Power Manager consuming Handles? Leak?

[Steerpike]

I've been pursuing a memory / resource leak on my new Vista install for some time. I've noticed that the number of Handles is forever increasing, with no obvious cause (Handles is one of the values presented in the task manager, on the Performance tab).
I tend to leave my machine running for days on end, simply suspending (sleep) to go between home and office.

I found a Vista memory leak patch from MS and applied it, but no change.

After about 4 days, the handles value was up to 78,000 ... a pretty alarming number. I decided to download and use the latest "Process Explorer" from sysinternals.

Over the course of about 3 days, I noticed that two processes were using ever-increasing handles - rundll32.exe and explorer.exe.

Looking more closely at Rundll32.exe, it was consuming about 18,000 handles. This instance of rundll32.exe was the 'parent' of PWMTR32V.DLL, running from the "program files\thinkpad\utilities" folder.

I killed this process, and recovered those 18,000 handles.

I then investigated the explorer.exe that was also consuming about 18,000 handles. Looking at the 'lower pane' of process explorer, which by default displays Handle data, I saw what looked like an excessive number of references to a registry key relating to to power management (PWRMGRV).

I killed this explorer process - which caused me to lose my start menu/tray/etc, but got it back by simply launching explorer.exe from the process explorer 'File/Run...' menu. (I've read that it is safe to do this; it's a somewhat safe way to get a fresh instance of explorer without rebooting).

At this point, I'm sitting here with about 38,000 handles in use, and the number seems pretty stable. I have a LOT of IE (internet explorer) pages open - about 20 - so that probably accounts for quite a few handles, and I have about 10 other apps running.

I'm going to observe handle consumption very carefully for a few more days (assuming I don't crash before then). I'm then going to reboot, and see if it again creeps up with the power manager stuff running. I'm then going to uninstall power manager stuff, and reboot, and see if that's the root cause.

For reference, this is a vista business install on a T60. All patches applied, all drivers acquired directly from Lenovo site within the past two weeks.

[Steerpike]

Update / more info.

I was forced to reboot today for unrelated reasons, so decided to watch what happened from scratch. After reboot, on running process explorer, I see:

Rundll32.exe is acting as the parent for pwmtr32v.dll (description: power manager background monitor and tray battery gauge). The 'handles' cound for this process is again steadily rising; started out around 250, and is now around 900 - increasing by about 200 per hour or so (compare this handles count to the value of about 18,000 that it was at in my previous post, after several days of running).

If I open up the 'lower pane view' in process explorer, and make sure it's set to view Handle details, I see what seems to be an ever increasing list of queries of the registry key HKCU\Software\Lenovo\PWRMGRV\Data\1ZC3R690L7. I'm pretty sure it's this registry query that is consuming the handles. It seems like it's opening a new handle each time it needs to query the registry, without closing previous handles. The number of handles is jumping by about 4 every 30-60 seconds, it seems.

I killed the battery gauge in the tray to see if that changed anything; it does not. If I re-launch the Power Manager application (start / programs / ThinkVantage / Power Manager), a second instance of Rundll32.exe fires up, and is acting as the parent for PWRMGRV.OCX. I then re-enable the Battery Gauge display ('Options', then check 'show power manager gauge in task bar'), then kill the Power Manager display; the second instance of Rundll32.exe goes away, the first one remains, handle count still increasing. It's now at 1500 (I got side-tracked while writing this!). So it's reached 1,500 after about 6 hours - still 4 new handles per minute!

I also see that there is one instance of explorer.exe that also has an ever-growing number of handles; looking at it's details in the lower pane, I see ... surprise surprise ... an ever increasing number of queries against key - HKU\(long string)\Software\Lenovo\PWRMGRV\Data\1ZC3R6940L7.

So between rundll32.exe, and explorer.exe, the lenovo power manager stuff is eating handles. Anyone else noticed this?

