RE: OT: identifying svchost instance in perfmon logs

Hello Xavier,

Thank you for posting here. Let's also thank Claus for the input.

According to your description, I understand that the svchost process high
CPU, and you want to find the instance of this process in performance log.
If I have misunderstood the problem, please don't hesitate to let me know.

Based on my research, I suggest we try the following steps:

1. Find the PID of the svchost process.

You can use the command "tasklist /svc" to list the PID of process. Or, you
can open Windows Task Manager, select Processes tab, click View menu ->
Select Columns, tick the PID, click OK. Then, you will see the PID number
of every process in the Windows Task Manager.

2. Then, you can find the PID number in your performance log.

3. For the svchost process high CPU issue, I suggest you do clean boot to
narrow down:

To clean boot the problematic computer, please use the steps below:
a. Click Start, click Run, and then in the Open box, type "MSCONFIG"
(without the quotation marks). Click OK.

b. In the System Configuration Utility (MSConfig) window, click to select
the Selective Startup button.

c. Click to clear the check mark from the "Load startup items" below
Selective Startup.

d. Click the Services tab, click to check the "Hide All Microsoft Services"
box, and remove all the check marks from the remained Non-Microsoft
Services. Please note that the Exchange services could be marked as
non-Microsoft. Please do not disable those services.

e. Click OK to close the MSConfig window. Click Yes when you are asked to
restart your computer in order to enable the changes.

f. After restarting, please check whether this issue will reoccur.

g. If there are no more problems, please use the above steps to enable
services and startup items one by one in order to figure out the root cause
of this issue.

If we cannot resolve the issue after we perform the above steps, please
help me collect some information for further investigation:

Please let me know the PID of the svchost process and gather MPS report at
same time

a. Download MPSrepot_network from
http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
15706/MPSRPT_NETWORK.EXE

b. Run MPSRPT_NETWORK.exe on the server box.

c. The tool will automatically collect the information. This procedure will
take 10~15 minutes.

d. Open Windows Explorer, navigate to the folder:
%SystemRoot%\MPSReports\Network\Reports\Cab\

e. Send the .cab file directly to me at v-terliu@xxxxxxxxxxxxx

I hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| Reply-To: "Xavier" <xminet@xxxxxxxxxxxxxxxxxxxxxxx>
| From: "Xavier" <xminet@xxxxxxxxxxxxxxxxxxxxxxx>
| Subject: OT: identifying svchost instance in perfmon logs
| Date: Sun, 21 Oct 2007 11:41:08 +0200
| Lines: 14
| Message-ID: <D08A2C03-4257-444E-BBF4-0004AA39906F@xxxxxxxxxxxxx>
| MIME-Version: 1.0
| Content-Type: text/plain;
| format=flowed;
| charset="iso-8859-1";
| reply-type=original
| Content-Transfer-Encoding: 7bit
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Windows Mail 6.0.6000.16480
| X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16545
| X-MS-CommunityGroup-PostID: {D08A2C03-4257-444E-BBF4-0004AA39906F}
| X-MS-CommunityGroup-MessageCategory:
{E4FCE0A9-75B4-4168-BFF9-16C22D8747EC}
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:70614
| NNTP-Posting-Host: TK2MSFTNGHUB02.phx.gbl 127.0.0.1
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Hello,
|
| I am currently investigating a performance problem in a SBS2003
environment.
| I do have perfmon logs and one of the process instances consuming a lot
of
| CPU ressource is referenced as "svchost #2". My assumption is that I
should
| have a look at PIDs of the various svchost instances and that the lowest
one
| would be "svchost", the second lowest would be "svchost #1", etc...
|
| Am I correct ?
|
| Thanks,
|
| Xavier
|
|

.