Under Windows, what is a processes "working set"?

To date I haven't had a satisfactory answer to this question, but I am constantly gob-smacked by the obscene number under the "Working Set" column in Sysinternals Process Explorer. Can someone define this in an easy-to-understand manner?


The working set can be defined as :

Working Set Bytes = Sizeof(RAM) – (Available Bytes + Pool Nonpaged Bytes + Pool Paged Resident Bytes + System Cache Resident Bytes + System Code Resident Bytes + System Driver Resident Bytes)

wifth the following definitions :

Pool Nonpaged Bytes: these represent allocations directed to the nonpaged pool, which is a set virtual memory pages that always remain resident in RAM. (These are nonpageable bytes.) Device drivers and the OS use the nonpaged pool to store data structures that must stay in physical memory and can never be paged out to disk. (For example, the TCP/IP driver must allocate some amount of nonpaged memory for every TCP/IP connection that is active on the computer for data structures that are required during processing of network adaptor interrupts when page faults cannot be tolerated.)

Pool Paged Resident Bytes: Most virtual memory pages that are acquired in the Operating System range of virtual addresses can be paged out. The Pool Paged Resident Bytes represent memory locations from the pageable pool that currently reside in RAM. System Cache Resident Bytes: the system’s file cache occupies a reserved range of virtual memory addresses, some of which may currently reside in RAM. (Cached file segments can also be non-resident, in which case they must be fetched from disk when they are referenced by executing processes.)

System Cache Resident Bytes : represents segments of the file cache that are currently resident in RAM.

System Code Resident Bytes: memory locations associated with system code that is currently resident in RAM.

System Driver Resident Bytes: memory locations associated with device driver code that is currently resident in RAM.


Here is my go at an easy-to-understand explanation.

A process working set is the amount of physical RAM it is currently using (referencing), in total, to do its work.

It can be a little confusing because it counts "shared" space in the RAM as well. For example, if process1 needs to run some system dll, the OS will read it into RAM. If process2 also needs to run that system dll, the OS doesn't need to read it into RAM, as it is already there. HOWEVER, the amount of RAM used to store that system dll code will show up under the working set of both processes, as they are both using that code to do their work.

So when you see a process with a huge working set, there may be a fair amount of that RAM it is claiming to use that is actually being shared with other processes, like the OS.


See MSDN?

"The working set of a program is a collection of those pages in its virtual address space that have been recently referenced".

So in short: ranges of addresses (pages) that are currently being directly used by the app.