[Steerpike]

Given that no one else seemed to be encountering this (google-wide), I decided to uninstall and reinstall the two drivers, and ... no more memory leak! Handles are sitting at 118 for the Rundll32.exe process, and the parent/associated explorer.exe is sitting at 830, after several hours. Far cry from 1,500 earlier!

So - just in case anyone ever encounters this, I unistalled the "ThinkPad Power Manager", then the "ThinkPad Power Management Driver". Then re-installed, 'driver' first.

Process Explorer is an awesome tool! Written by the Sysinternals guys who developed regmon/filemon, and now working for microsoft. http://www.microsoft.com/technet/sysint ... lorer.mspx

[mudtoe]

I know it's been a while since the last post in this thread, but I'm having this problem on a Z60t laptop with XP Pro and I've found out what causes the problem. It has to do with using a custom range of charging percentages for the battery. Initially I couldn't figure why this problem just started happening to me, but after using a process explorer to see what was leaking I figured it out. If you set a custom battery range for starting and stopping charging, this information is saved in the registry at:

HKCU\Software\IBM\PWRMGR\Data\1ZE0W7CA017

The information about the custom range is stored in the last part of the tree (1ZE07CA017). That's the key that is being leaked. If you don't have a custom battery range set, that key doesn't exist and the leak doesn't occur. If you are using a custom battery range the rundll.exe process that represents the power gauge on the task bar will leak about 10 handles per minute, all of them references to this key in the registry.

If you want to keep your custom charging range you have to log off and log back on to the laptop at least once every couple of days, or else the leak becomes so bad that the laptop starts acting erratically. You don't have to do a full reboot, as the process is terminated by logging off, but I haven't had good luck just terminating the process with task manager and restarting it. If I do that, the battery charges to full, and I have trouble getting it restarted without doing a reboot.

I'm using the latest version of the power manager for XP, so I don't know what else I can do other than not use the custom range. If anyone knows the proper channel to report this problem please let me know how to do it. With this level of detail on the problem it shouldn't be hard for the programmers to correct it.

mudtoe

[Steerpike]

Good info!

In my case, though - at least, according to my notes above - I was able to cure the problem by an uninstall/reinstall. I did have a custom battery range.

[ZPrime]

Good info!

In my case, though - at least, according to my notes above - I was able to cure the problem by an uninstall/reinstall. I did have a custom battery range.

Yes, but generally when you remove & reinstall the battery manager, it blows away all of your customized power options (including the custom battery range). Double-check your settings to insure they are still OK before assuming that the installer didn't mess with them...

[algorith]

For what it's worth, I am having a similar problem on my T61, running Windows XP. Today the system has slowed to a crawl. It has been up for ~ 11 days.

As above, I am using custom battery charging levels.

One of the rundll32.exe instances is listed as having
Handles = 32,131
I/O Read Bytes = 268,573,645

According to Process Explorer, this has ~10,000 open handles to the same registry key (HKCU\Software\IBM\PWRMGR\Data)

Killing this instance of rundll32 has fixed the slowing down problem, but also made the battery icon disappear from the task bar.

[Melvyn]

I was reading this thread as part of my daily reading process.

I checked my pc and see 58,732 handles (Vista ultimate x64).

Going to "process" tab > view > select columns > handles, I can see that the major process consuming were:

mysql-nt.exe *32 - 33479 handles
System - 2670
ZendStudio.exe *32 - 1755
svchost.exe - 1399
....

The rest (91 process total) are all less than a thousand handles.

My leak appear to be mysql.

Searching around and I don't find enough info about handles and performance.

The only information about a "handle" is the same in windows' help:

Handles: The number of object handles in a process's object table.

So, my question is:

What's a handle and how it affects my computer's performance?

[Mark@Lenovo]

mudtoe,

Could you specify which version of the PM you are using? What is the version number?

We are taking a look at this, and our ThinkVantage engineering team was interested to know...

Thanks!

