DNS Client and svchost.exe 100% load

[Guest]

I have seen svchost.exe using 100% of the cpu on some computers since early
last year. Then, I simply turn off DNS Client service and the spike in cpu
load will stop, and if I disable that service, the svchost.exe issue will not
recur.

How is DNS Client related to WSUS?

What is the implications of turning off DNS Client service?

Can this be considered as a alternative workaround for the svchost.exe issue?

 

[Rock]

I have seen svchost.exe using 100% of the cpu on some computers since early
last year. Then, I simply turn off DNS Client service and the spike in cpu
load will stop, and if I disable that service, the svchost.exe issue will
not
recur.

How is DNS Client related to WSUS?

What is the implications of turning off DNS Client service?

Can this be considered as a alternative workaround for the svchost.exe
issue?

FYI for WSUS, there is a newsgroup for that.
http://www.microsoft.com/communitie...618-654f-417c-a502-a30ca34cb9f7&lang=en&cr=us

 

[CreateWindow]

Hi,

DNS client is usually well behaved and is most cases not needed. But, leave
it running, I do .

However you may have the recent svchost problem if you have 100% CPU load
showing on svchost.
An unintentional bug introduced by Windows Update.

First you need reboot and login. Then as *fast as possible* stop the
Automatic Updates service before your PC becomes unusable.

Start / Run -type in -> net stop wuauserv and click ok.

OK now relax...

1) You need to download and install the new update client:
http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe

2) Then this patch:
http://support.microsoft.com/?kbid=927891

After applying the above updates - svchost still runs high CPU usage
*but* not 100% only 88 - to 97 % and drops down more often. The PC is
quite responsive compared to the old 100% lockups.
WSUS client uses DNS as per normal name resolution for the http server and
port of your WSUS machine.
Hope that helps?

CreateWindow
http://mymessagetaker.com
Stop using those paper phone message pads
make the computer work for you.
http://justpageprobe.com
The FREE Web page utility you always wanted.
Monitor your enterprise Web Servers.
Keep your router connected.
Email your IP to where you need it.

 

[MaHaBone]

I have seen svchost.exe using 100% of the cpu on some computers since early
last year. Then, I simply turn off DNS Client service and the spike in cpu
load will stop, and if I disable that service, the svchost.exe issue will
not
recur.

How is DNS Client related to WSUS?

What is the implications of turning off DNS Client service?

Can this be considered as a alternative workaround for the svchost.exe
issue?

So, why is one of the Svchosts taking all your CPU?

And what can you do about it?

Continue reading: "How do I fix this high CPU usage svchost virus or
whatever it is?"
http://ask-leo.com/how_do_i_fix_this_high_cpu_usage_svchost_virus_or_whatever_it_is.html

 

[Guest]

It seems the finger is often pointed to windows update whenever this issue is
encountered, and yet hotfix kb927891 and re-registering windows update
components do not resolve the issue in some cases.

This is the curious part. When I encountered this issue more than a year
ago, I used the workaround of disabling DNS Client service and the issue was
resolved. Only recently when I reinstalled XP SP2 on one of my pcs did I
faced this issue again. I applied the same workaround as I had done
previously and it works.

I do not know why disabling client-side dns caching has the effect of
stopping the svchost.exe from hogging the cpu (normally it should increase
cpu load slightly due to more dns queries). The svchost.exe will not cause
the cpu to spike whenever DNS Client is disabled.

Hence, I am checking with the discussion board whether this svchost issue
has anything to do with dns caching.

 

[Guest]

After applying the above updates - svchost still runs high CPU usage
*but* not 100% only 88 - to 97 % and drops down more often. The PC is
quite responsive compared to the old 100% lockups.
WSUS client uses DNS as per normal name resolution for the http server and
port of your WSUS machine.
Hope that helps?

Hi CreateWindow,

Thanks for the advice and info.

Do you still have the svchost.exe running at 50% to 90%?

Can you try turning off DNS Client and see what is the effect on svchost.exe?

I'm curious to know more.

 

[Guest]

After applying the above updates - svchost still runs high CPU usage
*but* not 100% only 88 - to 97 % and drops down more often. The PC is
quite responsive compared to the old 100% lockups.
WSUS client uses DNS as per normal name resolution for the http server and
port of your WSUS machine.
Hope that helps?

CreateWindow
http://mymessagetaker.com

After doing testing on affected pcs, I could see the msi.dll/wuaueng.dll
hogging the cpu at 50% for about a minute or more before all is clear, which
seems ok to me.

Intial motivation for creating this thread was because I never encounter the
100% lockup after using the dns client workaround. But I don't think this is
the case now so I considered this thread answered.

Thanks CreateWindow and MaHaBone for the info; it is really either turning
off au or letting the process go on for a while at half load.

