svchost.exe -k netsvcs occupying >1GB memory

Question

I have noticed my production server "svchost.exe -k netsvcs" is occupying >1GB ram memory, steadily, which I think is a bit excessive.

This is what tasklist /svc will give me for this process:

                               Appinfo, CertPropSvc, gpsvc, IKEEXT,
                               iphlpsvc, LanmanServer, ProfSvc, Schedule,
                               SENS, SessionEnv, ShellHWDetection,
                               Winmgmt, wuauserv

I was wondering what might be the process listed that is responsible for this memory leak and how to fix it. Has anyone had this same behavior in the past?

Server is running Windows Server 2008 R2 (Build 7601: Service Pack 1) and it's main function is to run in-house application processor workers.

I do have SP1 installed, but now that you talked about it... https://support.microsoft.com/kb/977357 get-hotfix -id KB977357 get-hotfix : Cannot find the requested hotfix on the 'localhost' computer. If I have SP1 installed shouldn't I have this hotfix installed? — agentsvr, Apr 03 '14 at 13:14
The service pack rolls up the hotfix with it, so you won't find it listed. — Nathan C, Apr 03 '14 at 14:03
OK. Well I would say the next step is to find out which exact service is consuming the memory, and the only way to do that is to break them out into their own svchost.exe processes one at a time by using `SC Config Servicename Type= own`. See http://serverfault.com/questions/12278/how-to-find-memory-usage-of-individual-windows-services — Ryan Ries, Apr 03 '14 at 15:09
You could also just stop / kill the services one at a time and see when the mem usage drops. — ssnobody, Jul 20 '15 at 04:35
Focus your attention on Windows Update (that's the wuauserv process). It's common for it to go haywire and start consuming huge amounts of memory. MS has a number of fix-its and other tools to help with this. If you're running a local WSUS that could also be contributing. — Brandon Xavier, Aug 24 '15 at 00:03

score 2 · Answer 1 · answered Jun 12 '15 at 06:24

The question is, is it a leak? You're saying that the memory usage is "steady".

Leak = memory usage increases over time, never decreasing, so you have to reload the server every once in a while.

If the taks is staying at ~1 GB for long time (say, two weeks), then the situation is perfectly normal. Modern software is made to use free memory whenever necessary, and I know a few programs that will just grab whatever there is just to save time on memory allocation.

If it doesn't impede system's operation, don't touch it.

score 1 · Answer 2 · answered Jun 19 '15 at 15:11

Memory allocation is very expensive on the CPU's cycles compared to reusing existing, allocated memory. It is often that once a program starts, until it is finished its function, it will not "let go" of this memory.

For example, Firefox holds memory for some time. If you leave your computer on for a week with Firefox open, you'll notice it will constantly grow in memory size. After YouTubing, Google Play Music-ing, and browsing, mine hits 2-4GB in memory - which shrinks to 300MB after I restart the process. This is because of its caching features, and this behaviour is by design.

I would tend to believe that the SVCHost process is doing exactly as it should. How many services is your server running? 1GB Does not sound concerning - though that depends on which services you're running.

score 1 · Answer 3 · edited Jun 24 '15 at 10:09

As the next step, if you want to investigate further, I would install process explorer (procexp.exe) which you can find it on the Microsoft site. That will give you what services use this process (see screenshot from procexp) you can then stop/start services and see if a particular service is associated with releasing/acquiring a large memory allocation. It will also tell you if it is Working set or Private (=mainly heap) allocated memory. If it is tied to a specific service then you will have a clearer path to research further.

It goes without saying you would need to do this testing in agreed outage/maintenance window or reproduce on a test server as you will be interrupting normal operations. Reboot and check list of services is back to your normal run set after testing is complete.

Screen shot:

svchost.exe -k netsvcs occupying >1GB memory

3 Answers3

Linked