Thoughts from the EPS Windows Server Performance Team
Useful Microsoft Blogs
HIGH CPU – SVCHOST.EXE
Description: SVCHOST.EXE is a generic host process for services. There can be multiple SVCHOST.EXE running on a system and each SVCHOST.EXE can also hold multiple services. Troubleshooting high CPU usage with SVCHOST.EXE can difficult since Task Manager or Performance Monitor cannot show which service inside the SVCHOST.EXE is causing the issue.
Scoping the Issue: The first step is to identify the Process ID (PID) of the SVCHOST.EXE that is pegging the CPU. This can be done through Task Manager->Processes tab. If the PID column is not present, you can add it by selecting View->Select Columns and check the PID checkbox. Once the PID is identified, the next step is to determine which services are running under the PID. From a Command Prompt, type:
TASKLIST.EXE will list all the processes and PID’s running on the system. Look for the PID in question and check the Services column. This will give you a list of Services to start investigating. If it is not clear which Service inside the SVCHOST.EXE process is causing high CPU usage, the next step is to isolate the service into its own SVCHOST.exe container. You can use ‘SC CONFIG’ to do this. From a Command Prompt type:
sc config <service name> type= own
Do this for each service inside the SVCHOST.EXE in question. Restart the service and it will start in its own SVCHOST.EXE.
To revert the service back to its original state, type the command:
sc config <service name> type= share
Please note that resetting SVCHOST.EXE configuration via the share command will require a system reboot.
Data Gathering: In all instances, collecting either MPS Reports with the General, Internet and Networking, Business Networks and Server Components diagnostics, or a Performance-oriented MSDT manifest must be done. Additional data required may include the following:
Troubleshooting / Resolution:
After you have gathered this data, review the following: