When you run poolmon with the /g (pooltag.txt) and /c (localtag.txt) options, the poolmon display lists the name of the driver that assigns each tag. Pooltag.txt and localtag.txt are the data sources for the column. For more info, search for "Poolmon" in the DDK. ~~juneb (MSFT) Rating: 17-Dec-03, June BlenderPoolMon displays pool tag information within a command window. Use the arrow keys or the PAGE UP and PAGE DOWN keys to display all the tag information returned by the tool. Poolmon.exe is available in the Windows NT 4.0 Resource Kit and in the \Support\Tools folder of Windows 2000, Windows XP, and Windows Server 2003 CD-ROMs.
Joined to say I had this happen to me today on two of my servers that are running Server 2012 R2, so your're not the only one. Non-paged pool usage was high in RAMMap and poolmon showed drivers using the tags Irp and FMic with the highest usage. After some digging narrowed it down to Veeam endpoint service.
differences in the speed on which the nonpaged pool grows. Both servers have a PoolTag Called "Thre" that is the biggest. On the server with 160MB Nonpaged pool this one is at about 82MB. Besides that there is a tag MmCm that is about 30MB big. I ran poolmon -c on the server and this gave me a file localtag.txt withIn this episode of Defrag Tools, Andrew Richards, Chad Beeder and Larry Larsen continue walking you through the Windows Performance Toolkit (WPT). This is part 1 of 3 episodes on memory usage/leaks.