Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Windows 7. It seems that svchost is eating up a lot of memory.

The user name for the particular svchost instance is "Network Service". The description is "Host Process for Windows Services".

Sometimes it eats up 50% of the CPU usage. Other times, it's just under 5%. I can't figure out when it's 50% and when it's not. But it fluctuates often -- even when I've just booted up and no programs were started.

How do I diagnose this?

share|improve this question
    
Correction: "Host Process..." not "Hose" – Hello71 Jun 24 '10 at 2:01
up vote 6 down vote accepted

SVC Host is made up of many services running on your machine. I recommend you either right click on it and choose "View Services" to see what is actually causing it (after choosing show processes from all users).

alt text

You can also use Microsoft / Sysinternals Process Explorer which should show you in more detail what is happening.

alt text

(Hovering mouse over the svchost.exe process in Process Explorer)

share|improve this answer
    
How did you get to the Sysinternals Process Explorer? – Jeremy Detrempe Dec 2 '09 at 3:47
    
Updated my post with link - technet.microsoft.com/en-gb/sysinternals/bb896653.aspx Sorry, I forgot it! it is a free download from Microsoft. – William Hilsum Dec 2 '09 at 3:51
1  
Just an addendum, I recently had 2 computers both with SVCHost.exe running intermittently and using up half to two thirds of the RAM available. I did check what services that particular process was handling, and they all seemed legit, windows update, wlansvc, etc. I ran a roguekiller scan because I was suspicious still, and in both instances RogueKiller stopped the process and dug out a malicious file. So, virus scan if suspicious maybe? – Matthew_Sp Apr 28 '15 at 14:26
    
I sometimes have this problem. The "go to services" tool in the Task Manager is completely useless. Sure, it tells you which services are sharing that process. But it doesn't tell you which one is gobbling up the memory! Is there some way to isolate those services to that they use their own instance of the service host? Then when the problem happens again, the offending service will be the only thing in its bloated container. – Kaz Aug 13 '15 at 18:47
    
Aha, question for this: superuser.com/questions/860117/… – Kaz Aug 13 '15 at 18:48

The problem is that multiple services share a single process (a very silly design). This sharing means that if one of them uses a lot of memory, you cannot easily identify it. Worse, if one of them crashes, all of them go down. Likewise, if you want to kill the bloated mess, all of the services contained inside it die.

There is something you can do with Task Manager's list of services for that process, besides balk at it with exasperation. You can isolate those into their own svchost.exe processes to continue the investigation. If a svchost.exe uses a lot of memory and contains only one service, then that is the culprit.

I'd start by isolating the likely culprits, like Windows Update, which is known to cause svchost.exe bloat.

There is a recent fix for Windows Update which may help with this problem. KB3050265, among other things, "... addresses an issue in which system performance can be decreased during scans. This issue has the greatest effect on computers that have a small amount of physical memory."

There is a Superuser question dealing with service isolation, if you want to try it: "Isolate hosted service (svchost.exe) in its own process".

Here are screenshots of the problem happening, on a system in which the Windows Update Service has been isolated to its own process, confirming that it's the culprit:

Windows Update service being a pig

Service view of Windows Update service being a pig

Here is a capture of the Task Manager window on the same system, after the KB3050265 patch is applied. The typical behavior is now that the update service takes cap at around a 300 megabyte footprint (much smaller than before), while tying up a procesor 100%. Not ideal, but the impact on the system responsiveness is greatly mitigated. It finishes after a few minutes and is gone: Windows Update service: less of a pig now

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.