I have noticed my production server "svchost.exe -k netsvcs" is occupying >1GB ram memory, steadily, which I think is a bit excessive.

This is what tasklist /svc will give me for this process:

                               Appinfo, CertPropSvc, gpsvc, IKEEXT,
                               iphlpsvc, LanmanServer, ProfSvc, Schedule,
                               SENS, SessionEnv, ShellHWDetection,
                               Winmgmt, wuauserv

I was wondering what might be the process listed that is responsible for this memory leak and how to fix it. Has anyone had this same behavior in the past?

Server is running Windows Server 2008 R2 (Build 7601: Service Pack 1) and it's main function is to run in-house application processor workers.

  • I do have SP1 installed, but now that you talked about it... support.microsoft.com/kb/977357 get-hotfix -id KB977357 get-hotfix : Cannot find the requested hotfix on the 'localhost' computer. If I have SP1 installed shouldn't I have this hotfix installed?
    – agentsvr
    Commented Apr 3, 2014 at 13:14
  • 1
    The service pack rolls up the hotfix with it, so you won't find it listed.
    – Nathan C
    Commented Apr 3, 2014 at 14:03
  • 4
    OK. Well I would say the next step is to find out which exact service is consuming the memory, and the only way to do that is to break them out into their own svchost.exe processes one at a time by using SC Config Servicename Type= own. See serverfault.com/questions/12278/…
    – Ryan Ries
    Commented Apr 3, 2014 at 15:09
  • Are you sure the process is the legit svchost.exe? Commented May 10, 2015 at 10:10
  • You could also just stop / kill the services one at a time and see when the mem usage drops. Commented Jul 20, 2015 at 4:35

3 Answers 3


The question is, is it a leak? You're saying that the memory usage is "steady".

Leak = memory usage increases over time, never decreasing, so you have to reload the server every once in a while.

If the taks is staying at ~1 GB for long time (say, two weeks), then the situation is perfectly normal. Modern software is made to use free memory whenever necessary, and I know a few programs that will just grab whatever there is just to save time on memory allocation.

If it doesn't impede system's operation, don't touch it.


Memory allocation is very expensive on the CPU's cycles compared to reusing existing, allocated memory. It is often that once a program starts, until it is finished its function, it will not "let go" of this memory.

For example, Firefox holds memory for some time. If you leave your computer on for a week with Firefox open, you'll notice it will constantly grow in memory size. After YouTubing, Google Play Music-ing, and browsing, mine hits 2-4GB in memory - which shrinks to 300MB after I restart the process. This is because of its caching features, and this behaviour is by design.

I would tend to believe that the SVCHost process is doing exactly as it should. How many services is your server running? 1GB Does not sound concerning - though that depends on which services you're running.


As the next step, if you want to investigate further, I would install process explorer (procexp.exe) which you can find it on the Microsoft site. That will give you what services use this process (see screenshot from procexp) you can then stop/start services and see if a particular service is associated with releasing/acquiring a large memory allocation. It will also tell you if it is Working set or Private (=mainly heap) allocated memory. If it is tied to a specific service then you will have a clearer path to research further.

It goes without saying you would need to do this testing in agreed outage/maintenance window or reproduce on a test server as you will be interrupting normal operations. Reboot and check list of services is back to your normal run set after testing is complete.

Screen shot: http://i.imgur.com/20Ij6Mi.png

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .