Scott Hanselman

Svchost.exe Sucks CPU and Rebulding the WMI/WBEM Repository

October 31, '05 Comments [5] Posted in Musings
Sponsored By

Lately I've been seeing one particular svchost.exe sucking CPU. There always a number of in-proc running inside of each of the many svchost (Service Host) instances. Using ProcEx, I figured out the PID of the specific instance. Then, I right clicked within ProcEx, hit Properties, and under the Threads tab noticed that wbemcore.dll was working REALLY hard.

Crap, time to re-schmutz WMI's repository. So, I stop WMI from the command line with :

net stop winmgmt

Then I deleted the Repository directory in c:\windows\system32\wbem\ then started again with

net start winmgmt

Then I re-stored/compiled all the .mof (Managed Object Format) files with a batch file containing this one line:

for %%i in (*.mof,*.mfl) do Mofcomp.exe %%i

Now I'm back in business.

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Sponsored By
Hosting By
Dedicated Windows Server Hosting by SherWeb
Monday, 31 October 2005 20:43:44 UTC
Hey Scott, If you have time, do explain,
1) What is WMI?
2) What function does the repository serve?
3) Why did it freak?
Thursday, 03 November 2005 21:16:42 UTC
I'd like to second that request, at least as far as why I ought to delete it all and rebuild it.

Hardware changes? Software changes? Both?
bob
Thursday, 03 November 2005 22:15:16 UTC
1) The purpose of WMI is to provide a standardized means for managing your computer system, be it a local computer or all the computers in an enterprise. (from MSDN) It's basically a repository for info about your system.
2) It stores all the information about your system (that has chosen to store info in WMI)
3) Dunno, I suspect I installed something that tried to store data in WMI and it went sour. It might also have gone bad since I turned off my machine suddenly one day while it was writing to disk.
Saturday, 05 November 2005 04:52:07 UTC
I had the exact same problem, started yesterday... Strange coincidence.... The only change to my system was an automatic up date of some HP printer driver software.

Thanks for the post, timely and helpful.

P.S. I just received your new ASP.NET 2.0 book... Starting to churn thru it...

Joe
Tuesday, 15 November 2005 00:55:09 UTC
I know svchost is a general ms dll service. I was looking at the properties>thread in procEx and noticed three of my five svchost.exe were only using apvapi32.dll. This is also an important non virus related dll. But why three. Should I follow the mentioned WMI remake?
Don
Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.