On This Page

• Tool Parameters
• Alerts by Chronological Order
• 2022.03.06-00:00:01 - 2022.03.06-00:48:01 (Alerts: 0|1)
• 2022.03.06-00:48:01 - 2022.03.06-01:36:01 (Alerts: 0|8)
• 2022.03.06-01:36:01 - 2022.03.06-02:24:01 (Alerts: 0|3)
• 2022.03.06-02:24:01 - 2022.03.06-03:12:01 (Alerts: 0|2)
• 2022.03.06-03:12:01 - 2022.03.06-04:00:01 (Alerts: 0|2)
• 2022.03.06-04:00:01 - 2022.03.06-04:48:01 (Alerts: 0|2)
• 2022.03.06-04:48:01 - 2022.03.06-05:36:01 (Alerts: 0|2)
• 2022.03.06-05:36:01 - 2022.03.06-06:24:01 (Alerts: 1|6)
• 2022.03.06-06:24:01 - 2022.03.06-07:12:01 (Alerts: 0|1)
• 2022.03.06-07:12:01 - 2022.03.06-08:00:01 (Alerts: 1|1)
• 2022.03.06-08:00:01 - 2022.03.06-08:48:01 (Alerts: 0|1)
• 2022.03.06-08:48:01 - 2022.03.06-09:36:01 (Alerts: 0|1)
• 2022.03.06-09:36:01 - 2022.03.06-10:24:01 (Alerts: 1|1)
• 2022.03.06-10:24:01 - 2022.03.06-11:12:01 (Alerts: 0|1)
• 2022.03.06-11:12:01 - 2022.03.06-11:59:01 (Alerts: 0|1)
• 2022.03.06-11:59:01 - 2022.03.06-12:47:01 (Alerts: 0|1)
• 2022.03.06-12:47:01 - 2022.03.06-13:35:01 (Alerts: 0|6)
• 2022.03.06-13:35:01 - 2022.03.06-14:23:01 (Alerts: 2|4)
• 2022.03.06-14:23:01 - 2022.03.06-15:11:01 (Alerts: 0|0)
• 2022.03.06-15:11:01 - 2022.03.06-15:59:01 (Alerts: 1|1)
• 2022.03.06-15:59:01 - 2022.03.06-16:47:01 (Alerts: 1| 0)
• 2022.03.06-16:47:01 - 2022.03.06-17:35:01 (Alerts: 1| 0)
• 2022.03.06-17:35:01 - 2022.03.06-18:23:01 (Alerts: 0|2)
• 2022.03.06-18:23:01 - 2022.03.06-19:11:01 (Alerts: 0|0)
• 2022.03.06-19:11:01 - 2022.03.06-19:59:01 (Alerts: 0|0)
• 2022.03.06-19:59:01 - 2022.03.06-20:47:01 (Alerts: 1| 0)
• 2022.03.06-20:47:01 - 2022.03.06-21:35:01 (Alerts: 0|0)
• 2022.03.06-21:35:01 - 2022.03.06-22:23:01 (Alerts: 0|0)
• 2022.03.06-22:23:01 - 2022.03.06-23:11:01 (Alerts: 0|0)
• 2022.03.06-23:11:01 - 2022.03.06-23:58:57 (Alerts: 0|0)
• Memory
• Memory Available MBytes (Alerts: 1|17)
• Memory Free System Page Table Entries (Alerts: 0|0)
• Memory Pool Non-Paged Bytes (Alerts: 0|0)
• Memory Pool Paged Bytes (Alerts: 0|0)
• Memory Pages/sec (Alerts: 0|4)
• Memory System Cache Resident Bytes (Alerts: 0|0)
• Memory % Committed Bytes In Use (Alerts: 0|0)
• Memory Pages Output/sec (Stats only)
• Memory Transition Pages RePurposed/sec (Stats only)
• Memory Committed Bytes (Stats only)
• Memory Commit Limit (Stats only)
• Memory Pages Input/sec (Alerts: 0|4)
• Memory Long-Term Average Standby Cache Lifetime (s) (Alerts: 1|8)
• Memory Pool Paged Resident Bytes (Stats only)
• Network Interface
• Network Interface % Network Utilization (Alerts: 0|0)
• Network Interface Output Queue Length (Alerts: 0|0)
• Network Interface % Network Utilization Sent (Alerts: 0|0)
• Network Interface % Network Utilization Received (Alerts: 0|0)
• Network Interface Packets Outbound Errors (Alerts: 0|0)
• Network Interface Bytes Total/sec (Stats only)
• Network Interface Current Bandwidth (Alerts: 0|0)
• Network Interface Packets/sec (Stats only)
• Network Interface Packets Sent/sec (Stats only)
• Network Interface Packets Received/sec (Stats only)
• PhysicalDisk
• PhysicalDisk Read Latency Analysis (Alerts: 3| 0)
• PhysicalDisk Write Latency Analysis (Alerts: 3| 0)
• PhysicalDisk Current Disk Queue Length (Alerts: 0|0)
• PhysicalDisk Avg. Disk Queue Length (Alerts: 0|0)
• PhysicalDisk Disk Bytes/sec (Stats only)
• Process
• Process Private Bytes (Alerts: 0|0)
• Process Handle Count (Alerts: 0|3)
• Process Thread Count (Alerts: 0|0)
• Process Working Set (Alerts: 0|0)
• Process % Processor Time (Alerts: 0|0)
• Process Virtual Bytes (Alerts: 0|0)
• Process IO Data Operations/sec (Alerts: 0|6)
• Process IO Other Operations/sec (Alerts: 0|4)
• Process ID Process (Stats only)
• Process IO Read Operations/sec (Alerts: 0|1)
• Process IO Write Operations/sec (Alerts: 0|0)
• Process % Privileged Time (Alerts: 0|0)
• Processor
• Processor % Processor Time (Alerts: 1| 0)
• Processor % Privileged Time (Alerts: 0|0)
• Processor % Interrupt Time (Alerts: 0|0)
• Processor % DPC Time (Alerts: 0|0)
• Processor % User Time (Stats only)
• Processor DPC Rate (Stats only)
• Server
• Server Pool Nonpaged Failures (Stats only)
• Server Pool Paged Failures (Stats only)
• System
• System Processor Queue Length (Alerts: 0|0)
• System System Calls/sec (Stats only)
• TCPv4
• TCPv4 Connection Failures (Alerts: 0|0)
• Incomplete analyses
• Disclaimer

Description: This section displays all of the alerts in chronological order.

Memory Available MBytes

Description: Available MBytes is the amount of physical RAM, in megabytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. If this counter is low, then the computer is running low on physical memory (RAM).
This analysis will alert a Warning if this counter's value is less than 10% of the physical memory installed and will alert a critical if this counter's value is less than 100 MB.

References:

• PerfGuide: Low Available RAM
• Chapter 8: Physical Memory of the Windows Performance Analysis Field Guide by Clint Huffman

Memory Free System Page Table Entries

Description: Free System Page Table Entries is the number of page table entries not currently in used by the system. This analysis determines if the system is running out of free system page table entries (PTEs) by checking if there is less than 20,000 free PTE's as a Warning and critical if there is less than 8,000 free PTEs. Lack of enough PTEs can result in system wide hangs. Also note that the /3GB switch will lower the amount of free PTEs significantly.

The Performance Monitor Memory\Free System Page Table Entries counter is inaccurate on installations of Windows Server 2003 without Service Pack 1. For more information about this counter, see Microsoft Knowledge Base article 894067. The Performance tool does not accurately show the available Free System Page Table entries in Windows Server 2003 http://go.microsoft.com/fwlink/?linkid=3052&kbid=894067

Fix for Win2003 SP1 systems with /3GB and low on PTE's: If the system is low on PTE's, running Windows 2003, and using /3GB switch, then consider using the /USERVA switch to give back some of the memory to the kernel. Note, this only works for Free System PTE issues.

For more information on the USERVA switch, go to: How to use the /userva switch with the /3GB switch to tune the User-mode space to a value between 2 GB and 3 GB

Reference:

Ruling Out Memory-Bound Problems

Microsoft Knowledge Base article 894067 The Performance tool does not accurately show the available Free System Page Table entries in Windows Server 2003

How to use the /userva switch with the /3GB switch to tune the User-mode space to a value between 2 GB and 3 GB

How to determine the appropriate page file size for 64-bit versions of Windows Server 2003 or Windows XP
http://support.microsoft.com/kb/889654

Memory Pool Non-Paged Bytes

Description: Pool Nonpaged Bytes is the size, in bytes, of the nonpaged pool, an area of system memory (physical memory used by the operating system) for objects that cannot be written to disk, but must remain in physical memory as long as they are allocated.

This analysis checks to see if the system is becoming close to the maximum Pool Nonpaged memory size. It does this by estimating the pool sizes taking into consideration /3GB, physical memory size, and 32-bit/64-bit, then determining if the value is higher than 60% of the estimated pool size. If the system becomes close to the maximum size, then the system could experience system wide hangs. Checks both 32-bit and 64-bit memory pools. Warning: The /3GB switch option in the boot.ini file significantly reduces the size of this memory pool.

If the system is low on Paged Pool or non-Paged pool memory, then it is recommended to open a support case with Microsoft to address this. Alternatively, you can use a free and public tool called Poolmon.exe to see what DLL's are using kernel memory (see the article below). Most kernel memory leaks can be tracked back to a usermode process. To identify which user mode process is responsible, reboot the system (so you start off with a clean system), start a performance monitor log intending to run for a week or more capturing the Memory and Process objects, then analyze the perfmon log looking for memory leaks and/or handle leaks in one or more of the processes. In any case, migrating to a 64-bit version of Windows should alleviate this issue.

References
How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel Mode Memory Leaks
http://support.microsoft.com/kb/177415

Ruling Out Memory-Bound Problems
http://technet.microsoft.com/en-us/library/7a44b064-8872-4edf-aac7-36b2a17f662a.aspx

Memory Pool Paged Bytes

Description: This analysis checks to see if the system is becoming close to the maximum Pool paged memory size. Pool Paged Bytes is the size, in bytes, of the paged pool, an area of system memory (physical memory used by the operating system) for objects that can be written to disk when they are not being used.

This analysis checks to see if the system is becoming close to the maximum Pool Paged memory size. It does this by estimating the pool sizes taking into consideration /3GB, physical memory size, and 32-bit/64-bit, then determining if the value is higher than 60% of the estimated pool size. If the system becomes close to the maximum size, then the system could experience system wide hangs. Checks both 32-bit and 64-bit memory pools. Warning: The /3GB switch option in the boot.ini file significantly reduces the size of this memory pool.

If the system is low on Paged Pool or non-Paged pool memory, then it is recommended to open a support case with Microsoft to address this. Alternatively, you can use a free and public tool called Poolmon.exe to see what DLL's are using kernel memory (see the article below). Most kernel memory leaks can be tracked back to a usermode process. To identify which user mode process is responsible, reboot the system (so you start off with a clean system), start a performance monitor log intending to run for a week or more capturing the Memory and Process objects, then analyze the perfmon log looking for memory leaks and/or handle leaks in one or more of the processes. In any case, migrating to a 64-bit version of Windows should alleviate this issue.

Reference:
How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel Mode Memory Leaks
http://support.microsoft.com/kb/177415

Ruling Out Memory-Bound Problems
http://technet.microsoft.com/en-us/library/7a44b064-8872-4edf-aac7-36b2a17f662a.aspx

How to determine the appropriate page file size for 64-bit versions of Windows Server 2003 or Windows XP
http://support.microsoft.com/kb/889654

Memory Pages/sec

Description: This analysis checks Pages/sec (hard page faults) of more than 1000. Keep in mind that all hard page faults are counted in the pages/sec counter which may or may not be related to the page file(s). According to Wikipedia, memory-mapped files are a segment of virtual memory which has been assigned a direct byte-for-byte correlation with some portion of a file or file-like resource. This resource is typically a file that is physically present on-disk, but can also be a device, shared memory object, or other resource that the operating system can reference through a file descriptor. In other words, applications like Microsoft Word and Microsoft PowerPoint will not load entire documents into RAM. Instead, they memory map the file, so that when you navigate through the document, it loads portions of the document as needed. The act of loading portions of the document from disk to RAM as a memory mapped file causes a hard page fault which is counted in the pages/sec counter. See the article The Case of the Phantom Hard Page Faults. To determine if the hard page faults are actually hitting the page file, use Process Monitor with Advanced Ouput enabled to see how often the page file(s) are hit.
Pages/sec is the rate at which pages are read from or written to disk to resolve hard page faults. It is the sum of Memory\Pages Input/sec and Memory\Pages Output/sec. It is counted in numbers of pages, so it can be compared to other counts of pages, such as Memory\Page Faults/sec, without conversion. It includes pages retrieved to satisfy faults in the file system cache (usually requested by applications) non-cached mapped memory files.

This counter should always be below 1000, therefore this analysis checks for values above 1000. Use this analysis in correlation with Available Memory Analysis and Memory Leak Analysis. If all are throwing alerts at the same time, then this may indicate the system is running out of memory and the suspected processes involved and follow analysis steps mentioned in the Memory Leak analysis.

