Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We encountered problems with one server. It always froze after 9 days, then reboot and again after 9 days: server hangs.

What I found in the events log was an Application Popup 333 Error like 10 times a minute or so.

The description of the 333 event was:

An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.

I tried at least half a dozen different workarounds, found on different websites, including MSKB and serverfault with no success. Somebody recommended adding the "handles count" column to the task managers process view, which I did. Result: SNMP keeps creating handles. The Performance Monitor Wizard sayed the service had over 2 Million handles the last time the server crashed.

I now have deactivated the service, but what was the cause?

edit: We're fortunately not dependent on the SNMP service, so the problem is solved for us, but what, if we actually needed the service? How would I determine what causes the issue? (just in case someone else has the same problem)

share|improve this question
up vote 0 down vote accepted

Yeah, high (enough) handle count will definitely crash the server. If I recall correctly, the SNMP service can load extension DLLs created by other people (ie not Microsoft). I'd bet one of those extensions simply had a handle leak which is similar to a memory leak. It happens -- it's software :(

share|improve this answer
Is there a way, to find out, which DLLs are currently loaded by the SNMP service? – Michael Niemand Oct 21 '09 at 12:57
Using <a href="… Explorer</a> you could find the snmp service exe, and view the DLLs currently loaded in process. Unfortunately the easiest way to figure out which one would be to unload all 3rd-party extensions and test, if it doesn't happen then enable one at a time until it does. AFAIK there is no easy way to tell which extension is leaking the handles. – Joshua Oct 22 '09 at 17:59
Gah! Forgot you can't do actual links here in comments, the url is for Process Explorer. – Joshua Oct 22 '09 at 17:59
Since, following the rating of this comment, Process Explorer seems to be way to go, when trying to figure whats the problem, so I mark this as an answer ... – Michael Niemand Apr 28 '10 at 12:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.