Reading from book Windows Internals, we should use private bytes to monitor memory leak.
1. I think the reason why not using virtual bytes, is because there may be some shared materials counted as a part of virtual bytes -- like shared library and file map;
2. I think the reason why not using working set, is because sometimes working set is trimmed and sometimes not all committed virtual bytes are in working set -- like demand for zero scenario.
Are my understanding for (1) and (2) correct?
thanks in advance,