Scott Hanselman

Figuring out why my SVCHOST.EXE is at 100% CPU without complicated tools in Windows 7

March 14, '11 Comments [23] Posted in Tools
Sponsored By

Windows Task Manager won't save youThe SvcHost.exe process hosts services that run in the background on Windows. It's literally "Service Host." You may have a dozen services or more running inside that process. More complex is that you'll sometimes see multiple SvcHost.exe's in your TaskManager. 

Let me tell you now, Task Manager will not save you. You can see the PIDs for a running Service for the Services tab, but when a service goes insane, good luck nailing it down.

This inevitably leads you to questions like, "What Services are running inside what SvcHost.exe?" and "Which Service is using 100% CPU."

There's lots of ways to figure this out, but first I'll tell you that simply killing the SvcHost.exe process that is using the most CPU will also kill ALL the other services that were running inside that host process.

There's many command line ways to figure this stuff out, like

net start

or

sc query type= service

or

tasklist /svc

But this post is about doing it the easy way without lining up Process IDs and such.

Which Service is Freaking Out?

From the Start Menu, type "Resource Monitor" and run it.

Resource Monitor

Click the checkboxes to the left of each of the svchost.exe processes (or just those that you care about). Now, switch to the CPU tab:

Resource Monitor - CPU

See the names of the logical services in the middle pane? Now you can sort by the CPU column and you've got the name of your out of control process.

You can right click and try to stop or restart just the one services, or even use default browser's default search engine to "Search Online" for that service name:

Resource Monitor with the Right Click Menu showing

This tip has helped me several times while writing and debugging services. Resource Monitor is your friend. Many folks don't' even know it's there!

Enjoy!

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. I am a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Sponsored By
Hosting By
Dedicated Windows Server Hosting by ORCS Web
Monday, March 14, 2011 9:45:37 PM UTC
This is very helpful, thanks.
fschwiet
Monday, March 14, 2011 9:58:07 PM UTC
Smacks head... Can't believe I haven't even seen that tool before. Thanks!
Monday, March 14, 2011 10:07:04 PM UTC
Would have figured you to be a Process Explorer man...
Monday, March 14, 2011 10:08:04 PM UTC
Would have figured you to be a Process Explorer man...

BTW OpenID login here is the least user friendly system I have used in a while... WTF?
Monday, March 14, 2011 10:59:40 PM UTC
There is something similar to IIS and which website is at 100%?
Monday, March 14, 2011 11:32:38 PM UTC
<a href"http://technet.microsoft.com/en-us/sysinternals/bb896653">ProcessExplorer</a> is the best kind of tool I have used for this purpose.
Monday, March 14, 2011 11:41:38 PM UTC
Of course, step 1 for the end user is probably to check whether your hosts file is small enough to open in Notepad.
Tuesday, March 15, 2011 2:43:16 AM UTC
I was so excited when I started reading your post. But you stopped to early! Once you identify IIS as the culprit, how do you narrow it down to which site and even further to compilation, misbehaving URLs, or bad requests? I've had this problem for a while now, and all I can do is schedule App Recycling every 15 minutes.
Eric Falsken
Tuesday, March 15, 2011 3:08:48 AM UTC
Sometimes it's not the CPU that's the culprit. The Disk tab will show which processes are eating up the I/O, and a little research with Goo. . . er, Bing, will show whether it's expected behavior or not. Great for those drive thrashing issues that can have have high CPU utilization as a side effect.
Tuesday, March 15, 2011 3:09:25 AM UTC
Sometimes it's not the CPU that's the culprit. The Disk tab will show which processes are eating up the I/O, and a little research with Goo. . . er, Bing, will show whether it's expected behavior or not. Great for those drive thrashing issues that can have have high CPU utilization as a side effect.
Tuesday, March 15, 2011 3:17:50 AM UTC
It's also on the "Performance" tab of the Windows Task Manager - a little button on the bottom. Just found that last week.
Tuesday, March 15, 2011 7:01:42 AM UTC
thanks for that
+
for quicker access use start->Run->resmon
then it will be cached there..
Tuesday, March 15, 2011 7:39:58 AM UTC
A quicker and easier way to get the resource monitor when you already have the Task Manager open, is to click on the 'performance' tab and click on the 'Resource Monitor' button at the right bottom of the screen.

Also the SysInternals tools mentioned by Santoch are of incredible value for programmers and other IT professionals.
Dave
Tuesday, March 15, 2011 8:44:02 AM UTC
Thanks for that info, it will be put to good use in the near future.
Tuesday, March 15, 2011 11:11:34 AM UTC
I had the exact same problem after I upgraded Windows 7 to service pack 1. 100% memory usage all the time with only a few windows opened. I use some Adobe products all the time for my work so impossible to work. I searched on internet but could not solve the issue. I wish I had found this post before instead of reinstalling Windows. Bookmarked it for the next time :) Thanks.
Tuesday, March 15, 2011 12:00:57 PM UTC
Those who are lucky to have Windows in a language other than English, won't find anything by typing "Resource Monitor" in the start menu. You can start the resource monitor by pressing WindowsKey+R and typing resmon.exe (and pressing enter afterwards).
Tuesday, March 15, 2011 2:31:01 PM UTC
Thanks for sharing info on svchost.exe mean while take a deep look on svchost process, visit here http://bit.ly/gN7RPh
Kevin
Thursday, March 17, 2011 3:49:03 AM UTC
Good post home skillet.
Friday, March 18, 2011 2:38:29 AM UTC
Great post! Very helpful - thanks!
Cori
Sunday, March 20, 2011 3:06:30 AM UTC
Thanks. I found the post very interesting for me. I wander why Microsoft doesn’t show the real service name right in the Task Manager. It would be very useful for everyone, not only developers or IT staff.
Tuesday, March 22, 2011 12:05:07 AM UTC
I can't believe I never saw that before. Hansleman, you're da *man*!
Tom Hundley
Monday, September 05, 2011 9:12:14 PM UTC
Interesting that the svchost.exe that's making my system go haywire is not associated with any processes. What could this mean? Scanned with 2 virus scanners nothing shows.
Geoff
Monday, October 03, 2011 2:11:11 AM UTC
I searched and read tons of blogs and forums and tried lots of different things and ran 100 different scans but this helped me fix my problem in 2 minutes. Thanks so much!
Dan
Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.