7

I'm running Windows 7. It seems that svchost is eating up a lot of memory.

The user name for the particular svchost instance is "Network Service". The description is "Host Process for Windows Services".

Sometimes it eats up 50% of the CPU usage. Other times, it's just under 5%. I can't figure out when it's 50% and when it's not. But it fluctuates often -- even when I've just booted up and no programs were started.

How do I diagnose this?

Improve this question
1
  • Correction: "Host Process..." not "Hose"
    – Hello71
    Jun 24, 2010 at 2:01

3 Answers 3

Reset to default
7

SVC Host is made up of many services running on your machine. I recommend you either right click on it and choose "View Services" to see what is actually causing it (after choosing show processes from all users).

alt text

You can also use Microsoft / Sysinternals Process Explorer which should show you in more detail what is happening.

alt text

(Hovering mouse over the svchost.exe process in Process Explorer)

Improve this answer
5
  • How did you get to the Sysinternals Process Explorer?
    – boo-urns
    Dec 2, 2009 at 3:47
  • Updated my post with link - technet.microsoft.com/en-gb/sysinternals/bb896653.aspx Sorry, I forgot it! it is a free download from Microsoft.
    – William Hilsum
    Dec 2, 2009 at 3:51
  • 1
    Just an addendum, I recently had 2 computers both with SVCHost.exe running intermittently and using up half to two thirds of the RAM available. I did check what services that particular process was handling, and they all seemed legit, windows update, wlansvc, etc. I ran a roguekiller scan because I was suspicious still, and in both instances RogueKiller stopped the process and dug out a malicious file. So, virus scan if suspicious maybe?
    – Matthew_Sp
    Apr 28, 2015 at 14:26
  • I sometimes have this problem. The "go to services" tool in the Task Manager is completely useless. Sure, it tells you which services are sharing that process. But it doesn't tell you which one is gobbling up the memory! Is there some way to isolate those services to that they use their own instance of the service host? Then when the problem happens again, the offending service will be the only thing in its bloated container.
    – Kaz
    Aug 13, 2015 at 18:47
  • Aha, question for this: superuser.com/questions/860117/…
    – Kaz
    Aug 13, 2015 at 18:48
1

The problem is that multiple services share a single process (a very silly design). This sharing means that if one of them uses a lot of memory, you cannot easily identify it. Worse, if one of them crashes, all of them go down. Likewise, if you want to kill the bloated mess, all of the services contained inside it die.

There is something you can do with Task Manager's list of services for that process, besides balk at it with exasperation. You can isolate those into their own svchost.exe processes to continue the investigation. If a svchost.exe uses a lot of memory and contains only one service, then that is the culprit.

I'd start by isolating the likely culprits, like Windows Update, which is known to cause svchost.exe bloat.

There is a recent fix for Windows Update which may help with this problem. KB3050265, among other things, "... addresses an issue in which system performance can be decreased during scans. This issue has the greatest effect on computers that have a small amount of physical memory."

There is a Superuser question dealing with service isolation, if you want to try it: "Isolate hosted service (svchost.exe) in its own process".

Here are screenshots of the problem happening, on a system in which the Windows Update Service has been isolated to its own process, confirming that it's the culprit:

Windows Update service being a pig

Service view of Windows Update service being a pig

Here is a capture of the Task Manager window on the same system, after the KB3050265 patch is applied. The typical behavior is now that the update service takes cap at around a 300 megabyte footprint (much smaller than before), while tying up a procesor 100%. Not ideal, but the impact on the system responsiveness is greatly mitigated. It finishes after a few minutes and is gone: Windows Update service: less of a pig now

Improve this answer
0

Beside Sysinternals Process Explorer there is a nice open source utility to analyze what svchost is doing: svchost viewer

svchost viewer screenshot

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .