Defrag Tools #154 - Memory Footprint and Leaks

Play Defrag Tools #154 - Memory Footprint and Leaks
Sign in to queue


In this episode of Defrag Tools, Chad Beeder and Sylvain Goyette discuss how to diagnose issues related to memory usage, using tools available in the Assessment and Deployment Kit (ADK).

We cover two scenarios:

  1. Looking at the baseline memory footprint of a particular Windows installation, and comparing it to the usage during a certain activity
  2. Diagnosing memory usage and leaks in a particular app.


[00:00] Introductions and overview
[01:43] Scenario 1: Get a baseline memory measurement of your system at idle, using the Windows Assessment Console. Run the Memory footprint assessment.
[04:08] Open the resulting XML file to see who is using what memory
[08:33] Collect a memory usage snapshot at any time by using Windows Performance Recorder and selecting the Resident Set analysis profile. Capture a short trace.
[10:37] Open the trace with Windows Performance Analyzer and look at the ResidentSet graph to drill into the memory usage data
[16:57] Scenario 2: Memory leak analysis. Capture a longer trace, using VirtualAlloc usage and Heap usage providers.
[18:09] You need to set a registry key to specify which process you want heap tracing enabled on. This is noted in the WPR documentation.
[19:44] What is the difference between heap usage and VirtualAlloc usage?
[20:45] Looking at Sylvain's test app which leaks memory
[22:37] Open the trace in WPA. Use the VirtualAlloc Commit LifeTimes and Heap Allocations graphs to see the memory usage over time and track down where the leaks are in your app.
[31:33] Questions? Email us at



The Discussion

  • User profile image

    Great job! thanks

  • User profile image

    Is there an easy way to track which module or driver that is allocating driver locked memory? The only way I can think of is using a kernel debugger and then setting breakpoints for the functions in the memory manager used for locking memory and then hopefully the name of the driver or module will be on the stack. Is there an easier way than using this approach?

  • User profile image

    @Hans: Yes, you could do it through the debugger. I quickly looked through the code and I didn't see any ETW events around the driver locked memory. If there is an easier way than debugging it, I'm not aware of it.

  • User profile image

    Is it too much to ask for professionalism while on camera ? 

  • User profile image

    What did you find to be unprofessional?

  • User profile image

    @Adrienne: a professional reporter is not a distraction , but rather puts the focus on the interviewee and the story.

  • User profile image

    @RobHouston What distracted you?

  • User profile image

    Nice try, but there's no need.  Either it will be toned down in front of the camera just by asking nicely (with no need for a flame war) or he really is just desperate for attention.       

    I think he'll do the professional thing.

  • User profile image

    I'm just trying to understand what you're referencing. I guess I'm not seeing whatever you're seeing.

Add Your 2 Cents