CODEWITHSUNDEEP
windowshandle
Tyler Lee
Tyler Lee

Reputation: 2785

How can I identify what handles this process has open?

I'm working to debug an issue with one our server processes that is consuming large number of handles over a period of 60-90 days. The server parent process spawns and cycles a number of children, with each child being recycled about once an hour. The parent's process handle count will rise to 40k plus over two months, but I'm not sure what exactly the handles are referencing.

Using ProcessExplorer, I can see the handle count and a number of handles are listed (image below is an example). However, the number of listed handles does not come close to the 40k number shown in the upper pane. I have about ~100 entries in the handles window, and looking through the properties of them, I can account for around 3k of the total handles with this window, far-cry from the 40k in total.

I've set the parent to cycles it's children every few minutes to try and see if it has something to do with the cycling children, but monitoring for an hour didn't seem to result in the parent process handle count rising any. It would go up and down during that period, but not on an upward trend. Admittedly, an hour is a far cry from two months, but it is a start.

I'd really appreciate some direction on how I can troubleshoot this further. Unfortunately, this is outside my general knowledge, so I'm a bit lost. Any assistance would be greatly appreciated in identifying what could be comprising this handle count.

enter image description here

Update: Based on the recommendation by josh poley below, I used handle.exe from Sysinternals to examine the process. Using a -a flag, I only got 5 results. So next I tried the -s flag, which lists counts of handles across all processes. I ran it once, then restarted my affected servers and ran it again. The Mutant handle category dropped dramatically, which makes me think I need to focus there. Will research

enter image description here

Upvotes: 2

Views: 3290

Answers (1)

josh poley
josh poley

Reputation: 7479

The handle view in Process Explorer doesn't show all the possible handle types (just ones that are commonly needed and it can provide useful details on).

You should use handle.exe (also from the sysinternals set) with the -a option in conjunction with your process' ID and then parse the output. Example:

handle.exe -a -p 26916 >handle.out

Just picking a random process on my box, handle.exe shows 795 EtwRegistration handles which don't show up in the Process Explorer GUI.

Upvotes: 3

Related Questions