locked
svchost.exe, 100% CPU load RRS feed

  • Question

  • Hello all,

    we are having a really weird problem with our 2008r2 servers.

    In the morning our nagios system was warning the CPU load of our 30 windows server (only 2008r2).

    So we toke a look at the servers and on all of them the CPU was used by 100% by the svchost.exe.

    We tried to locate the problem and deactivated the BITS and the windows updates service. After this the CPU was working normal. But every time when we started the update again the CPU was working with 100% again.

    We had this one month before but didn't know why this was happening.

    The servers are configured to automatically update. Located on different location with direct connection to microsoft update. (no wsus).

    Did anyone of you had a problem like this before?

    Wednesday, August 12, 2015 3:23 PM

Answers

  • Hi Dr34mp,

    We experienced exactly the same problem on all our WS2008R2 & WS2008 servers.

    The virtual servers on vSphere suffered the most in performance.

    svchost.exe used 100% cpu time for ca. 20~30 minutes once or twice a day

    When we looked which service caused this, we could see that it was every time the wuauserv (windows update) service.

    We also do not use WSUS

    This problem started for us in July.
    The cause of this problem was probably a bad update out of the June or May updates.
    We patch our servers in a 2 month cycle..

    Last weekend we patched our servers with the July & August updates.

    After these patches the problem has been solved for us.
    We are monitoring our servers closely but the problem did not occur anymore.

    Cheers,

    Marc

    • Proposed as answer by Leo Han Wednesday, September 2, 2015 4:35 AM
    • Marked as answer by Leo Han Monday, September 7, 2015 1:11 AM
    Tuesday, August 25, 2015 8:06 AM

All replies

  • We are having the exact same issue in our environment. This started mid July for us. We have several dozen servers, all Windows 2008 R2 SP1 or SBS 2011 in multiple physical locations and environments, that between 12PM and 2PM EST svchost.exe spikes CPU usage to 100% until we stop the WUAUSRV service from running. The pid that shows the usage is the WUAUSRV service. We have tried multiple hotfixes, updates and registry edits without any fix. At this point we are simply disabling WUAUSRV for most of the day so it doesn't kill our client's servers. We desperately need a fix for this or we are going to have to migrate dozens of servers to Server 2012.  

    We don't use WSUS and don't have the servers automatically search or install updates. We push updates using a remote management software.




    • Edited by Danjo1985 Wednesday, August 12, 2015 5:55 PM
    Wednesday, August 12, 2015 5:53 PM
  • So it must be an buggy update from July. The workaround with the deactivation and the management software is nice. But there must be a solution to this problem.

    Thursday, August 13, 2015 8:32 AM
  • Hi Dr34mp,

    Here is a blog talking about the issue, check if it helps.

    Automatic Update causes SVCHOST.exe high CPU:
    http://blogs.technet.com/b/asiasupp/archive/2007/05/29/automatic-update-causes-svchost-exe-high-cpu.aspx

    Best Regards,

    Leo


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Thursday, August 13, 2015 8:43 AM
  • Hi Leo,

    the blog is from the year 2007... Most of the links are not working.

    Also I think there must be a lot of changes from the system architecture since the year 2007?

    As I can read in the comments the blog does not help at all. Besides this everything was working before since we had this issue in the previous month.

    Thursday, August 13, 2015 10:07 AM
  • Most of the links in that article are dead. I tried manually updating the to the newest version of the Windows Update Agent when I found that article last week, 7. something, however it didn't make a difference.  Our servers aren't using WSUS either. If you check the comments on that article you posted people are actually commenting on seeing the issue starting to show up again in May of 2015. Microsoft needs to take a look at this.
    Thursday, August 13, 2015 1:36 PM
  • Hi Dr34mp,

    I have seen a similar case and the issue was solved according to the following blog:
    Getting Started with SVCHOST.EXE Troubleshooting:
    http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx

    Best Regards,

    Leo


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Friday, August 14, 2015 3:16 AM
  • Thanks for the link. I will take a look at it.

    But as Danjo wrote Microsoft should also take a look at this problem because it came with some of the last updates.

