==== Introduction ====

You notice that NONPAGED POOL expansion has been occurring on the system.  How would you determine who has done the most recent allocations?

==== Details ====

First you will need to have one of these two SYSGEN parameters enabled.  SYSTEM_CHECK or POOLCHECK.

<code>
  SYSTEM_CHECK

       SYSTEM_CHECK investigates intermittent system failures by
       enabling a number of run-time consistency checks on system
       operation and recording some trace information.

       Enabling SYSTEM_CHECK causes the system to behave as if the
       following system parameter values are set (although the values
       of the following parameters are not actually changed):

       Parameter        Value         Description

       BUGCHECKFATAL    1             Crash the system on nonfatal
                                      bugchecks.

       POOLCHECK        %X616400FF    Enable all poolchecking, with
                                      an allocated pool pattern
                                      of %x61616161 ('aaaa') and
                                      deallocated pool pattern of
                                      x64646464 ('dddd').

       MULTIPROCESSING  2             Enable full synchronization
                                      checking.

       While SYSTEM_CHECK is enabled, the previous settings of the
       BUGCHECKFATAL and MULTIPROCESSING parameters are ignored.
       However, setting the parameter POOLCHECK to a nonzero value
       overrides the setting imposed by SYSTEM_CHECK.

       Setting SYSTEM_CHECK creates certain image files that are capable
       of the additional system monitoring. These image files are
       located in SYS$LOADABLE_IMAGES and can be identified by the
       suffix _MON. For information about the type of data checking
       performed by SYSTEM_CHECK, see the description of the ACP_
       DATACHECK parameter. For information about the performance
       implications of enabling SYSTEM_CHECK, see OpenVMS Performance
       Management.
       </code>

<code>
  POOLCHECK

       This special parameter is used by HP and is subject to change. Do
       not change this parameter unless HP recommends that you do so.

       POOLCHECK is used to investigate frequent and inexplicable
       failures in a system. When POOLCHECK is enabled, pool-checking
       routines execute whenever pool is deallocated or allocated.

       Two loadable forms of SYSTEM_PRIMITIVES.EXE are available at
       boot time. The default image, which contains no pool-checking
       code and no statistics maintenance, is loaded when POOLCHECK
       is set to zero. When POOLCHECK is set to a nonzero value, the
       monitoring version of SYSTEM_PRIMITIVES.EXE, which contains both
       pool-checking code and statistics maintenance, is loaded.

       Setting the SYSTEM_CHECK parameter to 1 has the effect of setting
       POOLCHECK to %X616400FF. For further information about pool
       checking, see the OpenVMS VAX Device Support Manual, (which is
       archived).

       POOLCHECK is a DYNAMIC parameter. However, for a change in its
       value to have any effect, POOLCHECK must be non-0 at boot time
       (to load the monitoring version of SYSTEM_PRIMITIVES.EXE).</code>

NOTE:  SYSTEM_CHECK is not dynamic and would require a system reboot to take effect.  POOLCHECK is dynamic and can be enabled on the live system.

Booting the system with POOLCHECK non-zero or SYSTEM_CHECK = 1 loads the monitoring version of the system_primitives loadable image. This records allocations/deallocations of nonpaged pool in a ring buffer whose size is controlled by the SYSGEN parameter NPAG_RING_SIZE. This recording takes place regardless of the pool poisoning/checking enabled bits in the lower bit positions of the poolcheck parameter. To display these allocations/deallocations use this command:

SDA> SHOW POOL /RING