svchost taking up memory
One of my coworkers has been keeping an eye on a couple of Windows Server 2003 boxes at work due to some problems we have had with them. He sent me a screenshot of Task Manager showing a svchost.exe instance using more than 1GB of memory. Unfortunately, by the time I checked the server, the process was gone.
Since svchost.exe can host many things, I did a little research and sent the following command to him to help us identify what’s consuming so much memory:
tasklist /svc /fo list /fi "imagename eq svchost.exe" /fi "memusage gt 1000000"
That will show any svchost.exe processes that are consuming more than 1GB of memory. It will also list all the hosted DLLs so we can track down the culprit. Of course, all the same info is available in Process Explorer, but we don’t have that installed on the box in question (although I am thinking of suggesting that we make that a standard part of our server loadout).
I may also encapsulate the tasklist command above into a Nagios check and run it against all our Windows boxen. That’s what I like about having a flexible monitoring system like Nagios in place. As we find new things to check, we can just add them and the whole thing is automated from that point on.
