Private bytes

Question

Why do I get a different value for private bytes from perfmon, process explorer and vmmap. They all have a different value. Which one is correct?

Answer 1

They all measure different things. The whole "private vs shared vs public" discussion is complicated. Even the folks at MS give mixed answers. Ultimately they call Win32 APIs to get values so it depends on the API they call. The source of reference for me is the Windows Internal book written by Mark who also wrote several of these tools. He wrote a lengthy series of blogs about this topic quite a few years ago but I cannot find them right now to link to them. So here's some other links.

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc780836(v=ws.10)?redirectedfrom=MSDN
• https://topic.alibabacloud.com/a/difference-between-task-manager-and-performance-monitor-working-set-and-private-font-colorredbytesfont_8_8_32353074.html
• https://www.geeksforgeeks.org/private-bytes-virtual-bytes-working-set/#:~:text=Private%20Bytes%20are%20the%20actual,that%20is%20backed%20by%20RAM.
• http://cybernetnews.com/cybernotes-windows-memory-usage-explained/

At a summary level, private bytes is the non-shared, committed memory of your process. That could include memory that is currently paged to disk. So each tool may be looking at slightly different sets of values to get the information (or it could just be changing a lot). GetProcessMemoryInfo, for example, added private bytes to the returned data but then documents that it is really just the committed memory.
Ultimately I think the perf counters are the most accurate in terms of what the "private bytes" are. Without having the Windows source code I suspect they ultimately rely on the perf counters to get their value.