With Windows 10 growing in popularity and programs continuing to want more and more RAM, knowing more about Resource Monitor and how to use it can prove to be a very valuable skill for any sysadmin at work or Power User at home.
There’s a saying my granddaddy taught me. “You can never have too much money, happiness, or RAM”, he said, and truer words have not been spoken. Of course, I might add a few things to this list, like pizza, puppies, and bandwidth, but those are for another time. With Windows 10 growing in popularity and programs continuing to consume more and more RAM, knowing about this great tool and how to use it will prove to be a very valuable skill for any sysadmin at work or PowerUser at home. So in this article we will take a close look at Resource Monitor, and more specifically, at what it can do around Memory.
Microsoft states that the minimum memory requirements for Windows 10 are 1GB for the 32bit version, and 2GB for the 64bit version, but we all know that minimums are for chumps. Of course, sometimes, we have to deal with what the company issues us, or what our budget can afford, so we don’t always have 16GB of RAM at our disposal. In those times, keeping a close eye on what is consuming our precious RAM is even more important. Enter Resource Monitor.
What is it?
For starters, let’s talk about what Resource Monitor actually is. It is rather like your computer’s Mr. Hyde to Performance Monitor’s Dr. Jekyll, if you’ve seen the BBC production Jekyll, staring James Nesbitt. And if you haven’t seen that, just trust me. The Resource Monitor is the hidden part of Performance Monitor that only comes out to play when the cat is away. And it is the much more fun of the two. You can use Resource Monitor to get a much more point in time view of what’s going on with your system than you ever could with Task Manager, and more readily than with PerfMon.
But if you want a more technical definition of what it is, Wikipedia defines it as “a system application in some Microsoft Windows operating systems, which displays information about the use of hardware (CPU, memory, disk, and network) and software (file handles and modules) resources in real time.” Perhaps their explanation is more to the point, but no more accurate.
Resource Monitor runs under the Perfmon.exe process, which is totally ironic since you cannot actually get to Resource Monitor from Performance Monitor. Like I said, very Jekyll and Hyde! It has five tabs, which display an overview of the current system consumption of the “big four” resource categories; CPU, Memory, Disk, and Network, along with drill downs into each. While it displays details in real time, it does also display a running 60 second history of the same.
It’s not a replacement for Task Manager, though you can get to it from there, nor is it a replacement for Performance Monitor. But it does serve a niche that many third party applications have been developed to do in the past, including several of the SysInternals suite members. Don’t think of it as a complete replacement of tools you already use and are familiar with, but more of a pocket multi-tool that will do a lot for you in an easy to carry form, and often does enough that you don’t need to bring out the whole toolbox.
How do I launch it?
There are several ways to get Resource Monitor up and running. I usually launch Task Manager with a CTRL-SHIFT-ESC, click on the Performance tab, and then click the button at the bottom to “Open Resource Monitor.”
Arguably that’s the slowest possible way to get to it, but that’s how I roll. You can also:
- Hit the WIN button and just type “resmon” or “resource monitor” and then hit enter
- Click Start, All Programs, Accessories. System Tools, Resource Monitor
- WIN+R, resmon
- WIN+R, perfmon /res
No matter which way you choose to go, if you look in Task Manager you will see that Resource Monitor looks like its own process.
Go to Details though, and you will see it runs under perfmon.exe.
What would I use it?
You can use Resource Monitor to keep an eye on resource consumption as you run applications or test configuration settings, as well as to troubleshoot various performance issues. In this post, we’re going to focus on memory related tasks. Let’s look at the three main sections and what each can help you with.
Clicking on the memory tab shows you three key pieces of information. At the top, you see a list of all the processes currently running on your system, as well as a quick peak into what percentage of overall memory is in use. It’s small, so you might miss it, but it’s right there at the top of the “Processes” bar.
Each of the columns can give you more insight into what is happening on your system. Let’s take a look at them.
Image and PID
These should be self-explanatory, but just in case, the Image is the name of the file executable that the program runs under, while the PID is the Process ID of the program or service. Each of the rest of the columns indicates the values specific to the process, while the table and graphs in the other two sections show aggregate for all that is running on your system.
If you don’t have enough RAM for a process, it will generate hard faults when it needs to go to disk to get data from the page file. When you are trying to evaluate if a program runs well on a particular system, pay attention to this. Low to no hard faults means things should be good from a RAM perspective. Lots of hard faults means you need more RAM. Almost no program ever will have no hard faults ever, so don’t think badly of your system or a program just because you see the occasional hard fault. But if you consistently see several per second, you definitely want an upgrade.
