monitor memory leak

[George2]

Hello everyone,


Reading from book Windows Internals, we should use private bytes to monitor memory leak.

1. I think the reason why not using virtual bytes, is because there may be some shared materials counted as a part of virtual bytes -- like shared library and file map;

2. I think the reason why not using working set, is because sometimes working set is trimmed and sometimes not all committed virtual bytes are in working set -- like demand for zero scenario.

Are my understanding for (1) and (2) correct?


thanks in advance,
George