How is RAM reported and represented in Process Explorer?

5

3

I am running Sysinternals' Process Explorer There are a couple things I am confused about, and I did not see this info in the help file.

Here is a screenshot: Screenshot of Sysinternals' Process Explorer

  1. The Working Set column, is that RAM? And if so is that how much RAM is being used by that process?
  2. What do the colors represent? Yellow, Purple, Red, and No Color or Gray.
  3. What are Private Bytes?

L84

Posted 2011-09-22T02:46:01.920

Reputation: 3 403

Answers

7

The Working Set column, is that RAM? And if so is that how much RAM is being used by that process?

Yes. The working set of a process is the virtual memory of the process that is in physical RAM.

Note: some of this might be shared with other processes, so the sum of all working sets will be greater than the total RAM allocated to processes.

What do the colors represent? Yellow, Purple, Red, and No Color or Gray.

Options | Configure Colors to see the definitions.

What are Private Bytes?

The amount of virtual memory allocated to the process, it is likely that some of this is in the page file and some in physical RAM.

I would recommend Windows Internals for a detailed description of Windows memory management (all simple explanations are approximations and likely to lead to wrong conclusions). Also Windows Sysinternals Administrator's Reference for details on using Process Explorer and the other Sysinternals tools.

Richard

Posted 2011-09-22T02:46:01.920

Reputation: 8 152

1

I can answer question 2 handily. Under 'Options"-->"Configure Colors" You get this:

http://screencast.com/t/c3MSV1zbsg

As for #1 and #3, this forum post has some info (two birds, one stone):

All I know is that Working Set is equivalent to Mem Usage in Task Manager and Private Bytes is equivalent to Task Manager's Virtual Memory.

If you want technical definitions:

Working Set refers to the number of pages of virtual memory committed to a given process, both shared and private.

Private memory, is defined as memory allocated for a process which cannot be shared by other processes.

apathos

Posted 2011-09-22T02:46:01.920

Reputation: 631

Thanks for the info => One question - What exactly is a "page" (...number of pages of virtual memory...) that might help solve some of my questions. – L84 – 2011-09-22T03:40:52.127

1@Lynda: It's (usually) 4096 bytes of virtual memory, the smallest unit of memory which is managed independently in terms of sharing, caching, paging, etc. – user541686 – 2011-09-22T04:44:29.310

I see that every value in working memory is a multiple of 4, must be cos it's from lots of 4KB "pages" of VM. – barlop – 2011-09-22T06:05:34.763

"virtual memory committed to a given process, both shared and private." if it's shared then can it really be "committed to a given process"? and would it mean the total for all working set memory would be useless cos would count some memory multiple times. If though it doesn't mean shared, but, used by others, then it could work.. committed and total would have no duplicates. Like a "shared" network drive belongs on one, and is used by others, not really shared. – barlop – 2011-09-22T06:10:21.200

2"Committed" means that the OS has mapped an address range to either specific RAM pages and/or harddisk sectors. That can still be shared across processes. E.g. when you're running Notepad twice, the memory for the executable is both committed (backed by Notepad.EXE on disk) and shared. – MSalters – 2011-09-22T09:14:32.077