windows3-3  Exercise 2: A Pool Logger With Handles and Available Memory
=================================================================

Verification: Level 1 (run on the author's machine, no administrator rights; the programs it starts are stopped at the end).

Prediction (work this out before running the script):

  Over 40 seconds nonpaged and paged pools should each move by only a few MB at most, the total
  handle count should stay roughly steady (it is a busy system, so it will jitter), and Available
  should hover. None of that can prove or disprove a slow leak.

ex2.ps1:

  # ex2.ps1: poollog plus total handle count and available memory.
  param([int]$Samples = 8, [int]$Interval = 5)
  $names = '\Memory\Pool Nonpaged Bytes', '\Memory\Pool Paged Bytes', '\Process(_Total)\Handle Count', '\Memory\Available MBytes'
  $rows = Get-Counter $names -SampleInterval $Interval -MaxSamples $Samples | ForEach-Object {
      $v = @{}
      foreach ($s in $_.CounterSamples) { $v[($s.Path -split '\\')[-1]] = $s.CookedValue }
      [pscustomobject]@{ Time = $_.Timestamp.ToString('HH:mm:ss'); NP = $v['pool nonpaged bytes'] / 1MB; P = $v['pool paged bytes'] / 1MB
                         Handles = $v['handle count']; AvailGB = $v['available mbytes'] / 1024 }
  }
  'time       nonpaged     paged    handles   available'
  foreach ($r in $rows) { '{0}  {1,7:N1} MB {2,7:N1} MB  {3,8:N0}  {4,6:N2} GB' -f $r.Time, $r.NP, $r.P, $r.Handles, $r.AvailGB }
  $f = $rows[0]; $l = $rows[-1]
  'change: nonpaged {0:+0.0;-0.0;0.0} MB, paged {1:+0.0;-0.0;0.0} MB, handles {2:+0;-0;0}, available {3:+0.00;-0.00;0.00} GB' -f ($l.NP - $f.NP), ($l.P - $f.P), ($l.Handles - $f.Handles), ($l.AvailGB - $f.AvailGB)

Output (real, from the author's machine on 2026-10-24; your numbers will differ):

  time       nonpaged     paged    handles   available
  19:26:22  1,302.2 MB 1,606.4 MB   182,151   15.29 GB
  19:26:27  1,301.9 MB 1,605.3 MB   181,749   15.51 GB
  19:26:32  1,302.6 MB 1,605.4 MB   181,739   15.47 GB
  19:26:37  1,302.4 MB 1,605.4 MB   182,155   15.45 GB
  19:26:42  1,300.0 MB 1,605.3 MB   182,411   15.30 GB
  19:26:47  1,299.8 MB 1,605.3 MB   182,139   15.32 GB
  19:26:52  1,299.0 MB 1,605.3 MB   182,183   15.30 GB
  19:26:57  1,299.2 MB 1,604.8 MB   181,701   15.33 GB
  change: nonpaged -3.0 MB, paged -1.6 MB, handles -450, available +0.05 GB

WHY THIS WORKS AS AN ANSWER
---------------------------
  Nonpaged pool fell 3.0 MB (1,302.2 to 1,299.2), paged pool fell 1.6 MB, the machine's total handle
  count moved by -450 out of about 182,000 (a quarter of a percent, normal churn on a system with hundreds of
  processes) and Available rose 0.05 GB. What you can conclude: nothing in these counters moved in a
  way that suggests a fast leak during those 40 seconds. What you cannot conclude: that there is no slow
  leak (Microsoft says leaks "usually develop slowly" and can take hours to show), that no single
  process has a handle leak (a total of 182,000 would hide one process adding a few thousand), or that the
  pools are healthy in general (there is no baseline from when the machine was newly started).
  Common mistakes: treating a flat 40-second log as a clean bill of health; reading the _Total handle
  count as if it identified a process; and forgetting that the first sample after starting a logger is often
  noisy.