Reference

• Ruling Out Memory-Bound Problems
  
• The Case of the Phantom Hard Page Faults
  

Memory System Cache Resident Bytes

Description: System Cache Resident Bytes is the size, in bytes, of the pageable operating system code in the file system cache. This value includes only current physical pages and does not include any virtual memory pages not currently resident. It does equal the System Cache value shown in Task Manager. As a result, this value may be smaller than the actual amount of virtual memory in use by the file system cache. This value is a component of Memory\\System Code Resident Bytes which represents all pageable operating system code that is currently in physical memory. This counter displays the last observed value only; it is not an average.

This analysis checks if System Cache Resident Bytes is consuming more than 25 percent of RAM. Under load, a server might use the System Cache in order to cache I/O activity such as disk. Use in correlation with Process IO Data Operations/sec and Process IO Other Operations/sec Analyses.

References
File Cache Performance and Tuning http://technet.microsoft.com/en-us/library/bb742613.aspx

Memory % Committed Bytes In Use

Description: % Committed Bytes In Use is the ratio of Memory\Committed Bytes to the Memory\Commit Limit. Committed memory is the physical memory (RAM plus all of the page files) in use for which space has been reserved in the paging file should it need to be written to disk. The commit limit is the sum of physical RAM and the size of all of the paging files. If the paging file is enlarged, the commit limit increases, and the ratio is reduced). This counter displays the current percentage value only; it is not an average.

This analysis checks if the amount of Commited memory is becoming close to the Commit Limit (RAM plus total page file sizes), If so, then identify if you have a memory leak. If no memory leak is identified, then consider adding more physical RAM or increase the size of your page files..

The following article covers how to identify and troubleshoot system committed memory problems:
PerfGuide: Out of System Committed Memory

Memory Pages Output/sec

Description: Pages Output/sec is the rate at which pages are written to disk to free up space in physical memory. Pages are written back to disk only if they are changed in physical memory, so they are likely to hold data, not code. A high rate of pages output might indicate a memory shortage. Windows writes more pages back to disk to free up space when physical memory is in short supply. This counter shows the number of pages, and can be compared to other counts of pages, without conversion.

Memory Transition Pages RePurposed/sec

Description: Transition Pages RePurposed is the rate at which the number of transition cache pages were reused for a different purpose. These pages would have otherwise remained in the page cache to provide a (fast) soft fault (instead of retrieving it from backing store) in the event the page was accessed in the future. Note these pages can contain private or sharable memory.

Memory Committed Bytes

Description: Committed Bytes is the amount of committed virtual memory, in bytes. Committed memory is the memory which has space reserved in RAM and on the disk paging file(s). There can be one or more paging files on each physical drive. This counter displays the last observed value only; it is not an average.
This analysis checks if the amount of total committed memory (Commit Charge) exceeds the amount of physical RAM installed. If so, the page file needs to be used to help store the committed memory and performance might degrade. To alleviate this, try to identify which process is consuming the most committed memory by looking at process Private Bytes and looking for a potential memory leak (the consumption of memory over a long period of time without releasing it). Adding more RAM to the computer will help alleviate this issue, but if it is a memory leak, then the problem might return.

Memory Commit Limit

Description: Commit Limit is the amount of virtual memory that can be committed without having to extend the paging file(s). It is measured in bytes. Committed memory is the physical memory which has space reserved on the disk paging files. There can be one paging file on each logical drive). If the paging file(s) are be expanded, this limit increases accordingly. This counter displays the last observed value only; it is not an average.

Memory Pages Input/sec

Description: Pages Input/sec is the rate at which pages are read from disk to resolve hard page faults. Hard page faults occur when a process refers to a page in virtual memory that is not in its working set or elsewhere in physical memory, and must be retrieved from disk. When a page is faulted, the system tries to read multiple contiguous pages into memory to maximize the benefit of the read operation. Compare the value of Memory\\Pages Input/sec to the value of Memory\\Page Reads/sec to determine the average number of pages read into memory during each read operation. This analysis checks for more than 1000 page inputs per second. If there is a lot of page inputs per second, then it could be normal file I/O reading from the disk as memory mapped files, or it could be reading from the page file. This counter is not an indicator of a lack of memory condition unless there is a lot of memory pressure corresponding to this alert.

Memory Long-Term Average Standby Cache Lifetime (s)

Description: A low Long-Term Standby cache lifetime might indicate a low physical memory condition when correlated with other memory related performance counters such as \Memory\Available MBytes, \Memory\Page Writes/sec, and disk related performance counters such as \LogicalDisk(*)\Avg. Disk sec/Transfer.

The \Memory\Long-Term Average Standby Cache Lifetime (s) performance counter measures the average lifetime in seconds of pages in the standby list cache over a long period of time. A low life expectancy could indicate that the pages on the standby list are frequently used i.e. the system has to replenish the standby list with pages from the modified list (pages that must be written to disk first) and the modified list is replenished by the working sets of processes.

The Standby page list is a list of physical pages that are no longer in use (they are available to be reused), but contain data that already exists on disk. If the data is needed again, then it can be served from the Standby list in physical memory instead of going to disk to get it. Therefore, it is part of the system available memory and it acts as disk cache - the larger the disk cache, the less demand on the disk.

Memory Pool Paged Resident Bytes

Description: Pool Paged Resident Bytes is the size, in bytes, of the portion of the paged pool that is currently resident and active in physical memory. The paged pool is an area of the system virtual memory that is used for objects that can be written to disk when they are not being used. This counter displays the last observed value only; it is not an average.

Network Interface % Network Utilization

Description: % Network Utilization doesn't exist as a normal performance counter, so this analysis uses multiplies \Network Interface(*)\Bytes Total/sec by 8 (to convert it to bits total/sec), divides it by \Network Interface(*)\Current Bandwidth, and multiplies the result by 100 to create a percentage. This analysis throws a warning alert when greater than 50 and throws a critical alert when greater than 80.

Network Interface Output Queue Length

Description:

Network Interface % Network Utilization Sent

Description: % Network Utilization Sent doesn't exist as a normal performance counter, so this analysis uses multiplies \Network Interface(*)\Bytes Sent/sec by 8 (to convert it to bits total/sec), divides it by \Network Interface(*)\Current Bandwidth, and multiplies the result by 100 to create a percentage. This analysis throws a warning alert when greater than 50 and throws a critical alert when greater than 80.

Network Interface % Network Utilization Received

Description: % Network Utilization Received doesn't exist as a normal performance counter, so this analysis uses multiplies \Network Interface(*)\Bytes Received/sec by 8 (to convert it to bits total/sec), divides it by \Network Interface(*)\Current Bandwidth, and multiplies the result by 100 to create a percentage. This analysis throws a warning alert when greater than 50 and throws a critical alert when greater than 80.

Network Interface Packets Outbound Errors

Description: Packets Outbound Errors is the number of outbound packets that could not be transmitted because of errors.

If errors are occuring during this analysis, network connectivity could be affected with a potential for random Outlook RPC dialog boxes. See http://technet.microsoft.com/en-us/library/aa997363.aspx and http://technet.microsoft.com/en-us/library/aa995850.asp for more information

Network Interface Bytes Total/sec

Description: Bytes Total/sec is the rate at which bytes are sent and received over each network adapter, including framing characters. Network Interface\Bytes Total/sec is a sum of Network Interface\Bytes Received/sec and Network Interface\Bytes Sent/sec.

Network Interface Current Bandwidth

Description: Current Bandwidth is an estimate of the current bandwidth of the network interface in bits per second (BPS). For interfaces that do not vary in bandwidth or for those where no accurate estimation can be made, this value is the nominal bandwidth.

Network Interface Packets/sec

Description: Packets/sec is the rate at which packets are sent and received on the network interface.

Network Interface Packets Sent/sec

Description: Packets Sent/sec is the rate at which packets are sent on the network interface.

Network Interface Packets Received/sec

Description: Packets Received/sec is the rate at which packets are received on the network interface.

PhysicalDisk Read Latency Analysis

Description: Avg. Disk sec/Read is the average time, in seconds, of a read of data to the disk. This analysis determines if any of the physical disks are responding slowly.

If the response times are greater than 0.015 (15 milliseconds), then the disk subsystem is keeping up with demand.

If the response times are greater than 0.025 (25 milliseconds), then the disk subsystem is likely overwhelmed.

Reference:
Ruling Out Disk-Bound Problems
http://technet.microsoft.com/en-us/library/5bcdd349-dcc6-43eb-9dc3-54175f7061ad.aspx

PhysicalDisk Write Latency Analysis

Description: Avg. Disk sec/Write is the average time, in seconds, of a write of data to the disk. This analysis determines if any of the physical disks are responding slowly.

