We encountered problems with one server. It always froze after 9 days, then reboot and again after 9 days: server hangs.

What I found in the events log was an Application Popup 333 Error like 10 times a minute or so.

The description of the 333 event was:

An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.

I tried at least half a dozen different workarounds, found on different websites, including MSKB and serverfault with no success. Somebody recommended adding the "handles count" column to the task managers process view, which I did. Result: SNMP keeps creating handles. The Performance Monitor Wizard sayed the service had over 2 Million handles the last time the server crashed.

I now have deactivated the service, but what was the cause?

edit: We're fortunately not dependent on the SNMP service, so the problem is solved for us, but what, if we actually needed the service? How would I determine what causes the issue? (just in case someone else has the same problem)

link|improve this question

feedback

1 Answer

up vote 0 down vote accepted

Yeah, high (enough) handle count will definitely crash the server. If I recall correctly, the SNMP service can load extension DLLs created by other people (ie not Microsoft). I'd bet one of those extensions simply had a handle leak which is similar to a memory leak. It happens -- it's software :(

link|improve this answer
Is there a way, to find out, which DLLs are currently loaded by the SNMP service? – MAD9 Oct 21 '09 at 12:57
1  
Using <a href="technet.microsoft.com/en-us/sysinternals/… Explorer</a> you could find the snmp service exe, and view the DLLs currently loaded in process. Unfortunately the easiest way to figure out which one would be to unload all 3rd-party extensions and test, if it doesn't happen then enable one at a time until it does. AFAIK there is no easy way to tell which extension is leaking the handles. – Joshua Oct 22 '09 at 17:59
2  
Gah! Forgot you can't do actual links here in comments, the url is technet.microsoft.com/en-us/sysinternals/bb896653.aspx for Process Explorer. – Joshua Oct 22 '09 at 17:59
Since, following the rating of this comment, Process Explorer seems to be way to go, when trying to figure whats the problem, so I mark this as an answer ... – MAD9 Apr 28 '10 at 12:39
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.