Build1 distinct publisher3 min readPublished
Guest memory statistics reach a Proxmox host over the virtio balloon device, so a VM set to balloon: 0 shows its whole allocation as consumed while Task Manager inside reports 30 to 50 percent. Enabling it need not cost you a fixed allocation.
The Engineer · Build desk

Compiled by The EngineerSomething wrong?How this is made
Frank Zhang, writing on dev.to, hit this while monitoring a Proxmox VE environment with OpsHome NOC [20]. Proxmox needs the VirtIO balloon driver and its Windows service available before it can obtain useful guest memory statistics at all [8]. His trace shows the guest half of that path working and the host half absent, which leaves the statistics path incomplete, so the host's memory information does not reflect the real Windows state and monitoring inherits that upstream figure [9]. The conclusion he draws is that the VM configuration was the root cause, not the monitoring software [10].
The overshoot is the tell, visible before you even read a config file: the host's used figure exceeded the guest's entire allocation by 0.2 GB [18], and a number larger than the total simply cannot have been measured inside the guest, which means whatever was being graphed tracked allocation rather than consumption.
The spread confirms it, with the host view running 90 to 100 percent against Task Manager's 30 to 50 percent [2], a gap of 40 to 70 percentage points depending on which ends you compare [19]. Zhang's advice is not to reach for the obvious culprits here, whether that's a Windows memory leak, a wrong monitoring threshold, or a monitoring app doing bad arithmetic [17].
Checking the guest first was the right order, and it returned a false all-clear: `Get-Service *balloon*` reported BalloonService Running [5]. A service can be perfectly healthy with nothing attached to the other end of the pipe.
For this to be your bug rather than an interesting anecdote, your dashboard has to read the host's view of the guest. That is the path described here, from incomplete guest statistics through to the monitoring layer [9]. A collector running inside Windows is not on that path and will keep reporting Task Manager's number, correctly, while the host disagrees with it.
Setting minimum memory equal to memory works because the device only reclaims down to the floor, and here the floor is the ceiling. You get the statistics channel and no reclaim behaviour. The reason this configuration survives unnoticed for months is that nothing else breaks: the guest boots, applications, network and disk all work normally [11], and the discrepancy only surfaces when you put Task Manager, the Proxmox figures and the monitoring data side by side [12].
One thing the writeup does not settle is why the Ubuntu VMs on the same host read normally [4]. Their balloon setting is not given. Read that as a prompt to diff per-VM config, not as a claim about guest operating systems.
The general shape is worth keeping. A hypervisor memory percentage is a claim about a per-VM data path, and `balloon: 0` renders identically to a saturated guest [7].
Ranked by verification strength, evidence, and original report placement.
For Proxmox VE to obtain useful guest memory statistics from a Windows VM, the VirtIO Balloon driver and its related Windows service need to be available.
With the PVE Ballooning Device disabled, the guest memory statistics path is incomplete, PVE memory information does not reflect the actual Windows memory state, and monitoring receives that upstream data.
Proxmox VE monitoring showed the Windows 11 VM at 90 to 100 percent memory usage while Windows 11 Task Manager showed 30 to 50 percent.
The VM had 24 GB of RAM configured, and monitoring reported Memory: 100%, Used: about 24.2 GB, Total: 24 GB.
On the same Proxmox VE host, memory usage of the Ubuntu VMs looked normal; one Windows 11 VM was different.
Inside Windows 11, Get-Service *balloon* returned 'Running BalloonService', so the Windows-side BalloonService was installed and running.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 27, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
qm start said nothing, the UI said stopped, and only host dmesg named the passthrough failure1 distinct publisher
security
Windows 11's secure kernel trusts a RAM chip that never checks who is writing to it1 distinct publisher
build
Microsoft blames RGB software for KB5121003 crashes, so the fix is a driver hunt, not a rollback1 distinct publisher
build
Corosync redundancy is a claim until you cut the link: one wrong key, 13 seconds without quorum1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Reproducible command-level trail, single unverified author
The account is unusually concrete for a single-source post: the guest check and its output, the host qm config output showing balloon: 0 and memory: 24576, the exact remediation values, the CLI equivalent, the verification commands including pvesh against node PVE02, and a stated before/after (monitoring about 100 percent falling to about 40 percent against a steady Task Manager reading of about 40 percent). It is capped well below high confidence because everything rests on one practitioner's narrative about one VM, with no Proxmox VE or VirtIO documentation cited for the asserted statistics-path mechanism and no independent reproduction in the cluster.
One self-reported VM; no ecosystem signal
The only adoption-shaped facts are a single practitioner's configuration change on one VM and a bare disclosure that OpsHome NOC was the monitoring tool in use. There is no deployment count, fleet size, release, benchmark, pricing or licensing datapoint, and no indication of how widespread balloon: 0 on migrated Windows guests actually is, so no adoption level can be measured without inference.
Modest overreach in generalising one VM
The framing is restrained: the headline symptom is real, the fix is specific, and the author explicitly hedges that post-fix values need not match second by second. The small positive gap reflects that a general mechanism and a general migration-checklist warning are drawn from a single VM without vendor documentation, and that the narrative conveniently exonerates the monitoring product the author was running.
Mild product-adjacent authoring incentive
This is a self-published practitioner post whose conclusion is that the monitoring software was not at fault, written by someone who discloses using OpsHome NOC to monitor the environment - a visible but disclosed alignment between the finding and the tool in use. There is no evidence of paid placement, vendor sponsorship or promotional pricing content, and the technical remedy points at Proxmox configuration rather than at any purchase, which keeps the score in the moderate band.
Internally coherent but single-sourced
Confidence is moderate: the mechanism, symptom and fix form a coherent chain with verbatim artefacts and a stated before/after, so the specific incident is credible. It is held below high because the entire cluster is one publisher and one author, adoption cannot be measured, and the broader claim that disabled ballooning routinely produces this misreading on migrated Windows guests remains uncorroborated here.