Understanding Handle Count: Performance Monitor's Essential Metric

The handle count in the Performance Monitor refers to the number of object handles in a process's object table. In other words, it is the sum of all the handles that a particular process has open. Handles are unique identifiers that the operating system uses to refer to objects such as threads, files, and other resources. A high handle count could indicate a memory leak, as an application with a memory leak may create additional handles to identify memory resources. However, not all memory leaks will result in an increased handle count.

Handle count and memory leaks

A handle leak is a type of software bug that occurs when a computer program asks for a handle to a resource but does not free the handle when it is no longer used. If this happens repeatedly, a large number of handles may be marked as in-use and thus unavailable, causing performance problems or a crash. Handle leaks are specific instances of resource leaks, including memory leaks.

To detect a memory leak using Performance Monitor, monitor the following counters:

• Memory/Available Bytes: This counter lets you view the total number of bytes of available memory. This value normally fluctuates, but if there is a memory leak, it will decrease over time.
• Memory/Committed Bytes: If a memory leak is occurring, the number of available bytes of memory decreases, and the number of committed bytes increases.
• Process/Private Bytes: This counter displays the number of bytes reserved exclusively for a specific process. If a memory leak is occurring, this value will tend to steadily rise.
• Process/Page File Bytes: This counter displays the size of the page file. Windows uses virtual memory (the page file) to supplement a machine's physical memory. As the physical memory fills up, pages of memory are moved to the page file. If the size of the page file steadily increases, it is a good sign that a memory leak is occurring.
• Process/Handle Count: Applications use handles to identify resources they must access. If a memory leak is occurring, an application will often create additional handles to identify memory resources. So, a rise in the handle count might indicate a memory leak. However, not all memory leaks will result in a rise in the handle count.

In summary, handle count and memory leaks are related to software performance. Handle leaks are a type of software bug that occurs when a program does not free a handle to a resource, causing potential performance issues or crashes. To detect memory leaks, Performance Monitor can be used to track specific counters, including available bytes, committed bytes, private bytes, page file bytes, and handle count.

Handle count definition

The handle count in a performance monitor is the number of object handles in a process's object table. Handles are a generic operating system term for a ticket to an operating system object. Each handle is unique and identifies each object. Threads inside processes have a thread handle, and files and other resources (such as registry keys) have handles too.

In the context of Windows, a window handle (hWnd) is a unique identifier assigned to each window created. Handles represent system resources like files, registry keys, and threads. The handle count in the Task Manager is the sum of all handles that this process has open.

A high handle count could indicate a memory leak, as an application will often create additional handles to identify memory resources. However, not all memory leaks will result in a rise in the handle count.

Handle count and Windows handles

Handle count, as seen in the Task Manager, is the number of object handles in a process's object table. In other words, it is the sum of all the handles that a process has open. Handles are unique identifiers that Windows assigns to each window created. These can be command buttons, text boxes, dialog boxes, or full windows. Handles are also assigned to threads inside processes, and files and other resources such as registry keys.

The handle count can be monitored using the Performance Monitor (Perfmon). This can be done by opening the Performance Monitor, adding a counter, choosing Process under Performance object, then choosing Handle Count under the counter list, and finally choosing the relevant process from the instance list.

A high handle count could indicate a memory leak. This can be caused by an application creating additional handles to identify memory resources. However, not all memory leaks will result in a rise in the handle count.

There are other tools that can be used to monitor handle count and detect memory leaks, such as Process Monitor and Application Verifier.

Handle count and Task Manager

The handle count in the Task Manager is the number of object handles in the process's object table. In other words, it is the sum of all handles that this process has open. Handles are how processes communicate with compute resources. Each program has them to communicate with the disk, the Windows UI, the mouse, keyboard, etc.

Handles are also used to identify resources that applications must access. If a memory leak is occurring, an application will often create additional handles to identify memory resources. So a rise in the handle count could indicate a memory leak. However, not all memory leaks will result in a rise in the handle count.

You can use the Windows Performance Monitor to check the handle count of a process. To do this, open the Performance Monitor, add a counter, choose 'Process' under Performance Object, then choose 'Handle Count' from the counter list, and finally choose the process you want to monitor from the instance list.

Handle count and performance counters

The handle count in the Task Manager provides insight into the number of open handles a process has. This includes handles for threads, files, registry keys, and other resources. A high handle count can indicate a potential performance issue, as each handle consumes system resources. For example, a process with an excessive number of open file handles may be utilising more resources than necessary, impacting overall system performance.

Performance counters, such as those available in Windows' Performance Monitor, provide a more in-depth analysis of system performance. These counters can be used to detect memory leaks, where an application fails to release memory that is no longer needed. For instance, the "Memory/Available Bytes" counter displays the total number of available memory bytes, which will decrease over time if a memory leak is present. Similarly, the "Process/Private Bytes" counter shows the number of bytes reserved exclusively for a specific process, which will steadily increase in the event of a memory leak.

Additionally, the "Process/Handle Count" counter can also be indicative of a memory leak. As an application creates more handles to identify memory resources, the handle count will rise. However, it is important to note that not all memory leaks will result in an increased handle count. Other performance counters, such as "Memory/Committed Bytes" and "Process/Page File Bytes," can also provide valuable insights into system performance and memory management.

Performance counters are an essential tool for system administrators and developers, offering a detailed view of system behaviour and resource utilisation. By monitoring these counters, it becomes possible to identify and address performance issues, optimise resource allocation, and ensure the efficient operation of applications and processes.

Frequently asked questions