Wait for the data to run long enough to capture the information and collect the log while reproducing the issue. Click Add, OK, Next, Next, then select Start this data collector set now, then click Finish.Select Process from the drop-down list, and select from the next drop-down list.Select Memory from the drop-down list and select, then click Add.In the next page from the drop-down list, select Processor, select, and click Add. Under Create data logs, only select Performance counter, and click Next.Type a name (for example, McAfee ), select Create manually, and click OK.Right-click User Defined, select New, and select Data Collector Set.Click Data Collector Sets, User Defined.Type the following command and press ENTER:.Allocations that have still not been freed, or have continued to increase in size are the likely cause. Examine the allocations that were increasing, and determine whether the bytes are now freed.Bytes (number of bytes allocated minus number of bytes freed).When data collection is complete, examine the following values for each tag, and note any that continually increase:.NOTE: for the seconds, McAfee recommends every 15 minutes. To be able to take multiple snapshots over time the below script can off.

IMPORTANT: Repeat this every 30 minutes for at least two hours.

Stop PoolMon, wait for a 30 minutes, and then restart PoolMon.

Let PoolMon run for at least few hours, sometimes it might need to run for few days. IMPORTANT: To obtain the most accurate results, follow the instructions below accurately. Starting PoolMon changes the data, therefore you must let it run until it reaches a steady state and the data is reliable.

This example outlines a procedure for using PoolMon to detect a memory leak:.

Install PoolMon on the computer you want to test, following the Microsoft product instructions.

Poolmon.exe is contained in Microsoft Windows Driver Kit (WDK).

Type the following command and press ENTER:.

Click Start, Run, type cmd, and press ENTER.

Enable pool tagging by using the command line:.

In the dialog box, enable Enable Pool Tagging.

Enable pool tagging by using a dialog box:.If you are using Windows 2003 or later, skip to Step 2. If you are using XP, enable pool tagging as follows.You must enable Gflags.exe to enable pool tagging. Pool tagging is permanently enabled on Windows Server 2003 and later. IMPORTANT: This applies if you want to use PoolMon on Windows XP or earlier.

How to use poolmon.exe