#1326 Handle leak in win-event-log/WinEventLog.cpp in the reportEvent function


In our test environment, we observed what appeared to be a memory leak in the tvnserver.exe file. Upon additional investigation, it was not a memory leak, but rather a leak in handles. You can see this easily in taskmgr.exe, by adding the "Handles" to the column view. I found a couple machines that had 400000+ handles created and ever-increasing until we killed and restarted the server.

In reviewing and editing the code to see if I could identify the issue location, found that in win-event-log/WinEventLog.cpp, in the reportEvent function, an event handle is created, but never closed.

I added a simple CloseHandle(hEventLog); at the end of the reportEvent function before the final close curly brace, recompiled, and tested, and the largest part of the handle leak disappeared, (at least the part that was causing the open handles to exceed 400k). This also appears to have resolved the apparent memory leak.

There still appears to be another much slower handle leak, but I have not been able to identify the root cause yet.


  • Anton

    Anton - 2016-02-12
    • status: open --> open-accepted
    • assigned_to: Anton
    • Group: -->
  • Anton

    Anton - 2016-09-05

    It seems strange to me. WinEventLog object should be created one time on service run. Next it acuires the handle with RegisterEventSource and uses the same handle in reportEvent.

    So if we call WinEventLog::enable once, we will have only one EventSource handle for service lifetime.


Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:

JavaScript is required for this form.

No, thanks