process explorer中的visual size vs working set; private bytes vs WS private

在process explorer 中双击某个线程，出现Properties dialog，点击Performance tab就会出现进程的性能统计信息；

比如我机器上firefox的虚拟内存和物理内存如下：

Virtual Memory：

Virtual Size         426，124K

Private Bytes      153，352K

 

Physical Memory：

Working Set        166，292K

   WS Private       137，336K

   WS Shareable    28，956K

   WS Shared         11，296K

（WS Private + WS Shareable = Working Set；

WS Shareable包含WS Shared）

 

说明：

Working Set是fireofox使用到物理内存的大小；(physical memory)

Virtual Size是firefox使用的虚拟内存的大小；(physical memory + pages)

 

WS Private是firefox使用到的物理内存的大小，但是不包含和别的进程共享的物理内存(not shared physical memory）

Private Bytes是使用的虚拟内存量的大小，包含map到disk上的page，但是不包含和别的进行共享的虚拟内存;(not shared physical memory + not shared pages)

 

网上很多人将Private Bytes和Working Set做对比，这时没有意义的。

 

外文解释：

Virtual Bytes are the total virtual address space occupied by the entire process, including memory-mapped files such as shared DLLs. This is like the working set except it includes data that has already been paged out and is sitting in a pagefile somewhere. The total virtual bytes used by every process on a system under heavy load will add up to significantly more memory than the machine actually has.

Private Bytes refer to the amount of physical memory (RAM) that the process executable has asked for - not necessarily the amount it is actually using. Private bytes are "private" because they (usually) exclude memory-mapped files (i.e. shared DLLs). But - here's the catch - they don't necessarily exclude memory allocated by those files. So if your executable depends on any libraries - and almost every executable does - you cannot always tell whether a change in private bytes was due to the executable itself or some library it links to. Also note that "physical memory" is not a perfect description - what it really means is bytes that can be addressed without a page fault.

Working Set refers to the total physical address space used by the process. This includes memory-mapped files and quite possibly several other things; a 32-bit process can access 4 GB of address space and not all of that address space is actually memory. This is the same value that gets reported in Task Manager's "Mem Usage" and has been the source of endless amounts of confusion in recent years. Similarly to private bytes, this is "physical" in the sense that it can be addressed without a page fault.

The working set of a program is a collection of those pages in its virtual address space that have been recently referenced. It includes both shared and private data. The shared data includes pages that contain all instructions your application executes, including those in your DLLs and the system DLLs. As the working set size increases, memory demand increases.

 

其他的可参见：

http://technet.microsoft.com/en-us/library/bb742598.aspx
http://bytes.com/topic/windows/answers/626995-difference-between-physical-kernal-memory
http://smallvoid.com/article/winnt-kernel-memory.html
http://blogs.msdn.com/slavao/archive/2005/01/29/363181.aspx
http://www.ibm.com/developerworks/library/j-memusage/
http://ask-leo.com/how_do_i_find_out_whos_using_all_my_memory.html