I have experienced increase of invalid handles in System process (Windows Server 2008R2 x64). The amount is approximately 1,000,000 per week.

According to Process Explorer the handle type is file. From the task manager it seems the memory is not assigned to any of the processes but graph shows high (and growing) physical memory usage.

How to avoid or release invalid system handles?

  • Can you post an example of what you're looking at? – squillman Mar 11 '14 at 19:41
  • Well, I cannot post an image because of lack of reputation, so I will try to explain. Most of the file handles belong to files in shared folders. There are definitelly not all of them but some random (no pattern). There is quite a lot of files copied to share from outside everyday. The physical memory seems to be somehow blocked because when it reached the maximum machine stopped responding and restart was needed. – nkula Mar 11 '14 at 20:25
  • Do you have any antivirus or monitoring agents installed that you can disable to see if that helps? – Ryan Ries Mar 11 '14 at 20:33
  • There is no such sw installed. – nkula Mar 12 '14 at 17:02

I was not able to find the root cause yet but I figured out how to clean it up.

When I copied one of the files to analyse it I found out that the invalid handle was "reused" or "refreshed" and properly closed. It seems that operations on file like open, copy, delete fix the handle. So I created the powershell script that first get the list of handles using util Handle v3.51 and open affected files. After first run the number of handles descreased, physical memory usage started to decrease as well and after a few runs it looks ok. The clean up is scheduled nightly.

$handlesLog = .\handle.exe -p 4  # 4 is System process id

foreach ($line in $handlesLog)
    if ($line -match "<here is the pattern of affected  files>")
        $fileToCopy = <full path to the file>

        if ([System.IO.File]::Exists($fileToCopy))
              $fileStr = New-Object  System.IO.FileStream($fileToCopy,[System.IO.FileMode]::Open, [System.IO.FileAccess]::Read)

Do you have offline files turned on? You can disable them in Control Panel > Sync Center > Disable Offline Files (on the left-hand side). Maybe the server is trying to download an offline copy of the files, so it's not closing the handles properly. Just a shot in the dark.

  • There is no Sync center in windows server 2008. I tried to search for some related settings and ended up in Local Group policy editor, Computer configuration/User configuration, Administrative Template, Network, Offline files. Everything is set to Not configured. As I understand the description there it is by default disabled on servers. – nkula Mar 12 '14 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.