Pushing the Limits of Windows: Handles

re: Pushing the Limits of Windows: Handles

Alex Silva — Wed, 19 Sep 2012 15:13:39 GMT

Interesting and very explanatory.

A great post, very useful.

Thank you.

re: Pushing the Limits of Windows: Handles

Eko Indriyawan — Fri, 19 Nov 2010 06:45:57 GMT

I just want to say that your review above is useful for us about how to understand about Handles issue.

Good job Mark !!!

re: Pushing the Limits of Windows: Handles

Stephen Boyd — Thu, 15 Jul 2010 14:54:21 GMT

This is by far the best explanation of Windows limits that I have seen. It has helped me track down the cause of mysterious system crashes on our Windows 2003 Terminal Server.

Thank You

re: Pushing the Limits of Windows: Handles

Windows 7 tricks — Fri, 04 Jun 2010 21:03:46 GMT

Nice tutorial! Very well worth reading.

re: Pushing the Limits of Windows: Handles

nc — Mon, 22 Mar 2010 22:33:23 GMT

@giammin

Use Process Monitor to check the stacks of the opens that don't have corresponding closes. Check for third-party modules in the stack. Symbol configuration will help, but is likely not necessary.

re: Pushing the Limits of Windows: Handles

giammin — Mon, 22 Mar 2010 14:07:26 GMT

Hi Mark

First of all great blog and great post!

i'm trying to debug a strange windows explorer behavior: it opens many handles on video files and never closes them (a similar behavior like the HKEY_CLASSES_ROOT\SystemFileAssociations\.avi\shellex\PropertyHandler bug).

My problem is that when i attach windbg to explorer.exe and turn on handle tracing my pc become unresponsiveness but windbg.

I can trace only many close handle due to detaching debugger.

Have you any suggestion? Thanks

re: Pushing the Limits of Windows: Handles

nc — Tue, 23 Feb 2010 22:36:42 GMT

@John Hickey

Sounds like the process was creating events and not closing the handles when it was done with them. The OS was doing what it could to accommodate the process by creating the event objects the process asked for, without questioning the process' intent.

re: Pushing the Limits of Windows: Handles

John Hickey — Tue, 23 Feb 2010 12:55:15 GMT

Hi Mark,

Great article. I stumbled on the article while researching a nonpaged pool leak. I tracked the leak down to the poolmon event objects tag EVEN. I, eventually, checked the handles to discover a third party driver S7ADRV.exe with 1.5 million handles & climbing. This looks like the likely source of my leak.

The driver provides a link between GeFanuc iFix SCADA application and Siemen's plcs.

Any idea why a handle leak would cause a memory leak on the EVEN tag. The fact that the memory leak was showing up against the EVEN tag threw me off for a day.

re: Pushing the Limits of Windows: Handles

Dhiraj — Thu, 24 Dec 2009 14:46:56 GMT

Thank you this post! I really enjoyed reading it.

I have a question, pelase see if you can help.

We have an Exchange 2003 Setup, and at times we get an unexpected volume of email from a mal function Application. This unexpected volume increase the handle count, new mail Event objects consume non paged pool memory and bring it to threshold a system cannot sustain.

We wanted to Quantify NPP for every handle or Event objects ( In this case, it will be file (eMail), is it possible ? This is esntailly going to help us to set threshold for our monitoring and the way we trouble shoot.

re: Pushing the Limits of Windows: Handles

Palinxy — Fri, 11 Dec 2009 05:14:15 GMT

As always a great source of valuable information for the Windows Sys Admin!!

I have recently encountered an unresponsive W2KR2_Ent_x64 system with a Nonpaged pool memory size reaching nearly 7GB on a 16GB system, due to an Oracle.exe 10.02 process having over 4 million handles open! Oracle was still functional and Windows returned back to normal once the offending application was shutdown.