Sysinternals Homepage
Forum Home Forum Home > Sysinternals Utilities > Process Explorer
  New Posts New Posts RSS Feed - "not enough resources" problem
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

"not enough resources" problem

 Post Reply Post Reply Page  123 4>
Author
Message
lserni View Drop Down
Newbie
Newbie
Avatar

Joined: 06 January 2007
Location: Italy
Status: Offline
Points: 3
Post Options Post Options   Thanks (0) Thanks(0)   Quote lserni Quote  Post ReplyReply Direct Link To This Post Topic: "not enough resources" problem
    Posted: 08 January 2007 at 10:59am
Hi,
I am running PE 10.21. After working for a few days, it no longer starts and crashes with "Insufficient system resources to retrieve handle information". This messages appears several times; each time, PE gobbles up twice the memory it occupied until then.

The command line utility HANDLE.EXE will hang, hogging about 1 Gb of RAM, until killed (it takes about 3 minutes on a Pentium 4).

The PSLIST utility no longer works (it might be unrelated) and drwatsons as soon as I launch it.

The system is running MySQL 5 and Apache 2.2 (the latest), and occasionally PE 10 will work properly if both are stopped; if they are restarted, though, PE either hangs or drwatsons at its next screen refresh.

I have checked for viruses (NOD32 and AVG) to no avail; the usual checks for rootkits, from RKRevealer to GMER, turned out nothing.

I tried fiddling with .NET framework (up to a complete uninstall and reinstall) without any change. The system does not exhibit any other symptom (no sluggishness, no unusual network activity seen by the router, no other crashes or delays).

The event viewer shows nothing suspicious. PE 9.25 also does not run, but it keeps at about 4-6 Mb vsize hogging 99% CPU. It can be killed instantly, though (except that Task Manager takes about one minute to start).

The system has about 30 Gb free space, laptop XP SP2, 1 Gb physical RAM and another of disk swap.

Any pointers or hints on what I might be missing would be appreciated; I am ready to run any other tests you might deem useful.

Kind regards,

Leonardo
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17531
Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 08 January 2007 at 11:28am
Probably not going to help as other utils fail as well, but... any luck if you exit PE, rename / remove [HKEY_CURRENT_USER\Software\Sysinternals\Process Explorer], and then run PE again?
 
Originally posted by <SPAN =bold>lserni lserni wrote:

I tried fiddling with .NET framework (up to a complete uninstall and reinstall)
Does the problem happen with the .NET Framework not installed on the system?
 
Do any processes have an inordinate number of handles?
 
 
Daily affirmation:
net helpmsg 4006
Back to Top
lserni View Drop Down
Newbie
Newbie
Avatar

Joined: 06 January 2007
Location: Italy
Status: Offline
Points: 3
Post Options Post Options   Thanks (0) Thanks(0)   Quote lserni Quote  Post ReplyReply Direct Link To This Post Posted: 08 January 2007 at 11:44am
Originally posted by molotov molotov wrote:

Probably not going to help as other utils fail as well, but... any luck if you exit PE, rename / remove [HKEY_CURRENT_USER\Software\Sysinternals\Process Explorer], and then run PE again?


Thanks for the suggestion; I hadn't tried. But... no joy. The EULA gets asked - then immediately the error pops up again.

Originally posted by molotov molotov wrote:


Originally posted by <span>lserni lserni wrote:

I tried fiddling with .NET framework (up to a complete uninstall and reinstall)
Does the problem happen with the .NET Framework not installed on the system?


It does. I had found the FAQ on the various .NET troubles and had hoped the solution was there, but apparently I've been bitten by a different bug.

Originally posted by molotov molotov wrote:


Do any processes have an inordinate number of handles?


I have MySQL5 with about 4K handles, which seems a lot to me (there's no more than a handful of tables, and no client connected). Sometimes terminating MySQL will unlock PE. Sometimes it takes both MySQL and Apache to be stopped to turn the trick. And sometimes PE will do the insufficient resource number no matter what.

And I can't very well know whether other processes are (maybe temporarily) out of kilter, because HANDLE hangs too. What I've observed is that both applications, PE and HANDLE, will run or not run together. If one has trouble, the other does too; if one runs, the other will also run. It is definitely something relating to either the handles or the method used by PE to enumerate them.

I guess it's not possible for the handle list to somehow "loop" forever, is it? I'm totally in the dark here: are handles created with incremental IDs as PIDs are, for example? Might it happen that a sorted read of handles could "cycle over"? (Abject apologies to all knowledgeable people here for any heresies I might have incurred into ).

All the best,
Leonardo
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17531
Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 08 January 2007 at 12:29pm
Not very elegant, but...
Perhaps you could leave PE running, and periodically monitor its "System Information" dialog.  Get a baseline for the system so you understand what "normal" numbers for the system in question are, and see if anything gets too "crazy" over time, especially when you expect that you'll soon be encountering this issue. 
 
