PoolMon Display
PoolMon displays columns of data about pool memory allocations in a command window. Use the arrow keys, PAGE UP, and PAGE DOWN keys to scroll through the data.
Note
To see the entire PoolMon display, the Command Prompt window size must be at least 80 characters wide (width=80) and at least 53 rows high (height=53); and the Command Prompt window buffer must be at least 500 characters wide (width=500) and at least 2000 rows high (height=2000). Otherwise, the display might be truncated.
The following table describes the columns in the PoolMon display.
| Column Name | Description |
|---|---|
| Tag | The 4-byte tag assigned to the pool allocation. |
| Type | Whether the memory allocations are in paged or nonpaged bytes. |
| Allocs | The number of allocations. |
| ( ) | The change in the number of allocations since the last update. |
| Frees | The number of free operations. |
| ( ) | The change in the number of allocations since the last update. |
| Diff | The number of allocations minus the number of free operations. |
| Bytes | The size of the allocations, in bytes used. |
| ( ) | The change in the allocation size since the last update. |
| Per Alloc | The value of Bytes divided by the value of Diff. |
| Mapped_Driver | The local drivers other commonly used drivers and system components (/g) that assign the pool tag value. This column appears only when you use the /g parameter. |
The following sample PoolMon output is sorted by number of allocations. (To sort your display this way, start PoolMon with the /a parameter.)
Memory: 260620K Avail: 96364K PageFlts: 0 InRam Krnl: 1916K P:17856K
Commit: 203500K Limit: 640916K Peak: 260632K Pool N: 8332K P:27220K
System pool information
Tag Type Allocs Frees Diff Bytes Per Alloc
Wait Nonp 3971107 ( 0) 3971077 ( 0) 30 8456 ( 0) 281
ObSt Nonp 2791258 ( 0) 2791258 ( 0) 0 0 ( 0) 0
Gxlt Paged 1161638 ( 0) 1161630 ( 0) 8 864 ( 0) 108
Ustm Paged 1088342 ( 0) 1088298 ( 0) 44 2464 ( 0) 56
Io Nonp 1021112 ( 1) 1020985 ( 1) 127 91912 ( 0) 723
ObSq Paged 967615 ( 0) 967615 ( 0) 0 0 ( 0) 0
Key Paged 954821 ( 0) 953979 ( 0) 842 87528 ( 0) 103
SePa Nonp 680348 ( 0) 680321 ( 0) 27 3656 ( 0) 135
Update Rate
PoolMon updates its display every five seconds. You cannot programmatically change the update rate. You can, however, force a refresh of the PoolMon results by clicking some keys, if the window PoolMon is running in has focus. CTRL and ALT, for instance, force a refresh; however, Print screen does not.
Accumulated Values
The data that PoolMon displays is collected and calculated by Windows whenever pool tagging is enabled. The values for allocations, free operations, and bytes used accumulate from the time that Windows starts, and increase monotonically until Windows is restarted. If a driver or component is started after Windows has already started, the values are accumulated from the last time that the driver or component started and reset only when the driver or system is restarted.
Interpreting Tag Values
All pool memory allocations have tags, but they do not all have characteristic tag values. Pool memory allocations have characteristic tag values when the driver that allocates the memory sets the tag value by using ExAllocatePoolWithTag or ExAllocatePoolWithQuotaTag. If the driver does not assign a tag value (ExAllocatePool, ExAllocatePoolWithQuota), Windows still creates a tag, but it assigns the default tag value None. As a result, you cannot distinguish the statistics for that driver's allocations from that of other pool allocations.