V
vuadapass
Guest
My .NET console application with try/catch covered to handle exceptions, no intention exit code while running, has been tested and runs well on my Windows server 2008 for a month without issue. However when I run it on Windows Server 2012, 2016, i usually see the application auto random close after a few days.
When I look at the Event Viewer, I don't see any application crash report. Near the time it close, i found this log:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.
DETAIL -
2 user registry handles leaked from \Registry\User\S-1-5-21-89958827-396464871-1043300328-500_Classes:
Process 724 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500_CLASSES
Process 1868 (\Device\HarddiskVolume2\ConsoleApplication.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500_CLASSES
----
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.
DETAIL -
16 user registry handles leaked from \Registry\User\S-1-5-21-89958827-396464871-1043300328-500:
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500
Process 724 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\Root
Process 1868 (\Device\HarddiskVolume2\ConsoleApplication.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\CA
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\TrustedPeople
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Policies\Microsoft\SystemCertificates
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Policies\Microsoft\SystemCertificates
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Policies\Microsoft\SystemCertificates
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Policies\Microsoft\SystemCertificates
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\Disallowed
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\trust
I checked again but my application doesn't have code to read/write those registry keys. It's just a simple TCP server listening on a port with SSL enabled. Does that log provide the reason why my application self closes?
Continue reading...
When I look at the Event Viewer, I don't see any application crash report. Near the time it close, i found this log:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.
DETAIL -
2 user registry handles leaked from \Registry\User\S-1-5-21-89958827-396464871-1043300328-500_Classes:
Process 724 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500_CLASSES
Process 1868 (\Device\HarddiskVolume2\ConsoleApplication.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500_CLASSES
----
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.
DETAIL -
16 user registry handles leaked from \Registry\User\S-1-5-21-89958827-396464871-1043300328-500:
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500
Process 724 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\Root
Process 1868 (\Device\HarddiskVolume2\ConsoleApplication.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\CA
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\TrustedPeople
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Policies\Microsoft\SystemCertificates
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Policies\Microsoft\SystemCertificates
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Policies\Microsoft\SystemCertificates
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Policies\Microsoft\SystemCertificates
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\Disallowed
Process 468 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-89958827-396464871-1043300328-500\Software\Microsoft\SystemCertificates\trust
I checked again but my application doesn't have code to read/write those registry keys. It's just a simple TCP server listening on a port with SSL enabled. Does that log provide the reason why my application self closes?
Continue reading...