Version
Windows sensors
Topic
When Windows sensors are reporting 'Excessive Handle Counts', collecting the information below will help Engineering Team determine possible cause of the high handle count
Steps
1) Download the 'handle64.exe' tool from the sysinternals page. (For 32-bit machines use handle.exe):
https://technet.microsoft.com/en-us/sysinternals/handle
2) From an elevated command prompt, run following commands. This will create four files in the directory the 'handle64.exe' process is run: (%COMPUTERNAME%-test-handle-file.txt, %COMPUTERNAME%-handle-summary.txt, %COMPUTERNAME%-handle-all.txt, and %COMPUTERNAME%-handle-carbon.txt) .
a. handle64.exe > %COMPUTERNAME%-test-handle-file.txt
b. handle64.exe -s > %COMPUTERNAME%-handle-summary.txt
c. handle64.exe -a > %COMPUTERNAME%-handle-all.txt
d. handle64.exe carbon -u > %COMPUTERNAME%-handle-carbon.txt
3) Upload four files created for further analysis:
Uploading Diagnostic Logs to Carbon Black Support
https://community.carbonblack.com/docs/DOC-4211
