Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Svchost: How to make it run only one module per instance of svchost.exe? How to get extended process info?

Tags:

I have an issue with one of my applications. I run the application, everything is okay. When I close this application, I notice that one of the "svchost" processes in the system takes up about 95-100% of the CPU and I have to figure out what is taking up so much of the CPU cycles.

I set myself pretty simple and straightforward goals on how to go about this:

  1. Get the process info or this particular "svchost" that is taking up so much CPU
  2. I know what an svchost process is used for, so I save you guys the effort to explain me about it. So now I must know which modules are loaded by this rogue svchost.
  3. I ran my application, closed it and made sure that my process is completely closed, not anymore in memory. I then got the PID of the svchost taking up 100% CPU
  4. I ran ProcessExplorer (from sysinternals), got the info about how many and which services this svchost has hosted. They are about 12 services. I would not bother about this list as I am more concerned about How to IDENTIFY which one of these 12 services is taking up the CPU cycles.
  5. Now I have the list with me and here starts the tricky part... I want to do 1 of the 2 options below

Option 1: How do I identify which one of these 12 services is taking up so much CPU? Can I get extended info for this svchost process that gives me detailed info on a "per service" basis hosted in this process, rahter on the process basis that I have now?

Option 2: Is it possible to configure windows to make svchost to run only one service per instance of svchost?

If there is a better option on how to investigate, narrow down the root cause of this issue, please do let me know.

like image 599
aeon Avatar asked May 09 '11 06:05

aeon


People also ask

Why do I have multiple svchost.exe processes running?

It is not unusual for multiple instances of Svchost.exe running at the same time in Task manager in order to optimise the running of the various services. Each Svchost.exe session can contain a grouping of services, therefore, separate services can run, depending on how and where Svchost.exe is started.

How do you determine what services are running under a svchost.exe process?

Right-click on a SVCHOST process and select the Go to Service(s) menu option. You will now see a list of services on your computer with the services that are running under this particular SVCHOST process highlighted.

What is svchost.exe K?

Svchost.exe (Service Host, or SvcHost) is a system process that can host from one or more Windows services in the Windows NT family of operating systems. Svchost is essential in the implementation of shared service processes, where a number of services can share a process in order to reduce resource consumption.

Does svchost.exe need to be running?

Svchost.exe is a required Windows file and is used to load needed DLL files used with Microsoft Windows and Windows programs that run on your computer.


1 Answers

I had answered my question but I put it under comments. I am now adding the same as an answer so it is known.

I figured out how to do both the options in my question above:

Solution for option 1:

Open Resource Monitor (resmon.exe), go to CPU tab, check the svchost.exe (with the PID to watch for) under Image tab, go to "services" box and check for the CPU usage by different services.

Solution for option 2:

sc config <service name> type= own 

Or change in registry HKLM\System\CurrentControlSet\Services\<ServiceName>\Type to 0x10.

Refer to http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx for more info.

like image 146
aeon Avatar answered Nov 21 '22 19:11

aeon