排查缓存和内存管理器性能问题Troubleshoot Cache and Memory Manager Performance Issues

在 Windows Server 2012 之前,有两个主要可能的问题导致系统文件缓存的增长,直到在某些工作负载下的可用内存即将耗尽。Before Windows Server 2012, two primary potential issues caused system file cache to grow until available memory was almost depleted under certain workloads. 当这种情况导致系统缓慢时,可以确定服务器是否面对了这些问题之一。When this situation results in the system being sluggish, you can determine whether the server is facing one of these issues.

要监视的计数器Counters to monitor

  • 内存 \ 长期平均备用缓存生存期 (s) < 1800 秒Memory\Long-Term Average Standby Cache Lifetime (s) < 1800 seconds

  • 内存 \ 可用兆字节低Memory\Available Mbytes is low

  • 内存 \ 系统缓存驻留字节数Memory\System Cache Resident Bytes

如果内存 \ 可用的兆字节数较低,并且在同一时间内存 \ 系统缓存驻留字节消耗的物理内存很大,则可以使用 RAMMAP 来找出缓存的用途。If Memory\Available Mbytes is low and at the same time Memory\System Cache Resident Bytes is consuming significant part of the physical memory, you can use RAMMAP to find out what the cache is being used for.

系统文件缓存包含 NTFS 图元文件数据结构System file cache contains NTFS metafile data structures

RAMMAP 输出中的活动图元文件页面非常多,如下图所示。This problem is indicated by a very high number of active Metafile pages in RAMMAP output, as shown in the following figure. 此问题可能已在繁忙的服务器上被访问,因为正在访问数百万个文件,因此将不会从缓存中释放 NTFS 图元文件数据。This problem might have been observed on busy servers with millions of files being accessed, thereby resulting in caching NTFS metafile data not being released from the cache.

rammap 视图

用于通过 DynCache 工具缓解的问题。The problem used to be mitigated by DynCache tool. 在 Windows Server 2012 + 中,体系结构经过了重新设计,此问题不再存在。In Windows Server 2012+, the architecture has been redesigned and this problem should no longer exist.

系统文件缓存包含内存映射文件System file cache contains memory mapped files

此问题在 RAMMAP 输出中有大量活动映射的文件页面。This problem is indicated by very high number of active Mapped file pages in RAMMAP output. 这通常表示服务器上的某些应用程序使用 CreateFile API 打开大量使用文件 _ 标志 _ 随机访问标志的大型文件 _ 。This usually indicates that some application on the server is opening a lot of large files using CreateFile API with FILE_FLAG_RANDOM_ACCESS flag set.

知识库文章 2549369中详细描述了此问题。This issue is described in detail in KB article 2549369. "文件 _ 标志 _ 随机访问" _ 标志是一个提示,用于缓存管理器在内存中保留文件的映射视图 (,直到内存管理器不) 内存不足条件。FILE_FLAG_RANDOM_ACCESS flag is a hint for Cache Manager to keep mapped views of the file in memory as long as possible (until Memory Manager doesn't signal low memory condition). 同时,此标志指示缓存管理器禁用文件数据的预提取。At the same time, this flag instructs Cache Manager to disable prefetching of file data.

在 Windows Server 2012 + 中进行工作集修整改进后,这种情况已被缓解为某种程度,但问题本身也需要由应用程序供应商通过使用文件 _ 标志 _ 随机 _ 访问来解决。This situation has been mitigated to some extent by working set trimming improvements in Windows Server 2012+, but the issue itself needs to be primarily addressed by the application vendor by not using FILE_FLAG_RANDOM_ACCESS. 应用程序供应商的替代解决方案可能是在访问文件时使用低内存优先级。An alternative solution for the app vendor might be to use low memory priority when accessing the files. 这可以通过使用 SetThreadInformation API 来实现。This can be achieved using the SetThreadInformation API. 更主动地从工作集中删除以低内存优先级访问的页面。Pages that are accessed at low memory priority are removed from the working set more aggressively.

从 Windows Server 2016 开始,缓存管理器进一步减轻了这一点,因为在进行修整决策时忽略了 FILE_FLAG_RANDOM_ACCESS,因此它的处理方式与没有 FILE_FLAG_RANDOM_ACCESS 标志的任何其他文件一样, (缓存管理器仍采用此标志来禁用文件数据) 的预提取。Cache Manager, starting in Windows Server 2016 further mitigates this by ignoring FILE_FLAG_RANDOM_ACCESS when making trimming decisions, so it is treated just like any other file opened without the FILE_FLAG_RANDOM_ACCESS flag (Cache Manager still honors this flag to disable prefetching of file data).如果有大量使用此标志打开的文件并以真正随机的方式进行访问,仍可以导致系统缓存膨胀。 You can still cause system cache bloat if you have large number of files opened with this flag and accessed in truly random fashion. 强烈建议应用程序不使用 FILE_FLAG_RANDOM_ACCESS。It is highly recommended that FILE_FLAG_RANDOM_ACCESS not be used by applications.