Poolmon tag file nonp

Most Points Rookie The Distinguished Expert awards are presented to the top veteran and rookie experts to earn the most points in the top 50 topics. Join our community to see this answer! Unlock 1 Answer and 1 Comment. Andrew Hancock - VMware vExpert. See if this solution works for you by signing up for a 7 day free trial. What do I get with a subscription? With your subscription - you'll gain access to our exclusive IT community of thousands of IT pros.

We can't always guarantee that the perfect solution to your specific problem will be waiting for you. If you ask your own question - our Certified Experts will team up with you to help you get the answers you need. Who are the certified experts? So what happens if the tag that you are looking for is not listed in Pooltag. You can use the findstr command in all versions of Windows.

In the example below, I am looking for the driver that uses the CPnp tag:. If the driver is not in the drivers folder, you can also search the Program Files folder, the entire System Drive, or any other location that you specify. Pretty straightforward, right?

The following command displays all allocations that do not have the AfdB tag;. The following command displays allocations that have pool tags beginning with Afd , the tag used by afd. The following command displays allocations that have tags beginning with Aud and four-character tags beginning with Cc , except for allocations with the CcBc tag;.

You can also sort the PoolMon display by the change in a value between updates. The following command displays allocations with tags beginning with Afd , and sorts by the change in allocations. When PoolMon is in sort-by-change mode, it interprets all sort commands as commands to sort by the change in the value. If you press a parenthesis key again, it sorts by the value.

If you find a problem in allocations with a particular tag, this feature helps you identify the offending component or driver. The following command displays memory allocated with tags that begin with NtF. It uses the question mark character? The resulting display lists allocations with tags beginning in NtF. In this case, the display is even more specific, because pooltag. When a tag that appears in the display is not included in pooltag.

The resulting display lists the allocations with tags ending in MEM. However, because the MEM tags are not included in pooltag.

The following command starts PoolMon. If you do not specify a local tag file and PoolMon cannot find a localtag. PoolMon cannot generate a local tag file on bit versions of Windows. The resulting display, which uses the content from the newly created localtag. The order of parameters does not change the output. The following command lists allocations for tags beginning with Ip. Let PoolMon run for a few hours.

Because starting PoolMon changes the data, it must regain a steady state before the data is reliable. Save the information generated by PoolMon, either as a screen shot, or by copying it from the command window and pasting it into Notepad. Returning to PoolMon, press the p key twice to display only allocations from the nonpaged pool. Repeat steps 3 and 4 approximately every half-hour for at least two hours, switching between the paged and nonpaged pool displays each time.