|
This is something that's always bothered me, so I'll ask the Server Fault community. I love Process Explorer for keeping track of more than just the high-level tasks you get in the Task Manager. But I constantly want to know which of those dozen services hosted in a single process under svchost is making my processor spike. So... is there any non-intrusive way to find this information out? | ||||
|
feedback
|
|
Yes, there is an (almost) non-intrusive and easy way: Split each service to run in its own SVCHOST.EXE process and the service consuming the CPU cycles will be easily visible in Process Explorer (the space after "=" is required): Do this in a command line window or put it into a BAT script. Administrative privileges are required and a restart of the computer is required before it takes effect. The original state can be restored by: Example: to make Windows Management Instrumentation run in a separate SVCHOST.EXE: This technique has no ill effects, except perhaps increasing memory consumption slightly. And apart from observing CPU usage for each service it also makes it easy to observe page faults delta, disk I/O read rate and disk I/O write rate for each service. For Process Explorer, menu View/Select Columns: tab Process Memory/Page Fault Delta, tab Process Performance/IO Delta Write Bytes, tab Process Performance/IO Delta Read Bytes, respectively. On most systems there is only one SVCHOST.EXE process that has a lot of services. I have used this sequence (it can be pasted directly into a command line window): | |||||||||||||||
feedback
|
|
While I don't know of easy way to do it directly, you can often infer it from the Process Explorer properties page for the svchost process. The Services tab on the process properties will tell you which services are hosted in that process. And the Threads tab will show you the threads and thread stacks running as well as their CPU usage. Often the Start Address on the thread will give an indication of the entry point DLL, and by extension the service, that's running on that thread. Other times you can look at the thread callstack and will see the module name in the call stack that tells you which piece of code is running. | |||
|
feedback
|
|
I don't know if this is still a question you want answers, but while troubleshooting a customer's svchost error, I learned that there is a command line for exactly this: "tasklist /svc" It gives a complete list of the processes running, with the process ID and the services each process is running. It doesn't give a processor usage, but you can close them one process at a time by process ID, and learn at least which group of services is clogging up your CPU. | |||
|
feedback
|
|
To the poster that recommended the PowerShell script: I tried it and it succesfully changed all my services. However, upon reboot an error box popped up and a restart was triggered. I had to restore with 'last good configuration'. Be careful. | |||
feedback
|
|
rem DCOM Server Process Launcher DcomLaunch, rem Plug and Play PlugPlay, rem Power Power rem RPC EndPoint Mapper RpcEptMapper, rem Remote Procedure Call RpcSs rem DHCP Client Dhcp, rem Windows Event Log eventlog, rem TCP/IP NetBIOS Helper lmhosts rem Application Service AeLookupSvc, rem Application Information Appinfo, rem Certificate Propagation CertPropSvc, rem Group Policy Client gpsvc, rem IKE and AuthIP IPSec Keying Modules IKEEXT, rem Server LanmanServer, rem User Profile Service ProfSvc, rem Task Scheduler Schedule, rem System Event Notification Service SENS, rem Remote Desktop Configuration SessionEnv, rem Shell Hardware Detection ShellHWDetection, rem Windows Management Instrumentation Winmgmt, rem Windows Update wuauserv rem COM+ Event System EventSystem, rem Network List Service netprofm, rem Network Store Interface Service nsi, rem Windows Time W32Time rem Network Connections Netman, rem Distributed Link Tracking Client TrkWks, rem Remote Desktop Services UserMode Port Replicator UmRdpService, rem Desktop Window Manager Session Manager UxSms rem Base Filtering Engine BFE, rem Diagnostic Policy Service DPS rem Cryptographic Services CryptSvc, rem Workstation LanmanWorkstation, rem Network Location Awareness NlaSvc, rem Windows Remote Management WinRM rem Remote Registry RemoteRegistry rem Remote Desktop Services TermService rem IPSec Policy Agent PolicyAgent rem Windows Font Cache Service FontCache Somewhere I read that not all services can run in their own memory, some have to be in shared memory such as EFS. The list above has processes running from a Windows 2008 server. Any suggestions/recommendations from the community. Thanks in advance for your efforts. | |||
|
feedback
|
