svchost.exe -k netsvcs occupying >1GB memory

Question

I have noticed my production server "svchost.exe -k netsvcs" is occupying >1GB ram memory, steadily, which I think is a bit excessive.

This is what tasklist /svc will give me for this process:

                               Appinfo, CertPropSvc, gpsvc, IKEEXT,
                               iphlpsvc, LanmanServer, ProfSvc, Schedule,
                               SENS, SessionEnv, ShellHWDetection,
                               Winmgmt, wuauserv

I was wondering what might be the process listed that is responsible for this memory leak and how to fix it. Has anyone had this same behavior in the past?

Server is running Windows Server 2008 R2 (Build 7601: Service Pack 1) and it's main function is to run in-house application processor workers.

Answer 1

The question is, is it a leak? You're saying that the memory usage is "steady".

Leak = memory usage increases over time, never decreasing, so you have to reload the server every once in a while.

If the taks is staying at ~1 GB for long time (say, two weeks), then the situation is perfectly normal. Modern software is made to use free memory whenever necessary, and I know a few programs that will just grab whatever there is just to save time on memory allocation.

If it doesn't impede system's operation, don't touch it.

Answer 2

Memory allocation is very expensive on the CPU's cycles compared to reusing existing, allocated memory. It is often that once a program starts, until it is finished its function, it will not "let go" of this memory.

For example, Firefox holds memory for some time. If you leave your computer on for a week with Firefox open, you'll notice it will constantly grow in memory size. After YouTubing, Google Play Music-ing, and browsing, mine hits 2-4GB in memory - which shrinks to 300MB after I restart the process. This is because of its caching features, and this behaviour is by design.

I would tend to believe that the SVCHost process is doing exactly as it should. How many services is your server running? 1GB Does not sound concerning - though that depends on which services you're running.

Answer 3

As the next step, if you want to investigate further, I would install process explorer (procexp.exe) which you can find it on the Microsoft site. That will give you what services use this process (see screenshot from procexp) you can then stop/start services and see if a particular service is associated with releasing/acquiring a large memory allocation. It will also tell you if it is Working set or Private (=mainly heap) allocated memory. If it is tied to a specific service then you will have a clearer path to research further.

It goes without saying you would need to do this testing in agreed outage/maintenance window or reproduce on a test server as you will be interrupting normal operations. Reboot and check list of services is back to your normal run set after testing is complete.

Screen shot: