Archive for the ‘memory’ tag
Tracking Down Windows Memory Leaks
This is just a small windows O/S related note, covering how to track down memory usage of a specific windows service. This all happened on Windows Vista. The same steps are likely to work perfectly well on Windows 7 and both flavours of Server 2008. I’d expect them to also work on earlier versions of Windows as well.
I noticed that my laptop was consuming significant amounts of memory – well actually as this is a 4g laptop I didn’t notice this until I tried to run 2 instances of Oracle in 2 vms at the same time. Shutting everything down showed me that I still had a problem. There was an instance of svchost that was consuming the best part of a gigabyte of memory. Task Manager looked like this
Unfortunately the svchost process that was experiencing this issue was the instance that runs the netsvcs group of network services. On my machine the list of enabled services in that group reads
- AeLookupSvc
- Themes
- IKEEXT
- AudioSrv
- Rasman
- Remoteaccess
- SENS
- Wmi
- wuauserv
- BITS
- ShellHWDetection
- iphlpsvc
- seclogon
- MMCSS
- ProfSvc
- EapHost
- winmgmt
- schedule
- browser
- AppMgmt
Now the tasklist utility can report memory usage for a service – however quick investigation showed that it seemed to report in fact memory usage by the host process – that is memory usage for all of these services was identical. eg reporting memory usage looked like this (choosing a different group of services for reasons that will become obvious later)
C:\>tasklist /svc /FI "PID EQ 1524"
Image Name PID Services
========================= ======== ============================================
svchost.exe 1524 EventSystem, FDResPub, LanmanWorkstation,
netprofm, nsi, SSDPSRV, SstpSvc, W32Time,
WebClient
C:\>tasklist /fi "services eq LanmanWorkstation"
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
svchost.exe 1524 Services 0 9,892 K
C:\>tasklist /fi "services eq EventSystem"
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
svchost.exe 1524 Services 0 9,892 K
This meant that I had no idea which service was responsible for the memory usage. In addition many of these services are necessary for windows to function correctly. Googling memory usage by netsvcs or svchost did not produce significant help, although it did reveal a startling amount of ignorance about what svchost is and does.
Fortunately the SC utility allows modifications of service definitions
C:\>sc config help
DESCRIPTION:
Modifies a service entry in the registry and Service Database.
USAGE:
sc config [service name]
...
OPTIONS:
NOTE: The option name includes the equal sign.
A space is required between the equal sign and the value.
type=
start=
error=
binPath=
group=
tag=
depend=
obj=
DisplayName=
password=
C:\>
setting the type of each service to “own” as shown below (note the space after the = sign)
sc RASMAN type= own
and then restarting the PC starts each service in its own instance of svchost. After restarting this the culprit service became clear. The guilty service in my case was iphlpsvc which a helper service for IPv6 connectivity. A quick search on this problem revealed the following knowledge base article http://support.microsoft.com/kb/983457 and associated hotfix. In fact the hotfix is only available for the current Vista Service pack level – which is SP2 at the time of writing – and as I don’t require ipV6 networks I have just disabled the relevant service.
In summary then
Use of the filter operators for the command line utility tasklist can help in diagnosing some issues, but the output may not be accurate for services hosted in a shared svchost process. The sc utility can be used to modify service behaviour as well as to control add and delete services.