How to troubleshoot svchost.exe high memeory usage in windows servers

When we are dealing with Microsoft windows servers, one of the most frequent issues we observe is that, sometimes the server’s memory usage will be very high and when we check it out we will see that it is caused by a process called svchost.exe. At this moment it is difficult to confirm that svchost is the culprit because svchost service will contain many other processes which might be causing the high memory usage. What we need to do is, to split out processes that is inside the svchost.exe and we can find out which particular process is leaking the memory.

Step 1 : Download process Explorer from https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx

Step 2 :  Login to the server copy the Process explorer you downloaded in step 1

Step 3 :  Open Process explorer and sort the listing according to the memory column

Step4 : Expand svchost.exe process and you will be able to see the sub processes inside it.

Step 5 : As we see a single svchost process uses the most memory, open an elevated CMD and enter the following commands

Sc config aelookupsvc type=  own

Sc config BITS type=  own

Sc config CertPropSvc type=  own

Sc config gpsvc type=  own

Sc config IKEEXT type=  own

Sc config Iphlpsvc type=  own

Sc config LanmanServer type=  own

Sc config ProfSvc type=  own

Sc config Schedule type=  own

Sc config SENS type=  own

Sc config SessionEnv type=  own

Sc config ShellHWDetection type=  own

Sc config Winmgmt type=  own

Sc config wuauserv type=  own

Above commands will separate processes from svchost. But some processes will take effect after a reboot.

Once after the reboot we can now monitor the single instances of svchost for memory usage and point out the real culprit. Cheers !