If the response times are greater than 0.015 (15 milliseconds), then the disk subsystem is keeping up with demand.

If the response times are greater than 0.025 (25 milliseconds), then the disk subsystem is likely overwhelmed.

Reference:
Ruling Out Disk-Bound Problems
http://technet.microsoft.com/en-us/library/5bcdd349-dcc6-43eb-9dc3-54175f7061ad.aspx

PhysicalDisk Current Disk Queue Length

Description: Current Disk Queue Length is the number of requests outstanding on the disk at the time the performance data is collected. It also includes requests in service at the time of the collection. This is a instantaneous snapshot, not an average over the time interval. Multi-spindle disk devices can have multiple requests that are active at one time, but other concurrent requests are awaiting service. This counter might reflect a transitory high or low queue length, but if there is a sustained load on the disk drive, it is likely that this will be consistently high. Requests experience delays proportional to the length of this queue minus the number of spindles on the disks. For good performance, this difference should average less than two.

If the server is using an HBA (Host Bus Adapter: This is used to connect to a Storage Area Network SAN) and if the Current Disk Queue Length goes up to 32 frequently, then consider increasing the queue depth on the HBA to allow more concurrent I/O to the SAN. Please consult your SAN administrator before making any changes.

PhysicalDisk Avg. Disk Queue Length

Description: Avg. Disk Queue Length is the average number of both read and write requests that were queued for the selected disk during the sample interval.

PhysicalDisk Disk Bytes/sec

Description: Disk Bytes/sec is the rate bytes are transferred to or from the disk during write or read operations.

Process Private Bytes

Description: This analysis determines if one or more processes are leaking private, committed, memory over time. A process consuming large portions of memory is okay as long as the process returns the memory back to the system. Look for increasing trends in the chart. An increasing trend over a long period of time could indicate a system committed memory leak. Private Bytes is the current size, in bytes, of memory that this process has allocated that cannot be shared with other processes. This analysis checks for a 100 MB per hour increasing trend. Use this analysis in correlation with the \Memory\Committed Bytes performance counter.

Use this analysis in correlation with the \Memory\Committed Bytes. If you suspect a memory leak condition, then install and use the Debug Diag tool. For more information on the Debug Diag Tool, see the references section.

References:

Debug Diagnostic Tool v1.1 http://www.microsoft.com/downloads/details.aspx?FamilyID=28bd5941-c458-46f1-b24d-f60151d875a3&displaylang=en

Process Handle Count

Description: This analysis checks each process to determine if there is a handle leak and if more than 20,000 handles are open by a process. Handle leaks can be attributed to system committed memory leaks. If this analysis throws alerts, then you need to manually open the performance monitor log and look at the instances \Process(*)\Handle Count to determine which process is leaking handles. More than 20,000 handles may indicate a handle leak which might be related to ephemeral port exhaustion.

Process Thread Count

Description: The number of threads currently active in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread.

This analysis checks each process to determine if it is leaking more than 100 threads per hour and if it has more than 1000 threads. A process with a large number of threads and/or an aggressive upward trend could indicate a thread leak which typically results in a system committed memory leak and/or high context switching. High context switching will result in high privileged mode CPU usage.

Process Working Set

Description: Working Set is the current size, in bytes, of the Working Set of a process. The Working Set is the set of memory pages touched recently by the threads in the process. It is the amount of RAM consumed by each process. If available physical memory (RAM) in the computer is above a threshold, pages are left in the Working Set of a process longer. When available memory falls below a threshold, pages are trimmed from Working Sets more frequently than when not in a low available memory condition. If the trimmed page are still in RAM, but not in the processes working set (due to being trimmed), then some of them may be soft-faulted (RAM to RAM) back into the Working Set.
This analysis checks for an increasing trend of 100 MB or more per hour in all of the processes combined. This could be an aggressive working set (RAM usage) leak, but keep in mind that this is only tracking the amount of RAM used by all of the processes and does not include committed memory that has trimmed from the working set. This is generally why Private Bytes is a better counter to use for general memory leaks. With that said, Working Set is a helpful counter to have when analyzing low physical memory conditions that might be induced by page locking which can preven the virtual memory manager from trimming. Use this analysis in correlation with Available Memory Analysis.

Reference:

• Ruling Out Memory-Bound Problems
  
• The Case of the Out of Memory BizTalk Server