Mark

[dozer]

Steerpike, thank you VERY much for taking the time to post about it here. This was about the ONLY hit in the entire google database....lol.

I too am having the same problem; on a T60p....running windows 2000 sp4....also with a custom charge-setting.

I too usually just 'sleep' the machine each night.....so it can go literally weeks between reboot....and this endless buildup of handles definitely begins to slow down and screw up windows.

One difference; I don't appear to have the handles within my Explorer instance.....but I have over 5000 of them in rundll32 after only a single day since reboot.

Mark@Lenovo, have you found anything out yet?

Would you >please< post in this thread when you do?

You asked what version someone was running; and I didn't see any reply to you; so here is info on my setup:

Driver ver. is 1.44

Power Manager is 1.30b

FWIW, I'm also running RMclock, with the Intel Speedstep app disabled.

Machine is a 2623-DDU

Please don't hesitate to email me directly if I can help your effort to fix this in any way:

metal
fullwave
kom

add the usual punctuation, change k to c.

thanks much,

Richard

[cracki]

I'm having the same problem...

Model: 7767-96U
english Win XP

explorer.exe and rundll32 are hogging handles, opened on "HKCU\Software\IBM\PWRMGR\Data\1ZDG277H105"

i deinstalled the power manager and driver, rebooted, let the system update reinstall both. that didn't help.

i'd be happy to help in fixing this problem.

edit:

i'm thinking of writing a little hack to keep closing the handles...
Sysinternals Forums: Overview - Handle Enumeration

knowing myself, i won't get around to actually doing that, so feel free to use the information behind that link.

[ericjs]

I'm running XP Pro on a T61 and am experiencing a similar handle leak. The process leaking the handles, though, is not rundll32 or explorer, but the system process (which, I understand any driver handle leak will tend to show up under). My handle count have gone up into the hundreds of thousands over the course of a day. I uninstalled and then reinstalled the thinkVantage Power Manager and Power Manager driver, but it didn't help. Then I uninstalled them completely and thought this solved the problem, but then it happened again. Then I tried just installing the driver. Again it seemed okay for a while (it at least doesn't increment ALL the time) but eventually the handles start leaking again (I'm not sure what it is I do that precipitates it).

Among the repeatedly leaking handles are:

\REGISTRY\MACHINE\SYSTEM\ControlSet003\Control\Session Manager\Power

I don't understand what should be hitting this with the power manager and driver entirely uninstalled--yes I've rebooted since. I have to suspect that the real culprit may be one of the many ACPI or power-related sounding drivers I see in Device Manager under System devices. Among them I see:
ACPI Fixed Feature Button
ACPI Lid
ACPI Sleep Button
ACPI Thermal Zone
ACPI Thermal Zone (yes this appears twice)
Microsoft ACPI-Compliant Embedded Controller
Microsoft ACPI-Compliant system
Microsoft Composite Battery
Microsoft Windows Management Interface for ACPI

I'm kind of afraid to mess with these, and have no idea how to narrow it down.

Another handle that is leaking like a spigot is the unhelpfully generic sounding:

\REGISTRY\MACHINE\SYSTEM\ControlSet003\Control\DeviceClasses

Also, though this is a lesser problem and maybe unrelated, there are an awful lot of handles to these:
\REGISTRY\MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318}\0000
and
\REGISTRY\MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318}\0000\GlobalSettings

Eric

[cracki]

BTW: the handle leak showed up on my FRESH setup of win7 rtm. i will never ever again install lenovo's power manager. and why the hell is the default (bare system, no drivers) charging scheme of lenovo laptops so damaging to batteries that one has to install and mess with some app that takes system power management hostage with its own crappy power profiles that seem to have magic properties i can't see or change?

i think i got the power management driver through windows updates, and that went well. if that's the case, the culprit must be the messed up power manager app.

there's gotta be a way to set charging thresholds manually. that leaky, buggy piece of copypasted VB code they call "Power Manager" can't be too sophisticated...