Trying To Drill Down Into Generic Svchost - Need Help


  1. Posts : 357
    Windows 7 Home Premium 64bit
       #1

    Drilling Down Into Generic Svchost & Isolating A Process


    I know how to

    1. Find out how much memory is being used by each Svchost
    2. Find out what processes are running under each Svchost
    3. Identify the Process ID (PID) for each Svchost

    So the question is:

    If a Svchost has multiple processes running under it how do I find out how much memory each of those processes under a generic svchost is using?

    ================
    I believe I have figured out how to do it but I have a new question at the end of this post.

    1. Click on the Windows world ball
    2. Type "command prompt"
    3. Right click on "command prompt" and run as Adminstrator
    4. At the command prompt first type in "tasklist /svc". This will give you the "Image Name" "PID" and "Process(s)" for each PID (Product Identification Number)
    5. Follow the method described below for each Process that you want to isolate.

    Method 1: Creating an Isolated Process
    What this method really does is modify one of the registry parameters for the service in question from a shared process to an isolated process. The command syntax is fairly straightforward and uses the sc config command set: sc config <service name> type= own. So for Windows Updates (wuauserv), the command would be: sc config wuauserv type= own. Note that there is a space between the '=' and 'own' - you must insert that space.
    6. Reboot
    7. Now repeat steps 1 - 4 below the double dotted line above
    8. Verify that the "Process" that you wanted to isolate has its own PID
    9. Type in Tasklist /FI "PID eq xxxx". Where "xxxx" is the number of the PID that you just isolated. Make sure to type in the quotes as indicated.

    You will now be able to see the memory usage of the process that you just isolated. Note that the image name will still show as "Svchost.exe". To verify that you are looking at the correct PID, you can run "Process Explorer", go the PID in question, right click, left click on Properties, left click on Services and you will see the service that you just isolated.

    --------------------------
    So now my question is:

    Does isolating a service out of a Svchost and creating its own Svchost change the total amount of memory that your system is using? I would think that it would because you are adding an additional Svchost for each process that you isolate. Does anyone know?
    Last edited by Buddahfan; 14 Mar 2011 at 17:45.
      My Computer


  2. Posts : 1,814
    XP / Win7 x64 Pro
       #2

    I would think so as well. Why would you want to do this anyway?
      My Computer


  3. Posts : 357
    Windows 7 Home Premium 64bit
    Thread Starter
       #3

    FliGi7 said:
    I would think so as well. Why would you want to do this anyway?
    1. To see how much memory these services combined in one Svchost are each using.
    2. To see if there are any services that I am not using that are taking up a lot of memory so that I can disable them if they can be safely disabled in Services. No reason to disable them if they are not using much memory. However, for example Windows Defender uses 72MB of memory on my x64 computers so I would disable it if I wasn't benefiting from it.
      My Computer


  4. Posts : 797
    Windows 7 Ultimate (x64)
       #4

    How much RAM (memory) to you have installed on your PC? Is that 4 GB in your specs accurate? How much memory is in use under normal conditions?

    If you boot up your machine and your system uses about 1GB of RAM - this seems to be normal and I would not worry about it. You have plenty. Fine-tuning a few MB won't increase your performance at all. Moreover, even adding more memory might not be beneficial for you, unless you are running some really memory-intensive tasks (HD video editing, etc.). If you really want to increase your performance, you might look into the possibility of getting a SSD, but then I don't know your situation and whether you're actually considering any upgrades that you need to pay for.

    My experience is, disabling service in 7 does not lead to any performance increase. I surely disable some of them, but then those are either really unnecessary (anybody can tell me why the Tablet PC services are active by default on a desktop?) or seem to be a security risk (such as NetBIOS or Remote Registry). Apart from that it seems best to leave the OS alone.

    For your specific question, you might want to use Process Explorer from the Sysinternals suite.
      My Computer


  5. Posts : 5,642
    Windows 10 Pro (x64)
       #5

    You have too much memory to be worrying about what is using your memory.
      My Computer


  6. Posts : 357
    Windows 7 Home Premium 64bit
    Thread Starter
       #6

    1. If you read my post in its entirety you will see that I stated that I use Process Explorer. It does not drill down into Svchost to see how much memory each of the individual services that are linked to it use.

    2. Its not just about memory and performance though that comes into play. For example my Internet Security Suites allows me to use "Persistent Cache" to speed up scans. Having more available physical memory improves the caching. Before going any further let me say that I know that computer performance is a very complicated subject and a lot of things can impact it. However having more free physical memory does not hurt performance.

    3. The main reason for disabling unused services is a security one. The more services and programs that one uses, the greater the chance of having their system compromised. That is the main reason that I use only one Browser. Trying to learn about the security risks inherent in using your Browser and trying to protect those security holes becomes a lot more difficult if you use multiple Browsers.

    It is the same way in personal relationships. It becomes a lot more complicated when you date multiple people especially if you are emotionally involved with more than one person. So to with your computer. The more software programs that we use and become emotionally involved with the more difficult it is too manage them without screwing up and having our computers comprised by the bad stuff out there. Yes, people become emotionally attached to their software programs and computers.

    As they say, "Use it or lose it" or in this case "if you ain't using it lose it".

    In my opinion just like it comes to no good carrying around dead weight on your body and in relationships it also comes to no good having your computer load and run software that you don't use. It is all unnecessary bloatware and having it in your life leads to more bad than good.

    People can argue all day long about my position which is fine. What I can say is that this philosophy works just fine for me.
      My Computer


  7. Posts : 1,814
    XP / Win7 x64 Pro
       #7

    Buddahfan said:
    2. Its not just about memory and performance though that comes into play. For example my Internet Security Suites allows me to use "Persistent Cache" to speed up scans. Having more available physical memory improves the caching. Before going any further let me say that I know that computer performance is a very complicated subject and a lot of things can impact it. However having more free physical memory does not hurt performance.
    It doesn't hurt performance but does it in fact help the security and efficiency of the computer? I don't think you know the answer to this and are playing with fire on this one. Separating a process out into its own separate memory area and parent could certainly affect the level of its security. Compound this with the fact that you're altering the way it has to communicate now with other processes in the svchost parent it came from. You now have introduced more overhead to message passing since it's not sharing the same memory space and inter-process message passing technique.

    Also, do you know how Svchost manages its subprocesses? Do you know if it has a mechanism for preventing unwanted processes from going haywire or becoming compromised in a certain fashion? If it does, you will be losing that by separating a subprocess out.

    There are lot of things you are missing here that don't align with your philosophy of making things better by removing them or separating them. Personally, I think you're getting into a game where the odds of winning by seeing any actual measurable increase is greatly encompassed by the odds of losing by screwing something up that you're not knowledgeable about. I'm all for improving performance, but the reason and way you're going about it is not going to achieve it.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 03:25.
Find Us