How to check the total usage percentage by Windows server memory?

[omprakash9998]

Hi all,

How do you check the total % of memory being used by a windows server.
Which Performance counter can help us find the total Percentage of memory a windows server is consuming?

Thanks,
Om

[omprakash9998]

The List of Values are for the Counter % committed bytes in use. But the memory usage on the server lists it higher than the Value of the counter.
Any help is appreciated. Thank you

[jessec_splunk · Accepted solution]

% Committed Bytes In Use

[omprakash9998]

Thank you for the reply.

I tried to match the Memory usage in the Performance tab in the Windows task manager to the % Committed Bytes in Use. But the % committed bytes in use is lower than the values showed in the Task Manager. is there any other counter's value that has to be added to the % committed bytes in use.

Thank you

[jessec_splunk]

But the two numbers should not be far apart though.

% Committed Bytes In Use is virtual memory used against "Commit Limit", which could be higher than physical memory -- this is for performance reasons so clean pages don't get ejected due to committed size ~= Physical Limit.

To make your life easier, if you see % Committed Bytes In Use is near 80%, then you are hitting memory limit -- only two ways to resolve this: add more memory (so Commit Limit will also increase) and run less load.

Better approach is to capture both

% Committed Bytes In Use
Available Bytes

If % Committed Bytes In Use is > 80%, OR Available Bytes is < 5%, your system is under extreme memory stress.

Thanks.

[kumarpunee]

Yes, but how do we calculate % of Available bytes. Counter gives only numbers in Bytes or KBytes or MBytes. Where can I get the total memory installed on system to calculate the total % in use.

[koshyk]

The stanza should be present in Splunk_TA_windows . Install this addon onto your Search Head for field extractions

But essentially, Create an app YOUR_windows_inputs and put below stanza into inputs.conf and push it to your clients (using deployment server)

## Memory
[perfmon://Memory]
counters = Page Faults/sec; Available Bytes; Committed Bytes; Commit Limit; Write Copies/sec; Transition Faults/sec; Cache Faults/sec; Demand Zero Faults/sec; Pages/sec; Pages Input/sec; Page Reads/sec; Pages Output/sec; Pool Paged Bytes; Pool Nonpaged Bytes; Page Writes/sec; Pool Paged Allocs; Pool Nonpaged Allocs; Free System Page Table Entries; Cache Bytes; Cache Bytes Peak; Pool Paged Resident Bytes; System Code Total Bytes; System Code Resident Bytes; System Driver Total Bytes; System Driver Resident Bytes; System Cache Resident Bytes; % Committed Bytes In Use; Available KBytes; Available MBytes; Transition Pages RePurposed/sec; Free & Zero Page List Bytes; Modified Page List Bytes; Standby Cache Reserve Bytes; Standby Cache Normal Priority Bytes; Standby Cache Core Bytes; Long-Term Average Standby Cache Lifetime (s)
disabled = false
interval = 30
object = Memory
useEnglishOnly=true
index = yourWindowsIndex

This should report to yourWindowsIndex with relevant sourcetype.
Good to have a read on: https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowsperformance

[adonio]

read here:
https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/MonitorWindowsperformance
and here:
https://docs.microsoft.com/en-us/windows/desktop/PerfCtrs/performance-counters-portal