4000 handles does seem to be a bit large (to me, at least),  but not necessarily unreasonable.
 
Presumably, if you disable / turn off handle view in PE, you won't get the "Insufficient system resources to retrieve handle information" message so you should be able to look at the handle count of individual processes, even while handle.exe fails.
Daily affirmation:
net helpmsg 4006
Back to Top
lserni View Drop Down
Newbie
Newbie
Avatar

Joined: 06 January 2007
Location: Italy
Status: Offline
Points: 3
Post Options Post Options   Thanks (0) Thanks(0)   Quote lserni Quote  Post ReplyReply Direct Link To This Post Posted: 08 January 2007 at 4:35pm
Originally posted by molotov molotov wrote:

Not very elegant, but...
Perhaps you could leave PE running, and periodically monitor its "System Information" dialog.  Get a baseline for the system so you understand what "normal" numbers for the system in question are, and see if anything gets too "crazy" over time, especially when you expect that you'll soon be encountering this issue.


First of all, thanks a lot for the hint about deleting the regkey. It did not solve things there and then (probably the system was too 'compromised') but when I powered up the PC again, PE finally was able to run.

I have also checked the MySQL5 configuration (it was running the stock installation) and reverting to the MyISAM engine lowered the handle requirements to 200+.

Now both HANDLE and PE are running flawlessly (pslist still crashes - I sent another packet to Microsoft) and I am keeping an eye on the handle count. Let's see how it goes. Indeed, when viewing handles in the lower pane with unnamed handle display turned on, PE CPU usage peaks to about 50%; else it stays around 1-2%. I guess that with some more handles in use, and starting in handle view mode, it could explain the crash.

I really appreciate being able again to use PE - it's a great tool and has saved my day more than once. I was willing to reinstall the system just to get it back !

Bye for now, see you soon!

Leonardo
Back to Top
robbinma View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 March 2006
Location: United Kingdom
Status: Offline
Points: 137
Post Options Post Options   Thanks (0) Thanks(0)   Quote robbinma Quote  Post ReplyReply Direct Link To This Post Posted: 19 September 2007 at 1:17pm
I'm seeing this on a Windows 2003 with PAE enabled. After about 10 of the "Insufficient resources" messages PE fails to start but sits in the background running at 25% CPU.
If I can get it again then I'll run Process Monitor on it and see if I can see what it is trying to do
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17531
Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 19 September 2007 at 1:25pm
Hi Mark,
 
Looks like this has been discussed a bit previously.
 
 
Will be interesting what you find...  Does killing the handle view in the lower pane get rid of the problem?
Daily affirmation:
net helpmsg 4006
Back to Top
Mark View Drop Down
Admin Group
Admin Group


Joined: 04 June 2005
Location: United States
Status: Offline
Points: 550
Post Options Post Options   Thanks (0) Thanks(0)   Quote Mark Quote  Post ReplyReply Direct Link To This Post Posted: 19 September 2007 at 2:02pm

It occurs when there are too many handles open for their information to fit into the largest kernel buffer that can be allocated.

Back to Top
robbinma View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 March 2006
Location: United Kingdom
Status: Offline
Points: 137
Post Options Post Options   Thanks (0) Thanks(0)   Quote robbinma Quote  Post ReplyReply Direct Link To This Post Posted: 19 September 2007 at 2:33pm
Mark,
 
Thanks for the quick response.Smile
So your answer leads to several questions:
 
1 - I have the handles view on by default. Is there anyway that I can switch that off without the GUI starting? At the moment the GUI won't start at all and the process just keeps using 25%. I haven't explored the PE registry keys but can do if necessary.
 
2 - Is it possible to change the behavour so that it doesn't take up CPU resources (25% in my case) and just closes down gracefully. At the moment I have had to advise my support teams not to use this if the server is heavily loaded. Unhappy
 
3 - Is it possible to increase the kernel buffer available to PE?
 
4 - Are we talking about too many handles for a single user/process/server?
 
Apologies for lots of questions but I really really want my support teams to be using this as they see it providing a lot of extra value Thumbs%20Up but my admin guys go nuts about the CPU load when the problem occurs.
 
Thanks for a great set of tools though.
 
 
Back to Top
robbinma View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 March 2006
Location: United Kingdom
Status: Offline
Points: 137
Post Options Post Options   Thanks (0) Thanks(0)   Quote robbinma Quote  Post ReplyReply Direct Link To This Post Posted: 21 September 2007 at 4:23am

Some follow up questions around trying to solve the system problem rather than PE's behavour.

 
It sounds like a process is leaking handles i.e. requesting them but not releasing them when it is done
 
What are the maximum number of handles that a system should have (Win 2003 PAE) ?
 
Are there tools to detect handle leaks in the way that purity can check for memory leaks?
 
Can any of the other developers answer the questions in either post?
 
Cheers
 
 
Back to Top
 Post Reply Post Reply Page  123 4>
  Share Topic   

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 11.06
Copyright ©2001-2016 Web Wiz Ltd.