TR Forums

Hey. Every once in a while my CPU starts doing all sorts of spikes in activity, yet task manager never shows anything using more than 1 or 2 %. How is this possible, and how do I track down the process(es) that are causing these fluctuations.

link - https://skydrive.live.com/redir?resid=134B7ABC440430A6!12845


how is this possible?

dave

Edit - I can't make the image link work with skydrive... sorry.

Chances are it's just background stuff going on. In any case, you can get a more detailed look at what's using resources with Process Explorer.

Thanks for the link. It appears that svchost.exe is constantly chugging along at 16-18% CPU activity (1 core near 100%). Not sure what it's doing, but it seems odd to me. That's a lot of background processing.

Disco wrote:

Thanks for the link. It appears that svchost.exe is constantly chugging along at 16-18% CPU activity (1 core near 100%). Not sure what it's doing, but it seems odd to me. That's a lot of background processing.

Okay...I'm not a software expert, so no one rage if I get this a little wrong...

Many years ago, all Windows programs required a .exe file to run. Windows switched a lot of processes over to .dll files which take up less space. However, .dll files cannot be launched directly from Windows. Enter svchosts to launch .dll files.

Pre-post-edit: DancinJack linked it...I'll just hope my explanation is a good summary.

SvcHost is just a EXE that allows services (implemented as DLLs) to run, so the actual offender could be almost anything. To further track down the culprit, make sure you're running Process Explorer as an Administrator (you can right-click and run procexp.exe as Admin, or if you already have it running there's an option to "view all details" on the file menu). You'll now see additional child processes that may have been launched by SvcHost.

If SvcHost (rather than one of the children) is still racking up the CPU, you need to drill into it. On the View menu, turn on the Lower Pane with DLLs selected). Now, when you select the SvcHost instance, you'll see what it has loaded. Most of it will be standard Windows DLLs that virtually everything uses, but you may see something that will give you a clue (try sorting on Company Name and look for non-Microsoft DLLs, though obviously it's also possible a Microsoft-supplied service is running amok)

You can also use ProcessExplorer to (temporarily) suspend the offending EXE and see what stops working. This obviously a crude mechanism but it can shortcut the bug hunt.

But there's another route to take entirely: have a look at Services.msc (just type services into the Run box). This will show you all the registered services and note which ones have started. One of those is your likely culprit. If you can't figure it out right away, you can selectively pause them until you see the CPU usage drop. Depending on what it turns out to be, you may want to change its Startup Type to manual and/or go into System Configuration (services tab) and disable it. Or even uninstall whatever app installed it in the first place (if it's some 3rd party junk)

You got the technical part right, but I'll just amend the history:

superjawes wrote:

Many years ago, all Windows programs required a .exe file to run. Windows switched a lot of processes over to .dll files which take up less space.

Actually, DLLs have always been a feature of Windows -- it's one of the key ways they got 16bit Windows, and Windows applications, to fit into a 640KB machine back in the day. In fact, Windows itself used to be just a bunch of DLLs -- USER.DLL, GDI.DLL, KERNEL.DLL, and a couple of others -- that were invoked by win.exe

So the idea of "host" EXEs that exist to provide a process wrapper (a stack and program counter and a few other things) for DLLs has been fundamental to Windows from the very beginning. It's just been extended to various other parts of the system (services, COM, ActiveX controls and other UI extensibility mechanisms, etc). In the most generic form you'll see DLLHost.exe doing this for non-Services DLLs also.

You probably aren't seeing the process that is taking up all the CPU because you need to click on the "Show processes from all users" button. You can see it in the picture you linked on the bottom left of the Task Manager window.

Do you have any gadgets running, if so, which ones, I believe there were a few that would cause that behavior, I noticed it after getting my 2500k and having that turbo boost monitoring program from intel going.

I kept seeing the same spikes.

Sorry, just saw your pic,lol, still try it, the cpu one does not do it, but perhaps 1 of the other 2 are causing it.

Can't you find which files individual processes are accessing using Resource Monitor?

If you mouse over the svchost in process explorer it should tell you which processes it's specifically running.

How to identify whats actually running

Use the task manager and find out the PID (Process ID) that you need to identify. Then run cmd.exe and type the command tasklist /SVC and match the PID from that list.

Holy Cow! Thanks for all the discussion. I did examine the activity with process explorer - neat program by the way. There were quite a number of 'children' running under that particular svchost, but nothing that seemed too strange or foreign. So, I did what all smart and savvy computer users do... I re-booted and voila - no more CPU activity!

The next time it happens I will look in more detail at the child services. You guys are great. Thanks again for all the info. Next time it happens I'll know how to evaluate the activity.

dave

Process Explorer is really nice for this kind of thing. Once you have it in administrator mode, double-click on the svchost process and look at the Threads-page. Then you can see which service uses how many cycles and cpu. Used that exact thing when I had the same problem, what it boiled down to for me was that the iphlpsvc (windows ip helper service) sometimes go into a spin after the laptop having been in sleepmode a couple of times.

I have the very same problem. A spike but CPU activity is very low. I am not even sure which process is causing the problem. All this information is real useful. Thanks!

Okay guys, heads up, as I've recently tracked down exactly such an issue in an 8-core Xeon box that was jammin'. Usual disclaimer about this not being the problem/solution, but here goes.

What's likely happening is that you have a lot of deferred DPC calls. In Engrish, it means, 99% of the time, that there's a bad driver somewhere always begging Windows for attention.

First, while the system is sitting idle, you get LatencyMon running (don't forget to hit the "play" button). It's going to show you that you have some big spikes. When it does, next thing you do is you check both the Processes and Drivers tab, look anything with a "highest execution time" hundreds or thousands of times bigger than the next one in line.

If it's a process, then you know exactly where to look. If it's a driver, it's not quite as simple, but can be tracked down. Often it's ndis.sys, which means it's one of your network cards (also includes wi-fi cards, USB Ethernet adapters, Firewire, etc), or usbport.sys, which means it's either one of your USB devices, or even your USB controller or hubs.

At this point you want to start disabling the device(s) in question one by one in Device Manager and seeing when the CPU activity goes back to normal idle. After you've found the device, the first thing you do is check the manufacturer's site for a driver update. Also ensure that your motherboard's chipset drivers are up to date, namely with the Intel INF update utility or AMD's equivalent, as USB, SATA, and sometimes even Ethernet functionality are provided by the chipset itself.