Too many invalid handles in System process

Question

I have experienced increase of invalid handles in System process (Windows Server 2008R2 x64). The amount is approximately 1,000,000 per week.

According to Process Explorer the handle type is file. From the task manager it seems the memory is not assigned to any of the processes but graph shows high (and growing) physical memory usage.

How to avoid or release invalid system handles?

Well, I cannot post an image because of lack of reputation, so I will try to explain. Most of the file handles belong to files in shared folders. There are definitelly not all of them but some random (no pattern). There is quite a lot of files copied to share from outside everyday. The physical memory seems to be somehow blocked because when it reached the maximum machine stopped responding and restart was needed. — nkula, Mar 11 '14 at 20:25
Do you have any antivirus or monitoring agents installed that you can disable to see if that helps? — Ryan Ries, Mar 11 '14 at 20:33

score 2 · Accepted Answer · answered Mar 14 '14 at 18:46

I was not able to find the root cause yet but I figured out how to clean it up.

When I copied one of the files to analyse it I found out that the invalid handle was "reused" or "refreshed" and properly closed. It seems that operations on file like open, copy, delete fix the handle. So I created the powershell script that first get the list of handles using util Handle v3.51 and open affected files. After first run the number of handles descreased, physical memory usage started to decrease as well and after a few runs it looks ok. The clean up is scheduled nightly.

$handlesLog = .\handle.exe -p 4  # 4 is System process id

foreach ($line in $handlesLog)
{   
    if ($line -match "<here is the pattern of affected  files>")
    {
        $fileToCopy = <full path to the file>

        if ([System.IO.File]::Exists($fileToCopy))
        {
            try
            {
              $fileStr = New-Object  System.IO.FileStream($fileToCopy,[System.IO.FileMode]::Open, [System.IO.FileAccess]::Read)
            }
            finally
            {
               $fileStr.Close()
               $fileStr.Dispose()
            }
        }
    }
}

score 0 · Answer 2 · answered Mar 12 '14 at 00:11

0

Do you have offline files turned on? You can disable them in Control Panel > Sync Center > Disable Offline Files (on the left-hand side). Maybe the server is trying to download an offline copy of the files, so it's not closing the handles properly. Just a shot in the dark.

answered Mar 12 '14 at 00:11

Muhkayla

11
2

There is no Sync center in windows server 2008. I tried to search for some related settings and ended up in Local Group policy editor, Computer configuration/User configuration, Administrative Template, Network, Offline files. Everything is set to Not configured. As I understand the description there it is by default disabled on servers. – nkula Mar 12 '14 at 17:12

Too many invalid handles in System process

2 Answers2