Where has all my Physical RAM gone?
Published Mar 16 2019 05:05 AM 5,149 Views
First published on TECHNET on Dec 19, 2012

Hello AskPerf! Ranajoy here from the Windows Performance Team. One of our highest call generators here in support surrounds low Available Memory shown in Windows Task Manager. Today we are going to take a brief look at this value and where this “Missing Memory” may be hiding.

Picture the following:

  • Windows 2008 R2 Server with 64GB RAM
  • Windows Task Manager shows Available Memory at 400MB
  • Cache shows 60GB used

Is such a high value in System Cache detrimental to system performance?

It’s typically not something to be concerned with because the pages come out of the standby list , to be discussed shortly, but we can use tools like Perfmon or Sysinternals RAMMap to determine how this memory is divvied up to be sure.

Collecting PERFMON and RAMMAP output will show us something similar to the below values:


Memory                                  Minimum      Maximum      Average


Available Bytes                   :   56,495MB |   60,304MB | 58,349MB (Total Available Memory in the System)

As you can see, Available Bytes (Available Physical Memory) is around 58GB.

A RAMMap capture shows the following:

It would appear that most of our RAM is in Mapped File Usage. So, what do these columns mean?

Mapped File: Also known as section objects, mapped “views” of files are when the contents of that file are mapped to virtual addresses in memory. This can be a process mapping views of files into its memory (for reading or writing) or for the system file cache.

Active: Pages of physical ram in active use by the specified category (usually a process working set or the system working set).

Standby: Pages of physical ram not actively being used. These are still left in physical ram but will be repurposed first by the memory manager (either returned to the active list or zeroed out and reused) if something needs physical ram for active pages. Standby pages are essentially cache – it’s better to have infrequently used data kept in RAM “just in case” than pushing it out to disk when the memory isn’t needed for anything else.

As we see here the Cache is mainly comprised of memory pages in the standby list.

In this scenario, the OS is keeping Memory pages in Standby so that they can be immediately given to a process or a service requesting RAM. As you can see, Mapped File Total equals the amount of Available bytes we saw in our Perfmon log.

Another tool that we can use to review Memory Usage is Process Explorer.


The Process Explorer screenshots are taken from a different machine and under different circumstances.

Click View | System Information | Memory tab – the following screen appears:

The values listed under Physical Memory and Page list(K) will give you deeper Memory details than what Windows Task Manager shows and will suit with the values you see in RAMMAP.

-Until next time!

Version history
Last update:
‎Mar 16 2019 05:05 AM
Updated by: