tool to isolate the services w/in the svchost process

[Guest]

Hello,
I have an end user who's memory and cpu will suddenly spike. It looks to be
one of the svchost processes (one had it's cpu at 99%). I've got the EU's
task mgr set to show the PID now, so next time we can isolate w/ svchost
process it is.

From searching around, I've found that some of the svchost processes will
have multiple services running within.

I'm wondering if there's a way to isolate these individual services to see
if we can determine if one of them is the culprit.

I found some tools here, and wondering if one of them might do the trick:

http://www.microsoft.com/technet/sysinternals/Processesandthreadsutilities.mspx

EU is on a pc running XP prof. The last time this occurred, EU only had
Outlook, and the Compwatch application running.

Thanks!

 

[Wesley Vogel]

Tasklist.exe does not come with XP Home, only comes with XP Pro, but it can
be downloaded.

To view the list of services that are running in Svchost:
1. Click Start on the Windows taskbar and then click Run.
2. In the Open box, type CMD and then press ENTER.
3. Type Tasklist /SVC and then press ENTER.

Tasklist displays a list of active processes. The /SVC switch shows the list
of active services in each process. You can match up the PID number in Task
Manager. The PID #s change each time you reboot.

The services listed under each Services.exe and Svchost.exe entry are listed
with ServiceName not the DisplayName, i.e. AudioSrv is the Windows Audio
service.

A description of Svchost.exe in Windows XP
http://support.microsoft.com/kb/314056

The sc GetDisplayName command will display the DisplayName for a service.

sc GetDisplayName AudioSrv

Example....
-------------------------
C:\>tasklist /svc

Image Name PID Services
=========================
System Idle Process 0 N/A
System 4 N/A
smss.exe 316 N/A
csrss.exe 356 N/A
winlogon.exe 380 N/A
services.exe 424 Eventlog, PlugPlay
lsass.exe 436 SamSs
svchost.exe 636 RpcSs
svchost.exe 684 AudioSrv, CryptSvc, Dhcp, helpsvc,
LanmanWorkstation, Netman, winmgmt
spoolsv.exe 720 Spooler
avgamsvr.exe 840 Avg7Alrt
uphclean.exe 980 UPHClean
vsmon.exe 1020 vsmon
explorer.exe 1080 N/A
avgcc.exe 1288 N/A
zonealarm.exe 1344 N/A
devldr32.exe 1724 N/A
notepad.exe 176 N/A
MSIMN.EXE 1364 N/A
OEQuoteFix.exe 824 N/A
notepad.exe 1436 N/A
iexplore.exe 172 N/A
cmd.exe 928 N/A
tasklist.exe 1100 N/A
wmiprvse.exe 1564 N/A


C:\>sc GetDisplayName AudioSrv
[SC] GetServiceDisplayName SUCCESS Name = Windows Audio

C:\>sc GetDisplayName LanmanWorkstation
[SC] GetServiceDisplayName SUCCESS Name = Workstation

C:\>sc GetDisplayName PlugPlay
[SC] GetServiceDisplayName SUCCESS Name = Plug and Play

C:\>sc GetDisplayName Netman
[SC] GetServiceDisplayName SUCCESS Name = Network Connections
---------------

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Gerry Cornell]

Jim

What is
http://windowsxp.mvps.org/svchost.htm

Download Process Explorer.

For further information about Process Explorer see here:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

To ascertain which service is causing the problem select the svchost
producing the high CPU usage, right click,
select Properties, Services. Note there are the full names and
some explanation of what each service does.

You will find further information on Services here:
http://majorgeeks.com/page.php?id=12

To trace the particular Service involved you need to turn off each
service in turn and then restore it noting what effect it has on CPU
usage. However, you need to take care and watch what other Services are
dependent on that service. When you click on the Dependencies tab allow
it a little time to display the information.


--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~