This is something that's always bothered me, so I'll ask the Server Fault community.
I love Process Explorer for keeping track of more than just the high-level tasks you get in the Task Manager. But I constantly want to know which of those dozen services hosted in a single process under svchost is making my processor spike.
So… is there any non-intrusive way to find this information out?
Best Answer
Yes, there is an (almost) non-intrusive and easy way:
Split each service to run in its own SVCHOST.EXE process and the service consuming the CPU cycles will be easily visible in Process Explorer (the space after "=" is required):
Do this in a command line window or put it into a BAT script. Administrative privileges are required and a restart of the computer is required before it takes effect.
The original state can be restored by:
Example: to make Windows Management Instrumentation run in a separate SVCHOST.EXE:
This technique has no ill effects, except perhaps increasing memory consumption slightly. And apart from observing CPU usage for each service it also makes it easy to observe page faults delta, disk I/O read rate and disk I/O write rate for each service. For Process Explorer, menu View/Select Columns: tab Process Memory/Page Fault Delta, tab Process Performance/IO Delta Write Bytes, tab Process Performance/IO Delta Read Bytes, respectively.
On most systems there is only one SVCHOST.EXE process that has a lot of services. I have used this sequence (it can be pasted directly into a command line window):