none
Server 2008R2 mmc.exe and svchost.exe takes lot of memory

    Question

  • Hello,

    We have Windows Web Server 2008R2 SP1 which is running virtualized (WMWare).

    There are couple of processes which are taking quite a lot memory (server has totally 2GB memory at the moment).

    Processes are:

    - mmc.exe / Working set (memory) = 163,552K

    - svchost.exe / Working set (memory) = 234,788K. According TaskManager's services tab, corresponding svchost.exe includes following services: UxSms, UmRdpService, TrkWks, Netman

    And memory consumption is groving every day:

    At Friday (8/3/2012) svchost had 13,224K memory and there where no "extra mmc.exe"

    At Monday (8/6/2012) svchost had 133,584K and mmc.exe had 116,576K

    So, the questions are:

    - Is this normal for these processes?

    - Why mmc.exe is running (there is no Management Console window opened at the moment)? Is there any other purposes for mmc.exe than Management Console window?

    Thursday, August 9, 2012 6:48 AM

Answers

  • Can anyone say is this normal memory consumption for these services?

    Memory consumption differs from environment to environment and also on kind of application installed, how frequently a service is accessed on server etc...

    Following might help you troubleshoot this issue further

    Getting Started with SVCHOST.EXE Troubleshooting

    http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx


    I do not represent the organisation I work for, all the opinions expressed here are my own.

    This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    - .... .- -. -.- ... --..-- ... .- -. - --- ... ....

    Thursday, August 9, 2012 1:50 PM
    Moderator

All replies

  • Hi,

    Start analyzing the event logs for any application errors or warnings. It's difficult to predict any issues by just seeing Task Manager memory readings.

    Use perfmon on the server to check Memory, Disk and Network utilization.

    Sometimes Anti virus client installed on the server might cause memory overheads if real time protection is enabled.



    I do not represent the organisation I work for, all the opinions expressed here are my own.

    This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    - .... .- -. -.- ... --..-- ... .- -. - --- ... ....

    Thursday, August 9, 2012 8:08 AM
    Moderator
  • Hello Santosh,

    I just realized that we did install new IIS/ASP.NET application to the server at Friday 8/3/2012. So, maybe something happened back then...

    I did look up event logs and find some errors and warning from "Last 7 days":

    ----------------------
    Errors
    ----------------------

    WinLogon / EventID 4005
    "The Windows logon process has unexpectedly terminated."
    1 error from 8/3/2012
     -> I have no idea what would cause this one. There are other similar errors from past and at least some of those have been occurred when there have not been any users logged in (I know this because I am only one who uses this server).

    Schannel / EventID 36888
    "The following fatal alert was generated: 10. The internal error state is 1203."
     -> There are error or two per day. I found this kind of explanation:

    "This event is seen on windows 2008 R2 running IIS. If a user tries to access a web site using HTTP but specifies an SSL port in the URL then this event is logged. This event is expected as the client is trying to use the wrong port or the wrong protocol to access the site
    The error 1203 indicates invalid ClientHello from the client. This is by design and you can ignore this warning."

    ----------------------
    Warnings
    ----------------------
    TerminalServices-PnPDevices / EventID 36
    "Redirection of additional supported devices is disabled by policy."
     -> It seems that this will occur everytime I log in via Remote Desktop

    ASP.NET 2.0.50727.0 / EventID 1309
    2 warning from 8/3/2012 -> ASP.NET application didn't have execution permission to the database.

    --------------------------------------------------

    At the moment Working Set of svchost.exe is 180,960K. Working Set of "extra mmc.exe" is 108,932K.

    So, it seems that memory consumption is reduced little bit. Any ideas is it safe to just kill "extra mmc.exe"?

    Rgds,
    Jorma


    • Edited by J Sarnikorpi Thursday, August 9, 2012 11:40 AM text formatting
    Thursday, August 9, 2012 11:39 AM
  • Hi Jorma,

    Here are few links which you can refer in regards to event IDs posted above.

