Symptoms include poor system performance, and eventually error messages regarding virtual memory and/or resources.

---

the casual way
using Task Manager

The first thing you want to do is restart NT, and note your initial memory usages using Task Manager.

• From the Performance tab, note your kernel paged and nonpaged figures. They will grow and shrink as you open applications, but good apps return the memory they use after you close them, and the kernel memory should be within 10% of its starting figure after you close all your apps.

Now from the processes tab of Task Manager, select menu item "View/Select Columns..." From this dialog, select "Memory Usage", "VM Size", "Paged Pool", "Nonpaged Pool", and "Thread Count" (deselecting the others makes it easier to monitor memory leaks).



Now open a program or two to monitor.

You can't watch them all, of course, but you should choose some processes that are likely leakers, and note those figures down somewhere. Then start using the programs, and see what happens. Those memory numbers shouldn't rise sharply, or continually, over usage (although they should rise and lower some, of course). If you see a possible nasty, go over to your Performance tab and note the kernel memory usage, then close the offending program and see if it lets go of its resources (that is, do the kernel pool numbers go down after you close the program).

---

the better way
using Performance Monitor

The same idea as above, but you use a Performance Monitor Report to zone in on just a few apps. Select Report view in Performance Monitor, then click the Add button. If you hold the control key, you can multiple select. Start with Object: Process, then [multiple] select "Pool Nonpaged Bytes", "Pool Paged Bytes", and "Thread Count". Still holding the control key, select the processes in the Instances column you want to monitor. Now click "Add". You're done! You've got a nice looking, easy to monitor report layout.



In this report, I'm just monitoring one application, Netscape, and I've added another counter, Working Set.

You can save "snapshots" of these numbers for later review using Export Report. The file formats are TSV (tab-separated) and CSV (comma-separated), and they're both fine for use in Notepad or other text editors (or spreadsheets!).

Also, you can save the Report settings so you can open the same report later (saves going through the Add dialog).

At the same time the report is running, you can select the "Chart" view and make a similar chart (for a graphical representation of that data). However, if you're trying to monitor more than one application, it will look messy. You might get more value monitoring entirely different (but related) counters regarding your system, like Pages/sec or available bytes. When you see available bytes declining, you might switch back to the Report view and see if "anything's happening" (like if one of the applications has started using up more of the nonpaged pool, for instance).

A memory leak occurs when an process (like an application or a service) allocates memory, never gives it back, and/or keeps spawning new threads. Leaks can vary in degree, of course, but you can usually track one down using the built-in NT tools fairly easily, if you know what to look for.

Closing the app, or stopping the process, ends the leak pretty much.

A patch is required to fix the app... there's no "tweaking" you can do.

What to Look For

• Memory Usage and Virtual Memory increasing (even during inactivity)
• Paged Pool Memory being consumed and not returned
• Non-paged Pool Memory being consumed and not returned
• Threads being spawned like all get out

• Paged Pool Memory is system (kernel) code that is pageable to disk
• Non-paged Pool Memory is code that must stay resident in physical memory