Name : Menagaeswary a/p Govindasamy

ID
: SW093305
LAB : 5

EXERCISE (Requires submission to my e-mail after you have finished):

In order to answer the question, you might have to do your own fact finding online and
exploration on your computer.

1.Why are there more processes listed in processes tab as compared to the number of
applications running as shown in the Applications tab?

Each process may have many threads that are treated as the same as a process. There is a parent
process that have many supporting child processes.

2. What is the function of System Idle Process and System process?

System Idle process is to provide something to the processer to do when the processor is idle or
not doing anything important. System process is a background process that runs the windows
kernel. It is necessary to run windows user interface.

3. Which part of Windows is running as the processes? (Print screen that part of your
windows)

4. Run Word for windows. Check the size of winword.exe process. Compare it with the size
of winword.exe file in the hard disk (the C drive - you have to search for the file by using
the find files program). Why are they of different size?
Winword.exe in process is around 25k and windword.exe in local disk c is 1.88K.
They are different in size because the winword.exe in process is cached on memory
that will do many other work such as (save, print and etc.) while winword.exe in
local disk is used only to start the Microsoft word.

5. How many threads does the winword.exe process have? In your opinion, what can be the
functions of each thread that are running? Explain your point.

19 threads. Each might be for copying, pasting, cutting, inserting, typing, saving,
deleting, viewing, designing, printing, exiting, sharing, formatting, detailing,
mailing, editing, help, reviewing and etc

6. Explain the meaning of page faults. Observe the page fault of the winword.exe process.
Open a new file in word, type in the word test, copy the word and paste it back into the
document to fill up one page. Save the page. Observe the page fault for winword.exe. Any
changes? Why?
The number of page faults generated by a process since it was started. A page fault
occurs when a process accesses a page of memory that's not currently in its
working set. Some page faults require page contents to be retrieved from disk;
others can be resolved without accessing the disk. When the observing the page
fault before saving it , it is around 22K and after typing test on the whole page and
saved it , it is around 112K. This is because data is saved in winword.exe.

7. What does the number under handles mean? (This is under file system management)
The number of object handles in a process's object table.

8. For all other processes in the processes tab, try to explain the uses of each of them. In
particular WINLOGON.EXE, SERVICES.EXE, explorer.exe. Does the total handles, total
threads and total processes indicated in performance tab tally with the total added in the
processes tab? Can they be different? Why?
Winlogon.exe is a part of the Windows Login subsystem, and is necessary for user
authorization and Windows activation checks .Services.exe is the Services Control
Manager, which is responsible for running, ending, and interacting with system
services. Use this program to start services, stop them, or change their default from
automatic to manual startup. Explorer.exe is the file management system in
windows.
Yes, they can be different. If one or more threads are forced to terminate.

9. What is the difference between the non-paged and paged kernel memory (listed in kernel
memory box).
In computer operating systems, paging is one of the memory-management
schemes by which a computer can store and retrieve data from secondary storage
for use in main memory.
The non-paged pool consists of virtual memory addresses that are guaranteed to
reside in physical memory as long as the corresponding kernel objects are allocated.
The paged pool consists of virtual memory that can be paged in and out of the
system. To improve performance, systems with a single processor have three paged
pools, and multiprocessor systems have five paged pools.

10. Under physical memory box, what is the use of the file cache?
This represents the sum of the system working set, standby list, and modified page
list. If you want to find the matching counters in Performance, and then load up the
following objects under Memory Cache Bytes, Modified pages list bytes, Standby
cache core bytes, standby cache normal priority byte and standby cache reserve
bytes.

11. In the status bar at the bottom of the Task manager window, memory usage is given as 2
values: value 1/value 2. Are both values greater than physical memory size? Why?
Physical memory currently use is 3GB while virtual memory is 15GB.

12. Run the following applications in order: Windows explorer, calculator, notepad,
command prompt, telnet, another copy of Windows explorer. Observe the number of
applications, processes and their threads and memory usage in the task manager (Do a
print screen and write your observation). Exit each application in reverse order and
observe the changes each time you exit the application. Explain your observation.

13. Logoff your computer and reboot. Run the task manager as soon after you logon. (Do a
print screen and include it in your observation). Observe all the information under
processes tab and the memory usage under performance tab.