Memory service - ""Virtual Memory size"" inaccurate

Last Modified

Thu Mar 30 15:23 GMT 2023

Description

  • This article explains what to do if the value which N-able N-central is reporting differs from the actual "virtual memory size" allocated on the device.

Environment

  • N-able N-central

Solution

  • The N-able N-central monitoring service is WMI-based. This means that the N-able N-central agent will ask Microsoft WMI for this information. The only value stored in Microsoft WMI is "VirtualSize" which is distinct from actual Virtual Memory size.
    • This is the command that the N-able N-central Agent uses to collect information from Microsoft WMI.
gwmi -class win32_process | Where-Object { $_.Name -eq 'ProcessName.exe' } | select-object Name, VirtualSize

  • You can verify this is correct using the command above at the command line, or following these steps:

  1. Open Perfmon via Start Menu > Run.

  2. Choose Performance Monitor.

  3. Click the "+" sign at the top of the page.

  4. Choose Process and select the specific instance you want to monitor (e.g. "explorer" or "svchost").

  5. Review the Virtual bytes Memory counter, knowing the last current and average counter info would be helpful.

  6. If the information found in Microsoft Perfmon is not accurate, this is a Microsoft issue, so you may want to reboot the device or have a look at the steps described in: "Service Displays a 205 or 201 WMI Error" > and scroll to "Data or Class-related Errors".

  • If the total Virtual Memory is being reported inaccurately in the Memory service, you can instead collect the total Virtual Memory being used by Windows:
    1. Open Command Prompt
    2. Run this command:
      • wmic OS get TotalVirtualMemorySize
    3. Compare output with Service.
    4. If the output matches the service, then WMI is the problem and will need to be addressed.
    5. If the output does not match the service, please contact support for assistance.
  • Supplemental Info:
  • In the Microsoft documentation below, Microsoft is suggesting to use PageFileUsage or Committed Bytes, however, this is not available in win32_process object.
  • So, we may see a change in the behaviour of this N-able N-central service in the future since a request for enhancement of this monitoring is currently in place with no confirmed target version.
VirtualSize
Data type: uint64
Access type: Read-only
Qualifiers: Units (Bytes)
Current size of the virtual address space that a process is using, not the physical or virtual memory actually used by the process. Using virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and by using too much, the process might not be able to load libraries. This value is consistent with what you see in Perfmon.exe.