Poolmon.exe not working
- #POOLMON.EXE NOT WORKING DRIVERS#
- #POOLMON.EXE NOT WORKING DRIVER#
- #POOLMON.EXE NOT WORKING FREE#
- #POOLMON.EXE NOT WORKING WINDOWS#
Pooltag.txt is extensive, but it is not a complete list of all tags used in Windows. Tag Type Allocs Frees Diff Bytes Per Alloc Mapped_Driver In this case, the display is even more specific, because pooltag.txt includes the source files for NTFS allocations.
#POOLMON.EXE NOT WORKING DRIVER#
The rightmost column in the display, Mapped_Driver, shows that the memory was allocated by ntfs.sys, the driver for the NTFS file system. The resulting display lists allocations with tags beginning in NtF. (It uses the question mark character ( ?) as a wildcard.) The /g parameter adds the Mapped_Driver column. The following command displays memory allocated with tags that begin with NtF. The data for the Mapped_Driver column comes from pooltag.txt, a file installed with PoolMon.
#POOLMON.EXE NOT WORKING DRIVERS#
The components and drivers are listed in the Mapped_Driver column, the right-most column in the display.
If you find a problem in allocations with a particular tag, this feature helps you identify the offending component or driver.
#POOLMON.EXE NOT WORKING WINDOWS#
You can use the PoolMon /g parameter to display the names of Windows components and commonly used drivers that assign each pool tag. If you press a parenthesis key again, it sorts by the value. When PoolMon is in sort-by-change mode, it interprets all sort commands as commands to sort by the change in the value. The /( parameter and the parentheses keys are toggle switches. It uses the /a parameter to sort by number of allocations and the /) parameter to sort by the change in the number of allocations. The following command displays allocations with tags beginning with Afd, and sorts by the change in allocations. The /( parameter places PoolMon in sort-by-change mode. You can also sort the PoolMon display by the change in a value between updates.
The following command displays allocations that have tags beginning with Aud and four-character tags beginning with Cc, except for allocations with the CcBc tag poolmon /iAud* /iCc? /xCcBc The following command displays allocations that have pool tags beginning with Afd, the tag used by afd.sys poolmon /iAfd*Ī PoolMon startup command can include multiple /i and /x parameters. You can use an asterisk (*) and/or a question mark (?) to specify a set of tags with the same characters.
The following command displays all allocations that do not have the AfdB tag poolmon /xAfdB To exclude allocations with a particular tag, use the /x parameter. The following command displays allocations with the AfdB tag (the tag used by afd.sys for data buffers). To start PoolMon and display data for allocations with a particular tag, use the /i parameter. While PoolMon is running, press p to toggle through allocations from the paged pool, the nonpaged pool, or both. The following command starts PoolMon and displays only allocations from the nonpaged pool: poolmon /p To sort by bytes per allocation, press m. For example, to sort the display by number of bytes used, press b. While poolmon is running, you can use the run-time commands to change the display.
#POOLMON.EXE NOT WORKING FREE#
The following command starts PoolMon and sorts the display by number of free operations: poolmon /f The following command starts PoolMon: poolmon You can modify the sort order of the display at the command line or while PoolMon is running. By default, PoolMon displays all kernel memory allocations in alphanumeric order by tag value.
This example describes various ways to configure the PoolMon display. This topic includes the following examples of PoolMon use:Įxample 1: Display and Sort PoolMon OutputĮxample 5: Monitor a Terminal Server Session Example 1: Display and Sort PoolMon Output