernel memory (paged/non-paged/cache) - you can view this with the Windows Debugger. File > Kernel Debug > Local tab. "!vm" shows you the kernel memory. Important values are pool usage and maximum:

NonPagedPool Usage: 10300 ( 41200 Kb)
NonPagedPool Max: 65281 ( 261124 Kb)
PagedPool Usage: 14531 ( 58124 Kb)
PagedPool Maximum: 134144 ( 536576 Kb)

You can also check the program's PE image header using PE Explorer. The Characteristics field determines if the program can access memory above 2 GB. If this is not set, /3GB is a waste.

alt text

PE Explorer
http://www.pe-explorer.com/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .