XADM: Handles Leak During Online Backup

ID: Q249148

The information in this article applies to:

Microsoft Exchange Server, version 5.5 SP3

SYMPTOMS

If you monitor the Exchange Server computer by using Performance Monitor, you find that many handles leaked after an online backup.

CAUSE

Several registry keys are opened during an online backup. Some of them come from the Mdbrest.dll file. After the query, the keys are not closed. They remain open for later use for performance reasons. But if the Mdbrest.dll has been relocated because of a memory address collision, those keys are not closed. They are reopened, and the previous handles leak when they are queried again.

RESOLUTION

A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem. If you are not severely affected by this specific problem, Microsoft recommends that you wait for the next Microsoft Exchange Server version 5.5 service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:

http://www.microsoft.com/support/supportnet/overview/overview.asp

The English version of this fix should have the following file attributes or later:

Component: System attendant

File name	Version
Mdbrest.dll	5.5.2651.61

STATUS

Microsoft has confirmed this to be a problem in Microsoft Exchange Server version 5.5.

MORE INFORMATION

If you use CDB to attach to the Mad.exe file, the following information is displayed:

LDR: Automatic DLL relocation in Mad.exe
LDR: Dll mdbrest.dll base 004b0000 relocated due to collision with Dynamically Allocated Memory
CDB ModLoad: 0b950000 0b982000 Mdbrest.dll
CDB ModLoad: 6fcc0000 6fcd4000 C:\Exchsrvr\Bin\Netif.dll
CDB ModLoad: 6fcb0000 6fcb8000 C:\Exchsrvr\Bin\Isatq.dll

If you use the Oh.exe file to check the handles that are held by the Mad.exe file, you find that the leaked handles are from the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CCS\Service\MSExchangeIS\ParametersPrivate

The fix closes all such keys when the .dll file is detached.

Additional query words:

Keywords : exc55sp3
Version : winnt:5.5 SP3
Platform : winnt
Issue type : kbbug