How to troubleshoot svchost.exe high memeory usage in windows servers
When we are dealing with Microsoft windows servers, one of the most frequent issues we observe is that, sometimes the server’s memory usage will be very high and when we check it out we will see that it is caused by a process called svchost.exe. At this moment it is difficult to confirm that svchost is the culprit because svchost service will contain many other processes which might be causing the high memory usage. What we need to do is, to split out processes that is inside the svchost.exe and we can find out which particular process is leaking the memory.
Step 1 : Download process Explorer from https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx
Step 2 : Login to the server copy the Process explorer you downloaded in step 1
Step 3 : Open Process explorer and sort the listing according to the memory column
Step4 : Expand svchost.exe process and you will be able to see the sub processes inside it.
Step 5 : As we see a single svchost process uses the most memory, open an elevated CMD and enter the following commands
Sc config aelookupsvc type= own
Sc config BITS type= own
Sc config CertPropSvc type= own
Sc config gpsvc type= own
Sc config IKEEXT type= own
Sc config Iphlpsvc type= own
Sc config LanmanServer type= own
Sc config ProfSvc type= own
Sc config Schedule type= own
Sc config SENS type= own
Sc config SessionEnv type= own
Sc config ShellHWDetection type= own
Sc config Winmgmt type= own
Sc config wuauserv type= own
Above commands will separate processes from svchost. But some processes will take effect after a reboot.
Once after the reboot we can now monitor the single instances of svchost for memory usage and point out the real culprit. Cheers !