Scheduled Tasks appear hung in the “Running” state on Windows Server 2003 based systems


Some of the tougher issues we see here at Microsoft Support are those that are the result of different applications running together, which is what a multitasking OS like Windows is all about.

Take, for example, one issue in particular that I worked on recently. Task Scheduler was configured to run about 600 tasks. This is a huge number, however, Task Scheduler in Windows Server 2003 works fine with up to 1000 tasks. Go beyond that and you're asking for trouble.

Every few days, two or three tasks would appear to "hang", that is, they remained in the Running state. If a task remains in this state the next time it is scheduled to run, Task Scheduler’s inbuilt logic will ignore it. Most Tasks (or jobs) were configured to run every 10 minutes from 9 AM to 6 PM. Task Scheduler was also configured to stop the task if it ran for more than 8 minutes. The issue would come to light only after users notice that the task was not performing the work it was supposed to, like updating data files. The delay in users reporting the issue - which was 24 hours in this case - combined with the number of tasks running meant that by the time we pulled the log from the system - C:\Windows\Tasks\SchedLgU.txt - it had already wrapped many times over. The default 32 KB limit greatly restricted how many entries the log could store.

The first step in determining what was going on here was to increase the size of the log. We followed the steps in this KB article:

How to Limit the Maximum Size of the Scheduled Tasks Log File

http://support.microsoft.com/kb/169443

We changed MaxLogSizeKB setting from 20 (hex) to 1000 (hex). This gave us enough space with the number of tasks we had, and the regularity with which they were being run.

The next time the issue was reported, we noted the names of the tasks that were hung. We then reviewed the log file – which can also be accessed by the Advanced Menu à View Log option – and searched for the Tasks that were hung. Here’s what we found:

"Hung_Task_1.job" (Hung_Task1.bat)
       Started 10/27/2010 8:50:02 AM
"Other_Task_1.job" (Other_Task1.bat)
       Started 10/27/2010 8:50:04 AM
" Other_Task_2.job" (Other_Task2.bat)
       Started 10/27/2010 8:50:07 AM
" Other_Task_3.job" (Other_Task3.bat)
       Started 10/27/2010 8:50:09 AM
" Other_Task_4.job " (Other_Task4.Bat)
       Started 10/27/2010 8:50:11 AM
"Hung_Task_1.job" (Hung_Task1.bat) 10/27/2010 8:50:13 AM ** WARNING **
Unable to update the task.
       The specific error is:
       0x00000020: The process cannot access the file because it is being used by another process.
"Hung_Task_1.job" (Hung_Task1.bat)
       Finished 10/27/2010 8:50:13 AM
       Result: The task completed with an exit code of (0).
.
.
.
.
"Hung_Task_2.job" (Hung_Task2.bat)
       Started 10/27/2010 9:20:06 AM
"Other_Task_5.job" (Other_Task5.bat)
       Started 10/27/2010 9:20:08 AM
"Other_Task_6.job" (Other_Task6.bat)
       Finished 10/27/2010 9:20:08 AM
       Result: The task completed with an exit code of (0).
"Hung_Task_2.job" (Hung_Task2.bat) 10/27/2010 9:20:10 AM ** WARNING **
Unable to update the task.
       The specific error is:
       0x00000020: The process cannot access the file because it is being used by another process.
"Hung_Task_2.job" (Hung_Task2.bat)
       Finished 10/27/2010 9:20:10 AM
       Result: The task completed with an exit code of (0).
.
.
.
.
"Hung_Task_3.job" (Hung_Task3.bat)
       Started 10/27/2010 6:35:02 PM
"Other_Task_7.job" (Other_Task7.bat)
       Started 10/27/2010 6:35:04 PM
"Other_Task_7.job" (Other_Task7.bat)
       Finished 10/27/2010 6:35:05 PM
       Result: The task completed with an exit code of (0).
"Hung_Task_3.job" (Hung_Task3.bat) 10/27/2010 6:35:10 PM ** WARNING **
Unable to update the task.
       The specific error is:
       0x00000020: The process cannot access the file because it is being used by another process.
"Hung_Task_3.job" (Hung_Task3.bat)
       Finished 10/27/2010 6:35:10 PM
       Result: The task completed with an exit code of (0).

First, some background on how Task Scheduler works. When you create a Task, its details are stored in a .job file. Because the C:\Windows\Tasks folder is a “special” folder, these .job files are not visible. However, if you were to remove the System attribute from this folder - by running attrib.exe -s C:\Windows\Tasks - and then navigating to that folder, you’ll see all these .job files for each of the tasks you’ve configured. To add the System attribute back, run the attrib.exe command with a +s.

Each time Task Scheduler runs or stops a task, it edits the .job file. In our case, each task starts successfully. However, one it completes, Task Scheduler needs to update the .job file. It cannot do so because another process is reading/writing to that file.

The .job file is a binary (non-human readable) file which only the Task Scheduler can understand. So what other application can possibly need to access this file?

The answer to this question comes from years of dealing with the “…cannot access the file because it is being used by another process” error: The antivirus software.

The two options to confirm that the antivirus software is the cause of this issue are:

· Exclude the C:\Windows\Tasks folder from being scanned (recommended)
· Disable the antivirus software

In the unlikely event that the antivirus software is not responsible for the issue, here’s what you can do to track down the culprit:

Use Process Monitor and follow these steps:

Important note: Please ensure that which user session (user logon) you’re running Process Monitor in remains logged in. If you logoff this user, Process Monitor will exit and not capture any data.

  1. Download Process Monitor from here: http://download.sysinternals.com/Files/ProcessMonitor.zip
  2. Extract it to its own directory and run Procmon.exe.
  3. Click Agree on the Process Monitor License window and the click OK on the Process Monitor Filter window that pops up.
  4. If a capture starts by default, stop it by clicking on the capture button and then clear the window.
  5. Click the Filter Menu and then click Filter…
  6. Set this filter using the drop down lists available:

    First Drop Down List select Path
    Second Drop Down List select contains
    Third Drop Down List, type .job
    Forth Drop Down List select Include
    Click Add.

    First Drop Down List select Process Name
    Second Drop Down List select is
    Third Drop Down List, type svchost.exe
    Forth Drop Down List select Exclude
    Click Add

    First Drop Down List select Process Name
    Second Drop Down List select is
    Third Drop Down List, type Explorer.exe
    Forth Drop Down List select Exclude
    Click Add

    Click OK

  7. Click the Filter Menu again and select Drop Filtered Events.
  8. Now start the capture again (by clicking the capture button) and wait for the issue to reoccur.
  9. After the issue has occurred, stop the capture by clicking the capture button once again.

Any process that shows up in the log is suspect. Determine which application the process belongs to, disable/uninstall the application and monitor the server.


Comments (1)

  1. Suvradeep Banerjee says:

    Thanks for this article, really informative… btw can you suggest me any good article on Windows Task Scheduler, I mean I want to dig further on it.

Skip to main content