Red alert! My Server is hung - what do I do?

Microsoft Advanced Windows Debugging and Troubleshooting — Fri, 12 Sep 2008 22:53:09 GMT

So you have a dump from a hung server and you’re the first person on the scene. Your IT Manager is jumping

re: TalkBackVideo Understanding handle leaks and How to use !htrace to find them

Takashi Toyota — Mon, 27 Apr 2009 12:08:53 GMT

Thank you for the sample code!

I really enjoyed it!

I wrote the followin WinDbg script code just to see how your code works.

It's beautiful.

WinDbg script code:

.catch

{

.block

{

.logclose

.logappend d:\windbg\logs\browsers.log

r $t0 = ${/d:$SafetyCheck}

}

.block

{

.if (0 == @$t0)

{

as $SafetyCheck "Written by Takashi Toyota"

}

.else

{

ad /q *

}

.block

{

.create D:\ITDanwa\handleleak\Debug\handleleak.exe

.detach

.attach -k

!gflag

r $t0 = nt!PsActiveProcessHead

.for (r $t1 = poi(@$t0); (@$t1 != 0) & (@$t1 != @$t0); r $t1 = poi(@$t1))

{

r? $t2 = #CONTAINING_RECORD(@$t1, nt!_EPROCESS, ActiveProcessLinks)

as /ma $ImageName @@c++(&@$t2->ImageFileName[0])

.block

{

.if (1 == $spat("${$ImageName}", "*handleleak*"))

{

.for (r $t9 = 0; @$t9 < 3; r $t9 = @$t9 + 1)

{

.time

.sleep 0n3000

r? $t3 = @@C++((int) @$t2->ObjectTable->HandleCount)

n 10

?? @$t3

}

ad $ImageName

}

.detach

}

Result:

Debug session time: Wed Nov 5 16:53:16.949 2008 (GMT+9)

System Uptime: 0 days 8:28:36.780

base is 10

int 40

Debug session time: Wed Nov 5 16:53:19.964 2008 (GMT+9)

System Uptime: 0 days 8:28:39.794

base is 10

int 70

Debug session time: Wed Nov 5 16:53:22.978 2008 (GMT+9)

System Uptime: 0 days 8:28:42.809

base is 10

int 100