Physical memory overwhelmed PAL analysis – holy grail found!

I just wrote a very complicated PAL analysis that determines if physical memory is overwhelmed. This analysis takes into consideration the amount of available physical memory and the disk queue length, IO size, and response times of the logical disks hosting the paging files. Also, if no paging files are configured, then it simply has…


Should the paging file be moved from C: drive?

Should the paging file be moved from C: drive to another drive? This was the question I received today and thought I’d share my response to this. There is no general answer for all situations, so this question needs more information about the environment. This is why you will not (and should not) find any…


PAL processing, processors, and threads

I commonly get questioned on what response should be given to the NumberOfProcessors question variable in the PAL tool, so I thought I might try to explain it a bit… PAL is designed to be a stand-alone tool where the analysis of a performance counter log can be analyzed on a workstation where an administrator…


PAL collector script – PalCollector.ps1

One of the top questions I get with the PAL tool is what data to collect. As many of you know, the PAL tool only analyze existing counter logs. It is up to you to create the counter log. To help with this problem, I created a PowerShell script called PalCollector.ps1. This script will query…


How to create a threshold file for the PAL tool

The Performance Analysis of Logs (PAL) tool is an open source project at that analyzes performance counter logs. It has thresholds for performance counters written by experts in their respective areas spanning nearly all of the major Microsoft Server products, some Citrix XenApp,, VMware. and others. The number of products covered is limited to…


Page Frame Number (PFN) database

I just finished writing an article on the public, wiki, PFE PerfGuide on the subject of the Page Frame Number database in Microsoft Windows and Windows Server. This little known database is used by the operating system to keep track of the physical memory of the system. Please check it out and update it if…


Memory combining in Windows 8 and Windows Server 2012

I’ve spent that last few weeks studying the memory architecture of Windows 8 and Windows Server 2012. Windows and Windows Server has always had sharable memory where portions of DLLs and EXEs will have a single copy in physical memory (synonymous with RAM) and all of the applications that need them will simply reference the…


Can a process be limited on how much physical memory it uses?

I’ve been asked a lot of great questions lately and thought I’d post some of them. As you might know, I am one of the instructors of the popular workshop “Vital Signs” which teaches students Windows architecture and how to identify performance bottlenecks. One of the instructors recently had a student who asked if a…


My IIS7 PowerShell Scripts

I regularly go onsite with enterprise customers of Microsoft and do Microsoft Internet Information Services (IIS) health checks. Recently, I have been rewriting many of my VBScripts into PowerShell scripts to help make the health check easier. I will be writing more as I go. In the meantime, I hope that you will find these…


How to Speak SAN-ish

I recently signed a contract with MCP Magazine to publish articles. This is effectively a syndication of this blog. Check out my first article called, “How to Speak SAN-ish” at