    Event ID 4005 — Windows Logon Availability ( This may not be related to the actual issue )

    http://technet.microsoft.com/en-us/library/cc734097(v=ws.10).aspx

    Thread: Schannel error, Event ID 36888?

    http://forums.iis.net/p/1168770/1956958.aspx

    Event ID 36 — Supported Plug and Play Device Redirection ( This may not be related to the actual issue )

    http://technet.microsoft.com/en-us/library/cc775202(v=ws.10).aspx

    ASP.NET 2.0.50727.0 Event ID 1309

    http://social.microsoft.com/Forums/uk/crm/thread/ef4f1809-a03e-4a7a-a233-3a8f1b521ab1

    ASP.NET 2.0.50727.0 Warning Event ID: 1309 due to Request time out

    http://blogs.msdn.com/b/crm/archive/2008/11/20/asp-net-2-0-50727-0-warning-event-id-1309-due-to-request-time-out.aspx

    I also suspect that, server performance issue could be caused due to asp.net application.

    I would suggest you to check for IIS logs as well to see if you have any errors logged.

    For IIS related queries, you might want to create a new thread in IIS forum

    http://forums.iis.net/1052.aspx

    likewise, ASP.NET forum is here: http://forums.asp.net/


    I do not represent the organisation I work for, all the opinions expressed here are my own.

    This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    - .... .- -. -.- ... --..-- ... .- -. - --- ... ....

    Thursday, August 9, 2012 12:06 PM
    Moderator
  •  Any ideas is it safe to just kill "extra mmc.exe"?

    It's difficult to say whether or not to kill that process. You might want to try Process explorer to check what that exta process is.

    Following link might help

    How to use Process Explorer and Task Manager to identify performance issues

    http://www.defcon-5.com/noc/video.cfm?docid=374


    I do not represent the organisation I work for, all the opinions expressed here are my own.

    This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    - .... .- -. -.- ... --..-- ... .- -. - --- ... ....

    Thursday, August 9, 2012 12:12 PM
    Moderator
  •  Any ideas is it safe to just kill "extra mmc.exe"?

    It's difficult to say whether or not to kill that process. You might want to try Process explorer to check what that exta process is.

    Process Explorer shows: "C:\Windows\system32\mmc.exe" "C:\Windows\system32\ServerManager.msc"

    But I don't have any ServerManager opened.

    There is also another svchost.exe which seems to be quite big (Working Set 73,844K). It contains following services:

    wuauserv
    Winmgmt
    ShellHWDetection
    SessionEnv
    SENS
    Schedule
    ProfSvc
    LanmanServer
    iphlpsvc
    gpsvc
    CertPropSvc
    BITS

    Can anyone say is this normal memory consumption for these services?

    Thursday, August 9, 2012 12:46 PM
  • Can anyone say is this normal memory consumption for these services?

    Memory consumption differs from environment to environment and also on kind of application installed, how frequently a service is accessed on server etc...

    Following might help you troubleshoot this issue further

    Getting Started with SVCHOST.EXE Troubleshooting

    http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx


    I do not represent the organisation I work for, all the opinions expressed here are my own.

    This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    - .... .- -. -.- ... --..-- ... .- -. - --- ... ....

    Thursday, August 9, 2012 1:50 PM
    Moderator
  • Can anyone say is this normal memory consumption for these services?

    Memory consumption differs from environment to environment and also on kind of application installed, how frequently a service is accessed on server etc...

    Following might help you troubleshoot this issue further

    Getting Started with SVCHOST.EXE Troubleshooting

    http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx


    OK, thank you!

    There is no other problem with svchost.exe processes (high CPU usage, error messages etc.) so I guess this is normal for these services.

    I am still wondering about "extra mmc.exe" but I don't dare to kill it (it is kind of production server and don't want to mess up anything). I will leave it and see what happens after next boot.

    Friday, August 10, 2012 12:44 PM