Windows® Internals, Sixth Edition, Part 2

The !filecache debugger command dumps information about the physical memory the cache is using, the current and peak working set sizes, the number of valid pages associated with views, and the names of files mapped into views, where applicable, as you can see in the following output. (File system drivers cache metadata, such as directory structures and volume bitmaps, by using unnamed file streams.)lkd> !filecache ***** Dump file cache****** Reading and sorting 999 VACBs ... ReadVirtual: 85b77038 not properly sign extended ReadVirtual: 85ba7010 not properly sign extended Processing 998 active VACBs ... File Cache Information Current size 30528 kb Peak size 65752 kb 461 Control Areas Skipping view @ 91980000 - no VACB, but PTE is a prototype! Loading file cache database (100% of 523264 PTEs) SkippedPageTableReads = 882 File cache has 7668 valid pages Usage Summary (in Kb): Control Valid Standby/Dirty Shared Locked FsContext Name 85fa5be0 0 4 0 0 add0dbf8 $Directory 85f971b8 0 8 0 0 ad9bc918 $Directory 87c489f0 4 4 0 0 93b390f8 $Directory 87c4a9c0 4 0 0 0 93b38c30 $Directory 87c451a8 0 4 0 0 93b35780 $Directory 86a83710 4512 45432 0 0 86a90168 $Mft 85f96770 0 8 0 0 ad9c00f8 No Name for File 85e90998 0 512 0 0 abb83510 No Name for File 88062008 4 0 0 0 9e6c40f8 $Directory 87c291e8 44 164 0 0 93b400f8 $Directory 87c27e10 0 16 0 0 93b4bd08 $Directory 87b4bc88 236 84 0 0 93b28d08 $Directory 86ce23a8 12 0 0 0 a2051528 $Directory 87c2bb20 4 0 0 0 93b3b850 $Directory 87d51480 0 4 0 0 824f9830 $Directory 87c8c900 0 4 0 0 825b06d0 utmpx 87c2aa30 44 216 0 0 93b3fc70 $Directory 86ecc168 12 4088 0 0 9c3c5c50 Microsoft-Windows- GroupPolicy%4Operational.evtx ...

Cache Physical Size

While the system working set includes the amount of physical memory that is mapped into views in the cache’s virtual address space, it does not necessarily reflect the total amount of file data that is cached in physical memory. There can be a discrepancy between the two values because additional file data might be in the memory manager’s standby or modified page lists.

Recall from Chapter 10 that during the course of working set trimming or page replacement the memory manager can move dirty pages from a working set to either the standby list or modified page list, depending on whether the page contains data that needs to be written to the paging file or another file before the page can be reused. If the memory manager didn’t implement these lists, any time a process accessed data previously removed from its working set, the memory manager would have to hard-fault it in from disk. Instead, if the accessed data is present on either of these lists, the memory manager simply soft-faults the page back into the process’s working set. Thus, the lists serve as in-memory caches of data that’s stored in the paging file, executable images, or data files. Thus, the total amount of file data cached on a system includes not only the system working set but the combined sizes of the standby and modified page lists as well.

An example illustrates how the cache manager can cause much more file data than that containable in the system working set to be cached in physical memory. Consider a system that acts as a dedicated file server. A client application accesses file data from across the network, while a server, such as the file server driver (%SystemRoot%\System32\Drivers\Srv2.sys, described in Chapter 12), uses cache manager interfaces to read and write file data on behalf of the client. If the client reads through several thousand files of 1 MB each, the cache manager will have to start reusing views when it runs out of mapping space (and can’t enlarge the VACB mapping area). For each file read thereafter, the cache manager unmaps views and remaps them for new files. When the cache manager unmaps a view, the memory manager doesn’t discard the file data in the cache’s working set that corresponds to the view, it moves the data to the standby list. In the absence of any other demand for physical memory, the standby list can consume almost all the physical memory that remains outside the system working set. In other words, virtually all the server’s physical memory will be used to cache file data, as shown in Figure 11-3.

Figure 11-3. Example in which most of physical memory is being used by the file cache