Is a program a memory hog or a delicate flower? Commit represents the total amount of physical RAM and page file space that Windows has allocated to a process. Allocated may be much lower than what is actually being used, so expect it to be lower than the Working Set.
Working Set (KB)
Working set shows the amount of physical RAM a process is using (no page file here) and is the total of two types of allocated memory; shareable, and private. Sharing is good, but that’s not to say our programs all learned their manners in kindergarten.
Shareable memory is how much physical RAM a process is sharing with other processes. Think of shareable memory whenever you have related processes, such as the operating system, or members of a suite that have some common elements, like Word and Outlook.
This number represents the physical memory that this process and this only this process is using. Private will always be less than or equal to Commit and Working Set, and is the best indicator of how much memory a specific program monopolizes.
Actions you can take
For starters, click the column name on any of the columns to sort ascending, or click again to sort descending. This helps you find just what you are looking for, either by name or to determine the PID, or to sort the largest or smallest values in the other columns.
You can also check a process to keep it at the top of the display. That will also generate an orange line in the histogram on the left so you can see a running 60 second indicator of change.
It’s when you right-click a process that things get interesting.
You can end a process or a process tree, just like in Task Manager. You can also suspend or resume a process (though sometimes that either doesn’t work or makes the system unstable) and search online for more information. The most interesting thing you can do is analyze the wait chain, which can tell you if the process is waiting on some other process to release a resource so it can access it. You may think a program is performing poorly, but the wait chain can help you determine if it’s really another process that is the problem.
Next is a graphical representation of your memory, including how much physical RAM is installed, how much is available, and what’s using it, like so. Again, note the quick peak values on the top bar of this section.
Here is what each of these means. They will add up to almost what you have installed, but expect them to come up a little short.
This is where the BIOS, system drivers, virtual interrupts, etc. go. There’s really not much you can do about this, but it is interesting to see.
Just what it sounds like, this is the total memory in use on the system.
This is memory that is still held, but hasn’t been used recently. Eventually it will be flushed or written to the page file, and can be called into service quickly if resource demands require it.
This is paged memory that hasn’t been cleared out yet, but again, hasn’t been used recently. They are linked to the working sets of their owning process, and can “go active” if the process requests the data, but they can also be cleared out to free up RAM if demand climbs.
This is memory that is free and clear and ready to be allocated to a process as needed.
The rest, underneath the bar chart, are exactly what you think. Again, don’t look for all the numbers to add up perfectly.
Finally, you see a running 60 second histogram of system usage on the left side, including Used Physical Memory, Commit Charge, and Hard Faults/sec.
Here’s more on each of those.
Used Physical Memory
Used Physical Memory is pretty straightforward. Of the X GB of RAM in your system, that’s how much you’re using at the moment. Obviously here, the lower the percentage, the better. Having a graphical representation that updates every second can help you evaluate if your system is experience peaks or surges, and also see how actions you take or programs you launch affect memory consumption.
Commit Charge looks at how we make up for not having enough RAM – namely by using virtual memory. The Commit Charge number the percentage of total memory you are using including both physical RAM and page file. This too helps you see what whatever is happening at the moment impacts your system, particularly if it has a surge at launch or upon a particular action that then settles down.
Hard Faults/sec sounds bad, mostly because it is. No, it’s not your fault, nor is the Earth going to open up and swallow you hold. A hard fault happens when a process needs data, and that data is not in RAM but it is in the page file, meaning it must be fetched from disk. That’s horribly slow compared to RAM, and the only way to avoid it is to either have more RAM or run less stuff. Seeing these numbers is the best way to evaluate if you really do need more memory in your system, or if you are at the max the hardware will support, if you need to upgrade your disk. Remember, the page file is stored on the hard drive. The slower your disk drive is, the worse your experience when hard faults occur. Solid state drives can definitely help offset bad performance from lower maximum memory in systems.
Windows 10 can run well on much less RAM than you’d expect, but as with any system, more is better. Windows 10 will use as much RAM as it can, so if you see a lower value for Free Memory, don’t assume that means you don’t have enough. Between allocated memory in Modified and Standby, you probably have plenty of memory. If you don’t, it’s the Hard Faults that will be the surest sign.
Resource Monitor is a very cool tool to use to get a better idea of just what is going on with memory consumption on your system, but be aware it can also evaluate process, disk, and network. We may cover those in future posts if there is enough of an interest, so leave a comment below if you would like more.