WSUS 3 SP1 -svchost.exe remains at high memory usage on XP SP2

Problem:
svchost.exe remains at high memory usage on Windows XP computer.
========
Environment:
DELL GX520; RAM 1.24 GB; CPU 2.80GHZ;
Window! s XP SP3
Internet Explorer 6 SP3
WSUS 3 SP1
==========
Environment change:
Upgrade WSUS 2 to WSUS 3 SP1
=========
Information/Diagnostic:
1. view tasklist:
Image name Mem Usage
svchost.exe - over 100,000 K
=======
Error:
(something like) "...virtual memory low..."


--
On the search

"MoMo" <> wrote in message
news:53810173-FF16-4F84-B998-...
> Problem:
> svchost.exe remains at high memory usage on Windows XP computer.
> ========
> Environment:
> DELL GX520; RAM 1.24 GB; CPU 2.80GHZ;
> Window! s XP SP3
> Internet Explorer 6 SP3
> WSUS 3 SP1
> ==========
> Environment change:
> Upgrade WSUS 2 to WSUS 3 SP1
> =========
> Information/Diagnostic:
> 1. view tasklist:
> Image name Mem Usage
> svchost.exe - over 100,000 K
> =======
> Error:
> (something like) "...virtual memory low..."


By posting in the WU NG are you implying that it is the
Automatic Updates service which is causing this symptom?
Since the svchost.exe that that service normally runs in is shared
by many other services, how would you know?

Tip: use Process Explorer as an easy way to get more detail
about the svchost.exe process. Unfortunately I don't know of
any way to break out the virtual memory used by a single service.

BTW even if you do suspect the WU service I think you would be
more likely to find help in a newsgroup which specializes in performance
for your OS...

Oh. You're asking about WSUS? Does it have its own svchost.exe?
(You're in the wrong newsgroup for it too.) I was about to cross-post
to XP's Perf & Maint but if there is a separate svchost.exe that
WSUS specialists would know about you might be better off going
to the WSUS NG instead.


Good luck

Robert Aldwinckle
---


>
>
> --
> On the search

An application called Process Explorer will allow you to 'see' inside the
svchost process.
Bill

"Robert Aldwinckle" wrote:

> "MoMo" <> wrote in message
> news:53810173-FF16-4F84-B998-...
> > Problem:
> > svchost.exe remains at high memory usage on Windows XP computer.
> > ========
> > Environment:
> > DELL GX520; RAM 1.24 GB; CPU 2.80GHZ;
> > Window! s XP SP3
> > Internet Explorer 6 SP3
> > WSUS 3 SP1
> > ==========
> > Environment change:
> > Upgrade WSUS 2 to WSUS 3 SP1
> > =========
> > Information/Diagnostic:
> > 1. view tasklist:
> > Image name Mem Usage
> > svchost.exe - over 100,000 K
> > =======
> > Error:
> > (something like) "...virtual memory low..."
>
>
> By posting in the WU NG are you implying that it is the
> Automatic Updates service which is causing this symptom?
> Since the svchost.exe that that service normally runs in is shared
> by many other services, how would you know?
>
> Tip: use Process Explorer as an easy way to get more detail
> about the svchost.exe process. Unfortunately I don't know of
> any way to break out the virtual memory used by a single service.
>
> BTW even if you do suspect the WU service I think you would be
> more likely to find help in a newsgroup which specializes in performance
> for your OS...
>
> Oh. You're asking about WSUS? Does it have its own svchost.exe?
> (You're in the wrong newsgroup for it too.) I was about to cross-post
> to XP's Perf & Maint but if there is a separate svchost.exe that
> WSUS specialists would know about you might be better off going
> to the WSUS NG instead.
>
>
> Good luck
>
> Robert Aldwinckle
> ---
>
>
> >
> >
> > --
> > On the search
>
>
>

"Bill" <> wrote in message
news:96CD5887-3DC0-41A2-8DB1-...
> An application called Process Explorer will allow you to 'see' inside the
> svchost process.
> Bill
>


So, Bill, do you have an answer for my implied question about querying
virtual memory used by a service within a shared svchost.exe? ; )


---


> "Robert Aldwinckle" wrote:

>> Tip: use Process Explorer as an easy way to get more detail
>> about the svchost.exe process. Unfortunately I don't know of
>> any way to break out the virtual memory used by a single service.

....

Robert,
I am having an issue very similar issue to "MoMo," and I just wanted to say
that your remark here about your "implied question" was not at all productive
in resolving the actual issue. I have used Process Explorer for about a month
now (I downloaded it upon noticing the svchost.exe process running with a
dramatic increase in Virtual Memory), and I am not any farther ahead in
resolving the issue than when I started. Process Explorer gives me a myriad
of information about the process itself (most particularly a laundry-list of
services related to the process that I will input below). Since you're so
smart, and it's so obviously implied, why didn't you just go ahead and detail
how to query virtual memory usage?

