Detecting memory leaks in a service child process

This tutorial describes how to detect memory leaks in a child process of a service (or any descendant process of the service).

This tutorial covers the following:

1. 1. Modifying an application to use the NT Service API
   2. How to use the Memory Validator user interface to detect memory leaks in the service’s child process.

Related tutorials:

Detecting memory leaks in a service.
Detecting memory leaks in an IIS ISAPI DLL.
Detecting memory leaks in ASP.Net with IIS.
Detecting memory leaks in ASP.Net with Web Development Server.
Detecting detect memory leaks for a child process.

Native applications and mixed-mode applications

This tutorial applies to all native applications and to mixed-mode applications where the startup code is native.

.Net services

If your application is written entirely in .Net or .Net Core, or your application is mixed-mode with the startup code written in .Net or .Net core you can skip the part of this tutorial relating to the NT Service API and go straight to the detecting memory leaks in a service child process section.

Example Service and Child Process Application

Memory Validator ships with an example service and an example child process launched by the service. These can be found in the  following directories in the Memory Validator installation directory:

• examples\serviceWithAChildProcess\serviceWithAChildProcess 
• examples\serviceWithAChildProcess\childProcess 

Installing the example service

1. Open an administrator mode cmd prompt
2. Type serviceWithAChildProcess.exe -install

Starting the example service

1. Open an administrator mode cmd prompt
2. Type serviceWithAChildProcess.exe -start

or

1. Start the services control panel (type services in the Windows 10 search bar, then choose the Services app).
2. Find the service in the list of services, right-click to display the context menu, then choose Start.

Stopping the example service

1. Open an administrator mode cmd prompt
2. Type serviceWithAChildProcess.exe -stop

or

1. Start the services control panel (type services in the Windows 10 search bar, then choose the Services app).
2. Find the service in the list of services, right-click to display the context menu, then choose Stop.

Uninstalling the example service

1. Open an administrator mode cmd prompt
2. Type serviceWithAChildProcess.exe -remove

The childProcess has already been modified to use the NT Service API. In this tutorial, we’ll describe the modifications you would make to the child process to make it work correctly with Memory Validator.

What is the NT Service API?

The NT Service API is a simple API that allows you to load the Memory Validator profiling DLL and start the process of collecting memory allocation data.

The API also includes some debugging functions to help provide debugging information via log files (the only way to get data out of a service without a connection to the Memory Validator user interface).

Modifying your application to use the NT Service API

1. Identify your application’s main() function, and at the start of that function add a call to attachToMemoryValidator().
2. Just before the definition of main() add the code for the attachToMemoryValidator() function.

   static void attachToMemoryValidator()
   {
   	if (bLogging)
   	{
   		// Set the log file name. 
   		// When anything goes wrong the API will write error information to this file.
   		// You can also write to this log file any status errors you need (you'll see examples in this source file)
   
   		svlMVStub_setLogFileName(SZLOGFILENAME);
   		svlMVStub_deleteLogFile();
   	}
   
   	if (bLogging)
   	{
   		svlMVStub_writeToLogFileW(L"About to load Memory Validator\r\n");
   	}
   
   	SVL_SERVICE_ERROR	errCode;
   #ifdef IS6432
   	// x86 with x64 GUI
   	errCode = svlMVStub_LoadMemoryValidator6432();
   #else	//#ifdef IS6432
   	// x86 with x86 GUI
   	// x64 with x64 GUI
   	errCode = svlMVStub_LoadMemoryValidator();
   #endif	//#ifdef IS6432
   	if (bLogging)
   	{
   		if (errCode != SVL_OK)
   		{
   			DWORD	lastError;
   
   			lastError = GetLastError();
   			svlMVStub_writeToLogFileW(L"Memory Validator load failed. \r\n");
   			svlMVStub_writeToLogFileLastError(lastError);
   			svlMVStub_writeToLogFile(errCode);
   
   			svlMVStub_dumpPathToLogFile();
   		}
   		else
   		{
   			svlMVStub_writeToLogFileW(L"Memory Validator load success. \r\n");
   		}
   	}
   
   	// DO NOT setup a service callback because this is a child application of a service, not a service
   
   	// start Memory Validator
   
   	errCode = svlMVStub_StartMemoryValidator();
   	if (bLogging)
   	{
   		if (errCode != SVL_OK)
   		{
   			DWORD	lastError;
   
   			lastError = GetLastError();
   			svlMVStub_writeToLogFileW(L"Starting Memory Validator failed. \r\n");
   			svlMVStub_writeToLogFileLastError(lastError);
   			svlMVStub_writeToLogFile(errCode);
   		}
   
   		svlMVStub_writeToLogFileW(L"Finished loading Memory Validator\r\n");
   	}
   }
   

Detecting memory leaks in the service child process

Now that the NT Service API has been implemented in your application, we can start collecting memory allocation data from the service child process.

1. Choose the Launch > Services > Monitor a service… option.

   

2. The Monitor a service dialog is displayed.

   

   Select the application executable (the service’s child process) you are going to monitor. For this example the application is examples\serviceWithAChildProcess\serviceWithAChildProcess\x64\Release\childProcess_x64.exe.

   Choose the appropriate native/mixed-mode/.Net option to specify which types of code you want to detect memory leaks for. Mixed-mode is the default, as this collects memory allocation data for all types of code.

3. When you click OK, Memory Validator will set up everything needed to interact with the NT Service API and then present you with a dialog box. Note that although you are monitoring an application launched from a service the messages will still relate to the service.

   

4. Start your service. Then do the activities (if any) that cause the service to launch the child process.
5. Close the dialog box.
6. Memory Validator will instrument your service’s child process and start collecting memory allocation data.
7. Memory allocation data will be collected until the child process finishes executing.  For best results, we recommend closing the child process normally (do not kill it with TaskManager or TerminateProcess). You may need to stop the parent service to make the child process close.

I’m not getting any memory allocation data. What can I do?

There are a few things to check.

1. Have you correctly added the NT Service API to the application that will be the service’s child process? 
2. Check the log file for any errors. You specified the log file in step 2 with the call

   svlMVStub_setLogFileName(SZLOGFILENAME);

3. Check the diagnostics tab. If the NT Service API is working correctly Memory Validator will have some data. Information on instrumentation failures will be on the diagnostic tab.
4. Check the debug information dialog. You can access this from the Tools > DLL Debug Information… menu. This dialog will tell you which DLLs have debug information and which do not. Any DLLs that don’t have debug information you’ll need to ensure that debug information is built for these DLLs and is findable.

Conclusion

You have learned how to add the NT Service API to a native application that is going to be launched from a service, how to use Memory Validator to monitor a service’s child process, and what to look at to diagnose errors if things don’t work first time.