]> Memory leaks on svchost 🌐:aligrant.com

Memory leaks on svchost

Alastair Grant | Wednesday 4 November 2009

I've been seeing odd activity for a while with svchost choking massive amounts of memory on a server. We're talking about over 3GB of memory being consumed.

svchost is a process that contains a whole bunch of Windows services. I believe the idea is to save memory overall by allowing multiple services run under the same process.

The problem with this is, if one springs a regular leak, you've got no-way of troubleshooting which service, or clearing it. The only way to clear a memory leak is to kill the process (as by definition, the application no longer has a handle on it, so recycling individual services won't have any affect). Naturally, killing all your Windows services is generally not a good idea.

Though you can split the services out into their own process spaces with some commands.

tasklist /SVC /FI "imagename eq svchost.exe"

This will list all services contained within processes (you'll have to match your PIDs up with the one using the most memory).

You can then unshare the services one-at-a-time by using:

SC Config [service name] Type= own

You'll need to do this for each service listed under a shared svchost instance; and then reboot. You can reverse the change by changing "own" to "share".

I narrowed my problem down to Automatic Updates.



Breaking from the voyeuristic norms of the Internet, any comments can be made in private by contacting me.