# How does the High Memory Usage detection behave with Page Fault thresholds?

**URL:** <https://community.dynatrace.com/t/how-does-the-high-memory-usage-detection-behave-with-page-fault-thresholds/56897>\
**Category:** Open Q&A\
**Tags:** anomaly-detection\
**Created:** [September 7, 2026, 12:24pm UTC](https://community.dynatrace.com/t/how-does-the-high-memory-usage-detection-behave-with-page-fault-thresholds/56897 "2026-09-07T12:24:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sohel\_Rashid](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/sohel_rashid/32/12121_2.png) [@Sohel\_Rashid](https://community.dynatrace.com/u/Sohel_Rashid)\
**Post date:** [September 7, 2026, 12:24pm UTC](https://community.dynatrace.com/t/how-does-the-high-memory-usage-detection-behave-with-page-fault-thresholds/56897/1 "2026-09-07T12:24:17Z")

</div>

Hi Dynatrace community Team,

I would like to understand the expected behavior of the **High Memory Usage on Host** detection when using custom page fault thresholds.

Currently, we have configured:

- **Memory usage threshold:** 80%
- **Windows page fault threshold:** 100 faults/sec
- **Linux/Unix page fault threshold:** 20 faults/sec
- Detection mode: **Based on custom settings**

The configuration states that an alert is generated when **both memory usage and memory page fault rate thresholds are exceeded**.

Specifically, I would like to understand whether **both conditions must be continuously exceeded for the defined number of samples** before Dynatrace generates the problem.

Also, could you please clarify how the **“defined amount of samples”** is evaluated for the page fault rate?

Thanks in advance for your clarification.

 ![cf685158-d397-4564-9ae3-f31d0b6cf516.png](https://global.discourse-cdn.com/dynatrace/original/3X/d/1/d177e9338917babe893b7236843fd8ea9bf7bf99.png)

---

<div class="post-metadata">

**Author:** ![p\_devulapalli](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/p_devulapalli/32/41590_2.png) [@p\_devulapalli](https://community.dynatrace.com/u/p_devulapalli)\
**Post date:** [September 8, 2026, 12:52am UTC](https://community.dynatrace.com/t/how-does-the-high-memory-usage-detection-behave-with-page-fault-thresholds/56897/2 "2026-09-08T00:52:54Z")

</div>

[@Sohel\_Rashid](https://community.dynatrace.com/user/82811)&nbsp;Yes, both the conditions needs to be met for the defined samples/duration to alert

> **[Resource events](https://docs.dynatrace.com/docs/dynatrace-intelligence/root-cause-analysis/event-analysis-and-correlation/event-categories/resource-events)**
>
> Learn more about resource events and the logic behind raising them.

- **Windows** : By default, Dynatrace alerts if memory usage is higher than 90% and the memory page fault rate is higher than 100 faults/s within 18 of 30 10-second intervals.
- **Linux** : By default, Dynatrace alerts if memory usage is higher than 80% and the memory page fault rate is higher than 20 faults/s within 18 of 30 10-second intervals.

---

<div class="post-metadata">

**Author:** ![sujit\_k\_singh](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@sujit\_k\_singh](https://community.dynatrace.com/u/sujit_k_singh)\
**Post date:** [September 10, 2026, 11:03pm UTC](https://community.dynatrace.com/t/how-does-the-high-memory-usage-detection-behave-with-page-fault-thresholds/56897/3 "2026-09-10T23:03:23Z")

</div>

Hi&nbsp;[@Sohel\_Rashid](https://community.dynatrace.com/user/82811)

In addition to the&nbsp;[@p\_devulapalli](https://community.dynatrace.com/user/21657)&nbsp;, I am adding more insight of&nbsp;how the High Memory Usage on Host detection works with your custom configuration:

With your configuration (memory ≥ 80% AND page faults ≥ 100/sec for Windows or ≥ 20/sec for Linux/Unix), Dynatrace uses a **dual-condition AND** gate:

Both the memory usage threshold and the page fault rate threshold must be exceeded simultaneously for a sample to count as a “violating sample.”  
If only one condition is met (e.g., memory is above 80% but page faults are below the threshold), that sample does not count as a violation.

**How the “Defined Amount of Samples” is evaluated**  
Dynatrace uses a sliding window model for evaluation. The key parameters are:

slidingWindow&nbsp; - 5 samples  
violatingSamples - 3 samples  
dealertingSamples - 5 samples

So with defaults, Dynatrace looks at the last 5 minutes of data. If 3 or more of those 1-minute samples show both memory usage above 80% and page fault rate above your threshold, a problem is raised.

**Page Fault Rate Evaluation Specifics**  
The page fault rate is sampled at the same 1-minute interval as memory usage. Each 1-minute sample is evaluated against your configured threshold (100/sec for Windows, 20/sec for Linux/Unix). The value used per sample is typically the average page fault rate observed during that minute.

Thanks,

Sujit