_
Related Services as indicated by Process Explorer (wish I could've just
copy/pasted a screenshot):
Automatic Updates [wuauserv]
COM+ event System [EventSystem]
Computer Browser [Browser]
Cryptographic Services [CryptSvc]
DHCP Client [Dhcp]
Distributed Link Tracking Client [ERSvc]
Fast User Switching Compatibility [FastUserSwitchingCompatibility]
Help and Support [helpsvc]
Logical Disk Manager [dmserver]
Network Connections [Netman]
Network Location Awareness (NLA) [Nla]
Remote Access Connection Manager [RasMan]
Secondary Logon [seclogon]
Security Center [wscsvc]
Server [lanmanserver]
Shell Hardware Detection [ShellHWDetection]
System Event Notification [SENS]
System Restore Service [srservice]
Task Scheduler [Schedule]
Telephony [TapiSrv]
Themes [Themes]
Windows Audio [AudioSrv]
Windows Firewall/Internet Connection Sharing (ICS) [SharedAccess]
Windows Management Instrumentation [winmgmt]
Windows Time [W32Time]
Wireless Zero Configuration [WZCSVC]
Workstation [lanmanworkstation]
_

Having hand-typed all of that out there, wtf is all that doing running
masked behind a svchost.exe "Generic Host Process"?!?! What started this
occurance? What can we really do about it? It certainly explains why the
process is using so much Virtual Memory, but isn't this just the kind of bad
business that is shying people away from Windows as an OS?

"Robert Aldwinckle" wrote:

> "Bill" <> wrote in message
> news:96CD5887-3DC0-41A2-8DB1-...
> > An application called Process Explorer will allow you to 'see' inside the
> > svchost process.
> > Bill
> >
>
>
> So, Bill, do you have an answer for my implied question about querying
> virtual memory used by a service within a shared svchost.exe? ; )
>
>
> ---
>
>
> > "Robert Aldwinckle" wrote:
>
> >> Tip: use Process Explorer as an easy way to get more detail
> >> about the svchost.exe process. Unfortunately I don't know of
> >> any way to break out the virtual memory used by a single service.
>
> ....
>
>
>

Richard Harty wrote:

> Having hand-typed all of that out there, wtf is all that doing running
> masked behind a svchost.exe "Generic Host Process"?!?!

Having multiple services in a single process uses far less memory and other
system resources than having a separate process for each service.

Harry.

Harry,
None of those services were running in a process at all. Now, they
collectively absorb roughly 14-21% of my available virtual memory. Why? I've
posed this question all over different tech forums, and no one has a BS-free
answer. My answer is that it just simply is exactly that, BS, and I'm getting
really sick of Microsoft doing this type of thing. This method of business is
exactly why I am unwilling to go ahead and give them anymore of my money yet
to upgrade my personal system to the also well-discussed horrors of Vista
(AAAAAHHHHH!!!!!!). Just the mentioning of it sends shivers and goosebumps to
any truly computer literate consumer. That's a big part of why Microsoft is
losing so much private-sector business. They no longer inspire any confidence
in their products. Still, no one yet has been able to tell me what to do to
correct this most current issue with svchost, except of course the
advertising agents of this product or that product to use their trial (that
doesn't actually do anything) so that I will buy their company's software.
BTW: WTF ever happened to solid freeware that got the job done? But that is
just a rant for another time...

"Harry Johnston [MVP]" wrote:

> Richard Harty wrote:
>
> > Having hand-typed all of that out there, wtf is all that doing running
> > masked behind a svchost.exe "Generic Host Process"?!?!
>
> Having multiple services in a single process uses far less memory and other
> system resources than having a separate process for each service.
>
> Harry.
>

Richard Harty wrote:

> Harry,
> None of those services were running in a process at all.

All services (arguably excepting device drivers) run in a process, either shared
or separate.

> Now, they collectively absorb roughly 14-21% of my available virtual memory. Why?

If by this you mean that the Virtual Size of the process (as shown by Process
Explorer) is 14-21% of the commit charge, that would seem to be within normal
parameters. I've just checked on a couple of machines, on one that instance of
svchost.exe is using about 100M, with a total commit charge for the system of
500M, on the other it's using just over 200M with a total commit charge of about
700M. Note that because multiple processes can share DLLs, the commit charge is
not equal to the total of the virtual sizes for all processes in the system.

If this isn't what you meant, please advise.

Harry.

I literally meant virtual memory, not commit charge. Look at your columns
that can be selected under the file menu "View" in Windows Task Manager.

"Harry Johnston [MVP]" wrote:

> Richard Harty wrote:
>
> > Harry,
> > None of those services were running in a process at all.
>
> All services (arguably excepting device drivers) run in a process, either shared
> or separate.
>
> > Now, they collectively absorb roughly 14-21% of my available virtual memory. Why?
>
> If by this you mean that the Virtual Size of the process (as shown by Process
> Explorer) is 14-21% of the commit charge, that would seem to be within normal
> parameters. I've just checked on a couple of machines, on one that instance of
> svchost.exe is using about 100M, with a total commit charge for the system of
> 500M, on the other it's using just over 200M with a total commit charge of about
> 700M. Note that because multiple processes can share DLLs, the commit charge is
> not equal to the total of the virtual sizes for all processes in the system.
>
> If this isn't what you meant, please advise.
>
> Harry.
>

Richard Harty wrote:

> I literally meant virtual memory, not commit charge. Look at your columns
> that can be selected under the file menu "View" in Windows Task Manager.

OK, that's more significant. Oddly enough I can't find an equivalent for VM
Size in Process Explorer, but never mind.

Probably the only way to determine which service is using the bulk of the memory
is to shut them down one at a time and see if the VM Size drops. Looks like the
only one that can't be shut down is the Secondary Logon service, and that's
unlikely to be the culprit. (If you want to test it, disable it and restart the
computer.)

Is the VM Size for that instance of svchost.exe that high as soon as the
computer starts up, or does it build up over time?

Harry.