3

I am on Service Pack 2. My CPU is running at 100% with either svchost.exe or services.exe. I know that this was common in XP, server 2000, etc. But now I only seem to find posts for Vista. What is the reason?

user49352
  • 123
  • 2
  • 4
  • 12

3 Answers3

5

Try using Process Explorer and Task Manager to figure out what service is hogging the CPU. Once you know that much, edit it in to the question and we might be able to help.

Chris S
  • 77,337
  • 11
  • 120
  • 212
3

Since you're running Server 2008 and if you don't want to install software to figure out what's causing this (and really, process explorer is very good), you can now do this from Task Manager. The process is to...

  1. Go to View -> Select Columns.
  2. Ensure that "PID" is selected.
  3. Identify the consuming process and note the process ID (PID)

task-manager with PID column
(source: sysadmin1138.net)

  1. Select the "Services" tab in Task Manager
  2. Click the PID column to sort it by PID
  3. Identify the service(s) that is associated with that process, by locating that PID

Task-manager on the Services tab
(source: sysadmin1138.net)

With SVCHost a single instance may be associated with multiple services. As it happens, ProcessExplorer also can't distinguish between them. This is new with Server 2008, and is a very nice addition.

Glorfindel
  • 1,213
  • 3
  • 15
  • 22
sysadmin1138
  • 131,083
  • 18
  • 173
  • 296
  • Very helpful comments!! I am also seeing OWSTimer jump in with high CPU which appears to be a sharepoint issue. Is that true? How is it fixed? The services that I am seeing related to svchols are WinRM, TermService, NlaSvc, KtmRm, Dnscache, and CryptSvc. Task Manager makes these pretty obvious but didn't know how to see this in process explorer. We are running this server on VMWare with McAfee OAS – user49352 Jul 26 '10 at 21:00
  • I am also seeing PlugPlay and DcomLaunch for a different svchost – user49352 Jul 26 '10 at 21:08
  • 1
    Actually you can save a step, right click the suspect process in the Processes tab and there should be an option for Go to Services; you'll wind up there with the matching service(s) highlighted. – SqlACID Jul 26 '10 at 22:32
  • @SqlACID See? ProcessExplorer is no longer required kit for figuring out what process belongs to which service. – sysadmin1138 Jul 26 '10 at 22:57
0

the following will give you a run down of whats being hosted by these process

wmic service where "pathname like '%svchost.exe%' or pathname like '%service.exe%'" get name,pathname,processid

tony roth
  • 3,844
  • 17
  • 14