So, you want to figure out which services are consuming CPU. This happens often since so much software runs as a Windows Service.
It can be hard to figure out why svchost.exe is consuming a large amount of the CPU since the Task Manager doesn’t break down exactly what service is consuming the CPU. However, you can get this breakdown using the command-line “tasklist.exe” command.
Tasklist provides a listing of currently running processes:
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 0 28 K
System 4 0 256 K
smss.exe 688 0 460 K
csrss.exe 752 0 15,068 K
winlogon.exe 792 0 11,752 K
services.exe 852 0 74,632 K
lsass.exe 872 0 16,560 K
svchost.exe 1064 0 2,856 K
svchost.exe 1136 0 3,852 K
svchost.exe 1228 0 5,044 K
We can use the /SVC command-line option to get a mapping of processes to services:
C:> tasklist /SVC
Image Name PID Services
========================= ======== ============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 688 N/A
csrss.exe 752 N/A
winlogon.exe 792 N/A
services.exe 852 Eventlog, PlugPlay
lsass.exe 872 Netlogon, PolicyAgent, ProtectedStorage,
svchost.exe 1064 DcomLaunch
svchost.exe 1136 RpcSs
svchost.exe 1228 Dhcp, Dnscache
svchost.exe 1284 Alerter, LmHosts, W32Time
svchost.exe 1296 AeLookupSvc, BITS, CryptSvc, dmserver,
EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS,
Notice that we can now map actual services to each svchost.exe.
Now we just need to get the PID of the problem svchost.exe.
- Open Task Manager, right-click the Task Bar, click Task Manager
- Click the Processes tab
- Click View
- Click Select Columns..
- Select “PID (Process Identifier)”
- Click OK
At this point, you should be able to get the PID of the problem svchost.exe and use tasklist /SVC to determine which services are mapped to that process. You can then begin troubleshooting which service is causing the CPU load.