    Monday, August 17, 2015 12:27 PM
  • Hi Dr34mp,

    I have seen a similar case and the issue was solved according to the following blog:
    Getting Started with SVCHOST.EXE Troubleshooting:

    Best Regards,

    Leo


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    This is kind of a pointless article. Its simply how to figure out what service tied to svchost.exe is causing the run away usage which we already have. We can isolate the service using that article and lower its priority so it doesn't take as much processing power, but that is just a work around that doesn't solve the root issue for why wuausrv is going crazy in the first place. We need something more recent then 2008, this is a new issue caused by some windows update in the last 6 - 8 weeks.

    • Edited by Danjo1985 Tuesday, August 18, 2015 8:31 PM
    Tuesday, August 18, 2015 8:31 PM
  • I would suggest starting with this update which is to fix some Server 2008/Windows 7 update issues https://support.microsoft.com/en-us/kb/3075851


    Britt

    Wednesday, August 19, 2015 6:09 AM
  • Hi Dr34mp,

    I have seen a similar case and the issue was solved according to the following blog:
    Getting Started with SVCHOST.EXE Troubleshooting:

    Best Regards,

    Leo


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    This is kind of a pointless article. Its simply how to figure out what service tied to svchost.exe is causing the run away usage which we already have. We can isolate the service using that article and lower its priority so it doesn't take as much processing power, but that is just a work around that doesn't solve the root issue for why wuausrv is going crazy in the first place. We need something more recent then 2008, this is a new issue caused by some windows update in the last 6 - 8 weeks.

    I can only agree with Danjo1985. I will try the update from Britt Adams out. But the problem should be fixed with a new update and not with another workaround.
    Monday, August 24, 2015 1:00 PM
  • Please, let us know if this works. I tried the July update without it making any difference before i posted here. 
    Monday, August 24, 2015 6:12 PM
  • At the moment I have too that symptom too, and the Windows Update to get the new Windows Update agent did nothing. I suspect a new update will come soon. As soon I can get some new I let you know guys.

    I tried to flush the Software Distribution's folder, the CPU is less, but it's impacting the server for a long time anyhow.

    As a fallback I will try with a small WSUS's server, to see if the symptom occur.


    Regards, Philippe

    Don't forget to mark as answer or vote as helpful to help identify good information. ( linkedin endorsement never hurt too :o) )

    Answer an interesting question ? Create a wiki article about it!

    Tuesday, August 25, 2015 2:55 AM
  • Hi Dr34mp,

    We experienced exactly the same problem on all our WS2008R2 & WS2008 servers.

    The virtual servers on vSphere suffered the most in performance.

    svchost.exe used 100% cpu time for ca. 20~30 minutes once or twice a day

    When we looked which service caused this, we could see that it was every time the wuauserv (windows update) service.

    We also do not use WSUS

    This problem started for us in July.
    The cause of this problem was probably a bad update out of the June or May updates.
    We patch our servers in a 2 month cycle..

    Last weekend we patched our servers with the July & August updates.

    After these patches the problem has been solved for us.
    We are monitoring our servers closely but the problem did not occur anymore.

    Cheers,

    Marc

    • Proposed as answer by Leo Han Wednesday, September 2, 2015 4:35 AM
    • Marked as answer by Leo Han Monday, September 7, 2015 1:11 AM
    Tuesday, August 25, 2015 8:06 AM
  • happens even on Windows 7 SP1, 100% load on a cpu core... wtih the countereffect that my laptop battery empties itself within 30 minutes. After killing the svchost twice it stops.

    Very annoying. And not related to automatic updates, they had been disabled. Two different virus scanners including an Avia rescue CD didn't find any infections... will use the hints in the thread to solve the problem on my system(s)


    IT architect - Terminal servers, virtualizations, SQL servers, file servers, WAN networks and closely related to software devleopment (8 years + experience in VB, C++ and script langugaes), MCP for SQL server and CCAA for Xenapp 6.5


    • Edited by Al Hasoob Tuesday, September 8, 2015 6:26 AM
    Tuesday, September 8, 2015 6:25 AM