22

I have an issue with one of my applications. I run the application, everything is okay. When I close this application, I notice that one of the "svchost" processes in the system takes up about 95-100% of the CPU and I have to figure out what is taking up so much of the CPU cycles.

I set myself pretty simple and straightforward goals on how to go about this:

  1. Get the process info or this particular "svchost" that is taking up so much CPU
  2. I know what an svchost process is used for, so I save you guys the effort to explain me about it. So now I must know which modules are loaded by this rogue svchost.
  3. I ran my application, closed it and made sure that my process is completely closed, not anymore in memory. I then got the PID of the svchost taking up 100% CPU
  4. I ran ProcessExplorer (from sysinternals), got the info about how many and which services this svchost has hosted. They are about 12 services. I would not bother about this list as I am more concerned about How to IDENTIFY which one of these 12 services is taking up the CPU cycles.
  5. Now I have the list with me and here starts the tricky part... I want to do 1 of the 2 options below

Option 1: How do I identify which one of these 12 services is taking up so much CPU? Can I get extended info for this svchost process that gives me detailed info on a "per service" basis hosted in this process, rahter on the process basis that I have now?

Option 2: Is it possible to configure windows to make svchost to run only one service per instance of svchost?

If there is a better option on how to investigate, narrow down the root cause of this issue, please do let me know.

1
  • 1
    I figured out how to do both the options in my question above: Solution for option 1: Open Performance Monitor (perfmon.exe), go to CPU tab, check the svchost.exe (with the PID to watch for) under Image tab, go to "services" box and check for the CPU usage by different services. Solution for option 2: Go the registry key: HKLM\System\CurrentControlSet\Services|<ServiceName>(DLL) change the type to 0x10. Refer blogs.technet.com/b/askperf/archive/2008/01/11/… for more info.
    – aeon
    Commented May 9, 2011 at 9:52

2 Answers 2

27

I had answered my question but I put it under comments. I am now adding the same as an answer so it is known.

I figured out how to do both the options in my question above:

Solution for option 1:

Open Resource Monitor (resmon.exe), go to CPU tab, check the svchost.exe (with the PID to watch for) under Image tab, go to "services" box and check for the CPU usage by different services.

Solution for option 2:

sc config <service name> type= own

Or change in registry HKLM\System\CurrentControlSet\Services\<ServiceName>\Type to 0x10.

Refer to http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx for more info.

4
  • 4
    Very helpful, thank you. Per the TechNet blog post, to change it back to a shared process, run sc config <service name> type= share.
    – Mark Berry
    Commented Jan 31, 2015 at 18:46
  • @MarkBerry: Am happy if it helped :)
    – aeon
    Commented Jul 3, 2015 at 2:59
  • It seems there is a typo in solution for option 1 Open Performance Monitor (perfmon.exe), go to CPU tab. I believe you actually meant - Open Resource Monitor (resmon.exe) instead. There is no CPU tab in performance monitor in Windows 7.
    – RBT
    Commented Nov 14, 2016 at 4:13
  • Or you can type perfmon /res on run prompt to open resource monitor.
    – RBT
    Commented Nov 14, 2016 at 4:45
6
  1. Launch Resource Monitor

    • Type Resource Monitor into start menu or
    • Click Resource Monitor button under Performance tab in Task Manager
  2. Click CPU tab at the top of Resource Monitor

  3. Place a check mark by the process you want to investigate (I sort by Average CPU)

  4. Services will filter by the process you mark and show CPU stats for each service running in that process.

1
  • 3
    On non-English Windows: W+r perfmon /res
    – Jarekczek
    Commented Mar 11, 2015 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.