windows-7processwindows-servicesprocess-explorer

Svchost: How to make it run only one module per instance of svchost.exe? How to get extended process info?

I have an issue with one of my applications. I run the application, everything is okay. When I close this application, I notice that one of the "svchost" processes in the system takes up about 95-100% of the CPU and I have to figure out what is taking up so much of the CPU cycles.

I set myself pretty simple and straightforward goals on how to go about this:

  1. Get the process info or this particular "svchost" that is taking up so much CPU
  2. I know what an svchost process is used for, so I save you guys the effort to explain me about it. So now I must know which modules are loaded by this rogue svchost.
  3. I ran my application, closed it and made sure that my process is completely closed, not anymore in memory. I then got the PID of the svchost taking up 100% CPU
  4. I ran ProcessExplorer (from sysinternals), got the info about how many and which services this svchost has hosted. They are about 12 services. I would not bother about this list as I am more concerned about How to IDENTIFY which one of these 12 services is taking up the CPU cycles.
  5. Now I have the list with me and here starts the tricky part... I want to do 1 of the 2 options below

Option 1: How do I identify which one of these 12 services is taking up so much CPU? Can I get extended info for this svchost process that gives me detailed info on a "per service" basis hosted in this process, rahter on the process basis that I have now?

Option 2: Is it possible to configure windows to make svchost to run only one service per instance of svchost?

If there is a better option on how to investigate, narrow down the root cause of this issue, please do let me know.

Solution

  • I had answered my question but I put it under comments. I am now adding the same as an answer so it is known.

    I figured out how to do both the options in my question above:

    Solution for option 1:

    Open Resource Monitor (resmon.exe), go to CPU tab, check the svchost.exe (with the PID to watch for) under Image tab, go to "services" box and check for the CPU usage by different services.

    Solution for option 2: 

    sc config <service name> type= own

    Or change in registry HKLM\System\CurrentControlSet\Services\<ServiceName>\Type to 0x10.

    Refer to http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx for more info.