 

[Jim Byrd]

Hi Atlanticus - the most usual cause recently for the 100% svchost usage is
a problem with the Windows Update Service which is fixed by upgrading to the
Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available
here:
http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe
and installing the updated KB927891 hotfix, here:
http://support.microsoft.com/?kbid=927891 for a complete fix.


In the case that you are seeing associated with the DNS Client, I would
suspect a long known issue that occurs when using a HOSTS file for ad
blocking. See the discussion here:
http://www.mvps.org/winhelp2002/hosts.htm . If you are using a HOSTS file,
then it's normally best to just Disable the DNS Client Service.


--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In atlanticus <[email protected]> typed:
|| "CreateWindow" wrote:
||
||| After applying the above updates - svchost still runs high CPU usage
||| *but* not 100% only 88 - to 97 % and drops down more often. The PC
||| is quite responsive compared to the old 100% lockups.
||| WSUS client uses DNS as per normal name resolution for the http
||| server and port of your WSUS machine.
||| Hope that helps?
|||
||| CreateWindow
||| http://mymessagetaker.com
||
|| After doing testing on affected pcs, I could see the
|| msi.dll/wuaueng.dll hogging the cpu at 50% for about a minute or
|| more before all is clear, which seems ok to me.
||
|| Intial motivation for creating this thread was because I never
|| encounter the 100% lockup after using the dns client workaround. But
|| I don't think this is the case now so I considered this thread
|| answered.
||
|| Thanks CreateWindow and MaHaBone for the info; it is really either
|| turning off au or letting the process go on for a while at half load.

 

[Guest]

Hi Jim. That might be possible in my case. Thanks.

I installed the hotfix and update agent on 2 machines to test without any
custom hosts file in use.

For a P4 machine, svchost.exe/msi.dll will max out at 50% of cpu at startup
for a min or so, or if I run Microsoft Update manually, for the duration of
the update check.

For a celeron machine, svchost/msi.dll runs at about 70-90% of cpu at
startup for a minute or so, or when using Microsoft Update.

Moreoever, automatic updates do not often cause svchost to take up resources
at startup. It can be dormant for a few restarts too.

At least I don't see any 100% lockup and more leeway for other processes to
run concurrently but automatic updates can still take up quite a bit of
resources, esp. for slower machines.

Just some comments, if they are any helpful.

 

[Jim Byrd]

Hi Atlanticus - You may _still_ see high svchost usage, but with these new
components the machine should, however, remain responsive:

From a posting by Sudheer GN of Microsoft -

"Hi,
The biggest difference in WSUS 3.0 client (wrt performance) is that the
machines will still be responsive when WU client scans for updates. There
are also some optimization to reduce the number of update evaluations and
that will reduce the scan time in some scenarios.
It is still expected that CPU usage will be high so that the scan can
complete in lesser amount of time. But other applications can be launched
and used (they will still be a little sluggish because CPU is being shared
with WU client)

--
Sudheer GN
Microsoft, WU Client

This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm"


--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In atlanticus <[email protected]> typed:
|| Hi Jim. That might be possible in my case. Thanks.
||
|| I installed the hotfix and update agent on 2 machines to test
|| without any custom hosts file in use.
||
|| For a P4 machine, svchost.exe/msi.dll will max out at 50% of cpu at
|| startup for a min or so, or if I run Microsoft Update manually, for
|| the duration of the update check.
||
|| For a celeron machine, svchost/msi.dll runs at about 70-90% of cpu at
|| startup for a minute or so, or when using Microsoft Update.
||
|| Moreoever, automatic updates do not often cause svchost to take up
|| resources at startup. It can be dormant for a few restarts too.
||
|| At least I don't see any 100% lockup and more leeway for other
|| processes to run concurrently but automatic updates can still take
|| up quite a bit of resources, esp. for slower machines.
||
|| Just some comments, if they are any helpful.
||
|| "Jim Byrd" wrote:
||
||| Hi Atlanticus - the most usual cause recently for the 100% svchost
||| usage is a problem with the Windows Update Service which is fixed
||| by upgrading to the Windows Update Agent 3.0, v. 7.0.6000.374, for
||| 32 bit machines is available here:
|||
http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe
||| and installing the updated KB927891 hotfix, here:
||| http://support.microsoft.com/?kbid=927891 for a complete fix.
|||
|||
||| In the case that you are seeing associated with the DNS Client, I
||| would suspect a long known issue that occurs when using a HOSTS
||| file for ad blocking. See the discussion here:
||| http://www.mvps.org/winhelp2002/hosts.htm . If you are using a
||| HOSTS file, then it's normally best to just Disable the DNS Client
||| Service.
|||
|||
||| --
||| Regards, Jim Byrd,
||| My Blog, Defending Your Machine,
||| http://defendingyourmachine2.blogspot.com/