WMI Polling and Windows Handles

I have been revieweing some performance metrics on my servers since deploying the Orion NPM suite of products and found that the WMIPRVS.EXE process has a large amount of handles active when viewed in the Task Manager of the server. When I say high, I mean 2600. Other applications, including my own published apps max at less than 1000 handles. I need to understand what this means and if there is any reason for concern. This is something I am seeing as a change to the system and possibly causing performance and would like further understanding of this. All nodes are monitored via WMI as well as SAM components. Is there a calculation that I can use to determine the appropriate number of handles required for NPM and SAM to work? One thing to note is that the number of handles drops significantly to a few hundred when I unmanage the device.

Any assistance is greatly appreciated.

Thanks! baseline performance

Find more posts tagged with

sam

Performance

handles

baseline

npm

WMI

Accepted answers

All comments

danielleh

Hi amisseri,

You've posted this same question in 3 different areas. Please try to keep your questions limited to one thread so others can easily find this information should they have questions about this very issue.

I've sent this for Dev to review.

Thanks,

lukas.belza

Hello,

There is no formula to calculate the count of handles when we monitor the node using WMI - the behavior of WMIPRVSE.EXE process can be different for each version of Windows (I found several posts describing the handle or memory leak on this process).

I have several questions:

1) Is the handle count approximately constant or is it still growing?

2) Do you experience this issue on all Windows nodes that are polled through WMI?

3) What is the version of Windows on the node with high handles count?

Note: There is the limit for handle count for the WMIPRVSE.EXE process. This limit is set to 4096 and when this limit is reached, the WMIPRVSE.EXE process is restarted. Interesting article about the quotas: Memory and Handle Quotas in the WMI Provider Service - Ask the Performance Team - Site Home - TechNet Blogs

Thank you,

Lukas Belza (SolarWinds development)

amisseri

To answer you rquestions:

1) The handle counts grow 1 or 2 every minute and grows up to 3700 in some cases that I have seen. When the node was changed to be unmanaged, the count reduced to a couple of hundred.

2) All Windows boxes experience this issue, but it looks to be proportional to the number of items being monitored. For devcices with 5 or less items, handles are around 2k. For 10+ items, it can go from 2500 to 3500 handles.

3) I am seeing this on Windows 2003 R2 and 2008 R2 operating systems. Most are 32 bit, but some are 64.

I am reviewing the link as well, thanks for the info, very helpful.