You notice that NONPAGED POOL expansion has been occurring on the system. How would you determine who has done the most recent allocations?
First you will need to have one of these two SYSGEN parameters enabled. SYSTEM_CHECK or POOLCHECK.
SYSTEM_CHECK SYSTEM_CHECK investigates intermittent system failures by enabling a number of run-time consistency checks on system operation and recording some trace information. Enabling SYSTEM_CHECK causes the system to behave as if the following system parameter values are set (although the values of the following parameters are not actually changed): Parameter Value Description BUGCHECKFATAL 1 Crash the system on nonfatal bugchecks. POOLCHECK %X616400FF Enable all poolchecking, with an allocated pool pattern of %x61616161 ('aaaa') and deallocated pool pattern of x64646464 ('dddd'). MULTIPROCESSING 2 Enable full synchronization checking. While SYSTEM_CHECK is enabled, the previous settings of the BUGCHECKFATAL and MULTIPROCESSING parameters are ignored. However, setting the parameter POOLCHECK to a nonzero value overrides the setting imposed by SYSTEM_CHECK. Setting SYSTEM_CHECK creates certain image files that are capable of the additional system monitoring. These image files are located in SYS$LOADABLE_IMAGES and can be identified by the suffix _MON. For information about the type of data checking performed by SYSTEM_CHECK, see the description of the ACP_ DATACHECK parameter. For information about the performance implications of enabling SYSTEM_CHECK, see OpenVMS Performance Management.
POOLCHECK This special parameter is used by HP and is subject to change. Do not change this parameter unless HP recommends that you do so. POOLCHECK is used to investigate frequent and inexplicable failures in a system. When POOLCHECK is enabled, pool-checking routines execute whenever pool is deallocated or allocated. Two loadable forms of SYSTEM_PRIMITIVES.EXE are available at boot time. The default image, which contains no pool-checking code and no statistics maintenance, is loaded when POOLCHECK is set to zero. When POOLCHECK is set to a nonzero value, the monitoring version of SYSTEM_PRIMITIVES.EXE, which contains both pool-checking code and statistics maintenance, is loaded. Setting the SYSTEM_CHECK parameter to 1 has the effect of setting POOLCHECK to %X616400FF. For further information about pool checking, see the OpenVMS VAX Device Support Manual, (which is archived). POOLCHECK is a DYNAMIC parameter. However, for a change in its value to have any effect, POOLCHECK must be non-0 at boot time (to load the monitoring version of SYSTEM_PRIMITIVES.EXE).
NOTE: SYSTEM_CHECK is not dynamic and would require a system reboot to take effect. POOLCHECK is dynamic and can be enabled on the live system.
Booting the system with POOLCHECK non-zero or SYSTEM_CHECK = 1 loads the monitoring version of the system_primitives loadable image. This records allocations/deallocations of nonpaged pool in a ring buffer whose size is controlled by the SYSGEN parameter NPAG_RING_SIZE. This recording takes place regardless of the pool poisoning/checking enabled bits in the lower bit positions of the poolcheck parameter. To display these allocations/deallocations use this command:
SDA> SHOW POOL /RING