4

I'm looking for a robust way to determine if a service can be stopped without data loss or corruption, or if a regular stopping will work if the service can be killed via powershell.

I thought about to watch the file handles for the service to see if the service is writing or reading something from there working directory. Is there something else I can query via powershell to see if the service is still processing data.

Lizz
  • 111
  • 1
  • 8
Marcel Janus
  • 1,115
  • 2
  • 14
  • 29
  • 1
    Attempting to shutdown the service is fairly robust way to determine whether or not you can shut down the service. What are you actually trying to achieve here? – HopelessN00b Sep 27 '12 at 09:48
  • 4
    There's a slight difference between a service's properties "CanShutdown" (IGNORES_SHUTDOWN, ACCEPTS_SHUTDOWN) and "CanStop" (STOPPABLE, NOT_STOPPABLE) in PowerShell. For instance: `(Get-Service spooler).CanShutdown` vs `(Get-Service spooler).CanStop` -- do you want to know if you can stop the service, or if the service is notified during shutdown? – jscott Sep 27 '12 at 11:20
  • @HopelessN00b but sometimes we have the problem that the service control manager can't shutdown the service even although the service is not processing any data. – Marcel Janus Sep 27 '12 at 19:14
  • @jscott we need to know if the service can be stopped. Sorry for the unclear question. As I mentioned also in my comment above we have the problem that sometimes the service can't be stopped via SCM. So we have to kill the service. But to prevent any data loss or corruption we need to assure that the service is not processing any data. – Marcel Janus Sep 27 '12 at 19:18
  • Delicate circumstance. Is this an in-house app? Until the problem can be found and fixed, I suggest using a tool like Hyena from http://systemtools.com/hyena/index.html to monitor file handles, as you mentioned. – Lizz Jan 05 '13 at 06:25

1 Answers1

2

The most "robust" way of determining whether a service can be stopped or killed is to analyze its source code to see if it handles a shutdown or stop event properly.

Next best is to attach to it with a debugger and set breakpoints around important events.

You don't tell us what this service does or how it works, but if you want to watch what file handles the process has open during normal operation, in my opinion Sysinternals' Process Explorer is the easiest way to do it. You can also see file system activity taking place in real time with Process Monitor, filtering the results to the just process you want to see.

If the service was written properly, it will decommit all of its resources in some sort of graceful way before the process exits (when shut down through the service manager,) or at least the ones that would lead to data loss if they weren't.

sc query your-service will give you what the Service Manager thinks the service is capable of, but again it is ultimately up to how the service was written as to whether the functionality was properly implemented or not.

Edit: That your service hangs when you try to stop it tells me that it wasn't written properly.

Edit: Oh and one last thing, if you want to do something scripty with this, handle.exe is a command-line program to monitor handles. You could parse its output. All these Sysinternals utilities are up on the WebDAV share \live.sysinternals.com\Tools\

Ryan Ries
  • 55,481
  • 10
  • 142
  • 199
  • Thank you for your answer. The service I want to monitor is not written by someone of your company or customers company. Is's OpenText StreamServe so it's closed source. The idea with handle.exe from sysinternals was the first thing which came in my mind. But I want to hear some alternatives to my solution. – Marcel Janus Jan 09 '13 at 13:36