UMDH & perfmon private bytes

Question

I'm trying to use UMDH to find where huge chunks of memory are being allocated but the results I'm getting seem completely absurd.

I start the program, wait for it to reach an equilibrium, and then grab a snapshot with umdh. Then I perform the activity that causes it to suck up memory, wait for it to reach equilibrium again, and grab another snapshot. Then I run a diff:

umdh -d -v 1.txt 2.txt > diff.txt

I'm witnessing 500M of additional private bytes in perfmon (other memory counters also grow accordingly). UMDH diff shows a "decrease of..." some huge number. Say what??? Can anyone explain why that might be the case?

Then I commented out all activity in the function that was reported in the largest growth stack. I performed the above repro again, watched the same 500M growth pattern, but UMDH is reporting a small increase in memory use!!! Very small being the operative word there.

The first part really blows my mind. What would cause UMDH to show a decrease in heap use but perfmon show a rather large increase in allocated memory use by the same process??

I considered thread stacks, but the thread stack count actually goes down. What else might go into "private bytes"?

Answer 1

Put debug info file, i.e. pdb, into the same path of exe. The following commands worked, replace PID with actual process ID you want to dump:

umdh -p:PID -f:memlog1.txt

umdh -p:PID -f:memlog2.txt

umdh memlog1.txt memlog2.txt > result.txt

If you see the following warning:

Warning:
Warning: UMDH didn't find any allocations that have stacks collected.
Warning: Use gflags to enable allocation stack collection.
Warning: Restart the application for the setting to be in effect.

run:

gflags -i "full\path\of\exe" +ust

and restart the exe before running umdh again.