Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have noticed my production server "svchost.exe -k netsvcs" is occupying >1GB ram memory, steadily, which I think is a bit excessive.

This is what tasklist /svc will give me for this process:

                               Appinfo, CertPropSvc, gpsvc, IKEEXT,
                               iphlpsvc, LanmanServer, ProfSvc, Schedule,
                               SENS, SessionEnv, ShellHWDetection,
                               Winmgmt, wuauserv

I was wondering what might be the process listed that is responsible for this memory leak and how to fix it. Has anyone had this same behavior in the past?

Server is running Windows Server 2008 R2 (Build 7601: Service Pack 1) and it's main function is to run in-house application processor workers.

share|improve this question
I do have SP1 installed, but now that you talked about it... get-hotfix -id KB977357 get-hotfix : Cannot find the requested hotfix on the 'localhost' computer. If I have SP1 installed shouldn't I have this hotfix installed? – agentsvr Apr 3 '14 at 13:14
The service pack rolls up the hotfix with it, so you won't find it listed. – Nathan C Apr 3 '14 at 14:03
OK. Well I would say the next step is to find out which exact service is consuming the memory, and the only way to do that is to break them out into their own svchost.exe processes one at a time by using SC Config Servicename Type= own. See… – Ryan Ries Apr 3 '14 at 15:09
Are you sure the process is the legit svchost.exe? – Konrad Gajewski May 10 at 10:10
You could also just stop / kill the services one at a time and see when the mem usage drops. – ssnobody Jul 20 at 4:35

3 Answers 3

The question is, is it a leak? You're saying that the memory usage is "steady".

Leak = memory usage increases over time, never decreasing, so you have to reload the server every once in a while.

If the taks is staying at ~1 GB for long time (say, two weeks), then the situation is perfectly normal. Modern software is made to use free memory whenever necessary, and I know a few programs that will just grab whatever there is just to save time on memory allocation.

If it doesn't impede system's operation, don't touch it.

share|improve this answer

As the next step, if you want to investigate further, I would install process explorer (procexp.exe) which you can find it on the Microsoft site. That will give you what services use this process (see screenshot from procexp) you can then stop/start services and see if a particular service is associated with releasing/acquiring a large memory allocation. It will also tell you if it is Working set or Private (=mainly heap) allocated memory. If it is tied to a specific service then you will have a clearer path to research further.

It goes without saying you would need to do this testing in agreed outage/maintenance window or reproduce on a test server as you will be interrupting normal operations. Reboot and check list of services is back to your normal run set after testing is complete.

Screen shot:

share|improve this answer

Memory allocation is very expensive on the CPU's cycles compared to reusing existing, allocated memory. It is often that once a program starts, until it is finished its function, it will not "let go" of this memory.

For example, Firefox holds memory for some time. If you leave your computer on for a week with Firefox open, you'll notice it will constantly grow in memory size. After YouTubing, Google Play Music-ing, and browsing, mine hits 2-4GB in memory - which shrinks to 300MB after I restart the process. This is because of its caching features, and this behaviour is by design.

I would tend to believe that the SVCHost process is doing exactly as it should. How many services is your server running? 1GB Does not sound concerning - though that depends on which services you're running.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.