rammap主要参数解释

rammap主要参数解释

转自http://www.cnblogs.com/hmxp8/archive/2013/07/11/3183994.html

使用RamMap和VMMap工具解决Windows内存问题

　RamMap

　　RamMap用于展示系统和进程内存状态和利用率。它提供一个命名为“使用计数”的概要栏，它列出所有各种各样的系统内存分区，如分页池和非分页池、流程私密的、可共享的、硬盘空间、内核堆栈和映射文件。它还显示被称为Metafile的缓存文件内存空间的数量。

　　所有这些分区又进一步分类成不同类型的物理内存消耗，如活跃的、备用的、修改的、转变的、调零的、免费的或糟糕的。这些列中的每一个都可通过点击列抬头分类。所有这些术语在Russinovich的《Windows内部书》一书中都有解释。

　　RamMap还在“进程”栏中显示进程内在利用率。在这里你可以看到所有列出的进程，还有它们相应的私有内存利用率。数据还包括所有占用备用或修改页面列表的进程内存，还有用于页表项的内存量。 

　　RamMap的另一种运用是显示实际的物理内存用量，一页一页地识别内存清单、运用、文件名、进程、虚拟地址和池标签等属性。每一栏都可以分类，并且有一个过滤功能可以用来有选择性地分析数据。

　　最后，RamMap在展现缓存文件活动和数据上也做得不错。你可以运用“文件摘要”和“文件详细信息”栏向下查看系统文件缓存来确定文件路径、它占用的大小、相应内存是在活跃的、备用的还是修改的页面列表中。

　　VMMap

　　到目前为止，我们已经明白了RamMap如何展示系统和进程内存使用。如果你要解决的内存问题看起来和特定的进程或应用相关，你也许有必要通过使用VMMap来仔细看看。VMMap是一个过程导向的工具，它让你可以查看现有的进程或者追踪新的进程并查看其内存使用，它提供的信息远比RamMap详细。

　　VMMap启动时，它提示你选择你想要审查的现在进程或是开启一个新的进程。如果你启动了一个新进程，你将能追踪内存利用率，如堆和虚拟分配。

　　一旦VMMap的主窗口显示，你可以看见屏幕分成几部分。顶部部分是进程内存消耗的一个图形概要。它分成提交空间、专用字节和工作集。在屏幕的中部部分，内存利用率根据运用分类，如专有数据、共享数据、图片、映射文件和堆大小。最后，屏幕底部显示每个虚拟地址相应的页面类型是什么、所用的工作集大小和数量、页面保护、所有区块和分区的细节。颜色标记让你可以快速地看到特定类型的内存消耗多少空间。

　　VMMap提供有关进程地址空间的两个额外视图，包括一个“字符串”视图和一个“分割”视图。字符串视图让你可以搜索地址空间中存在的所有可读字符串。分割视图以颜色标记的方式显示进程虚拟地址空间，因此你可以看到多种分配、它们的大小以及它们的连续性如何。

 

5，Help

Memory Types

VMMap categorizes memory into one of several types:

Image

The memory represents an executable file such as a .exe or .dll and has been loaded into a process by the p_w_picpath loader. It does not include p_w_picpaths mapped as data files, which would be included in the Mapped File memory type. Image mappings can include shareable memory like code. When data regions, like initialized data, is modified, additional private memory is created in the process. The Details column shows the file's path.

Private

Private memory is memory allocated by VirtualAlloc and not suballocated either by the Heap Manager or the .NET run time. It cannot be shared with other processes, is charged against the system commit limit, and typically contains application data.

Shareable

Shareable memory is memory that can be shared with other processes, is backed by the paging file (if present), is charged against the system commit limit and typically contains data shared between DLLs in different processes or inter-process communication messages. The Windows APIs refer to this type of memory as pagefile-backed sections.

Mapped File

The memory is shareable and represents a file on disk. The Details column shows the file's path. Mapped files typically contain application data.

Heap

Heaps represent private memory managed by the user-mode heap manager and, like the Private memory type, is charged against the system commit limit and contains application data. Application memory allocations using the C runtime malloc library, HeapAlloc and LocalAlloc, use Heap memory.

Managed Heap

Managed heap represents private memory that's allocated and used by the .NET garbage collector and, like the Private memory type, is charged against the system commit limit and contains application data.

Stack

Stacks are private memory used to store function parameters, local function variables and function invocation records for individual threads. Stacks are charged agains the commit limit and typically grow on demand.

System

System memory is private kernel-mode physical memory associated with the process. The vast majority of System memory consists of the process page tables.

Free

Free memory regions are spaces in the process address space that are not allocated.

Note: The VirtualProtect API can change the protections of any page to something different than that implied by the original allocation's memory type. That means that there can potentially be pages of memory private to the process in a shareable memory region, for instance, because the region was created as a pagefile-backed section, but then the application changed the protection on some pages to copy-on-write and modified them. The protection shown for a region isn't necessarily the protection it had since it's creation. 

The VMMap Window

When you run VMMap, it will present a process selection dialog. After you select a process it analyzes the process and presents the graphs:

• Commit Summary Graph This graph shows the committed (memory that represents data or code) memory usage of the process by type. The graph's scale is the total committed virtual memory usage of the process.

• Private Summary Graph This graph shows the committed private virtual memory. This memory is backed by the paging file and charged against the system commit limit. It corresponds to the PrivateBytes performance counter.

• Working Set Summary Graph This graph shows the working set usage of the process by memory type. Working set represents the amount of commited virtual memory that's in physical memory and owned by the process. The graph's scale is the total committed virtual memory.

The color key for the regions in the graphs is presented in the Summary View. Below the graphs VMMap shows two windows:

• Summary View This shows a summary of the virtual and physical usage of the process by type.

• Details View This shows the memory regions of the process address space.

For each region, VMMap displays the memory type, memory protection, and virtual and physical memory usage. Selecting a type in the Summary View filters the Details View to just show regions of the selected type. Select Total to show all memory types in the Details View. In order to reduce noise in the output, VMMap does not show entries that have a value of 0.

 

Both windows include the following columns of information:

Size

Total size of the allocated type or region. For the Summary View and regions in the Details View that do not have reserved areas, this is equal to the maximum amount of physical memory required to store the region's data.

Committed

The amount of the allocation backed by system virtual memory (RAM and paging files) and charged against the system commit limit.

Private

The amount of the allocation that, if modified, is private to the process (copy-on-write pages that have not been modified are included). This represents the charge to the system commit limit (sum of RAM plus the paging files) of the region.

Total WS

The amount of physical memory assigned to the type or region.

Private WS

The amount of physical memory assigned to the type or region that cannot be shared with other processes.

Shareable WS

The amount of physical memory assigned to the type or region that can be shared with other processes.

Shared WS

The amount of Shareable WS that is currently shared with other processes.

Locked WS

The amount of the working set that is locked into physical memory. This corresponds to memory locked via the VirtualAlloc API as well as Address Windowing Extensions (AWE) memory views. Note that working set figures returned by some other diagnostic tools does not include AWE memory.

Largest
The largest block of the  particular size.

Note: Because of limitations in  the APIs provided by the operating system, on 64-bit Windows XP or 64-bit  Windows Server 2003, Vmmap does not show the regions corresponding to 32-bit  thread stacks when analyzing 32-bit processes.