Which one of these SVChost services could be causing problematic intermittent CPU usage,

Question

I have an Amazon EC2 Windows server 2012 RTM, /w MSSQL 2012. I've finally got my Web application hosted and its slow. I canconfirm that IIS is not causing issues.

I've noticed every 3-4 seconds my CPU jumps from 10% to 27%-40%. I'm hoping this is the cause of the issue.

It's basically a fresh instance, I have barely anything installed, (Just MSSQL, IIS, Filezilla server) I have uninstalled all these, and none are the cause.

The PID causing this, is 840, svchost.exe (netsvcs) and after a tasklist /svc it contains:

certpropsvc
gpsvc
I KEEXT
iphlpsvc
lanmanserver
profsvc
schedule
sens
sessionenv
shellhwdeteciton
themes
winmgmt

How can I identify which one is causing the problem? Is one more likely that the other?

Solution

My guess:

Probably it is iphlpsvc causing the problem. This is the service description:

"Provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer."

If this service is the problem, it would probably be because your machine is a part of some funky network configuration that iphlpsvc can't easily handle, thus causing the CPU spike. The reason why I think it is iphlpsvc is because that service is known to cause system issues when it's in situations it can't handle very well. See this thread for various issues (along with various solutions) to problems with iphlpsvc: http://social.technet.microsoft.com/Forums/en/windowsserver2008r2general/thread/ba9f0968-9275-434f-9e40-ec0621c3a35a

If my guess is wrong:

In the event iphlpsvc really isn't the problem, the good news is you've already done the non-obvious troubleshooting part, which is to find out the services hosted by your offending process (netsvcs winsvc.exe).

From there, it's going to be a process of elimination. Disable each service one-by-one and check the cpu usage afterwards to find the one that is causing the offense, and you will have root cause.

You have 12 hosted services. On my particular, superbly-running machine, I have 15:

AeLookupSvc
Appinfo
BITS
Browser
EapHost
iphlpsvc
LanmanServer
MMCSS
ProfSvc
Schedule
SENS
ShellHWDetection
Themes
Winmgmt
wuauserv

Looking at the common ones and finding the ones unique to each system, we can observe that you have the five following hosted services running in your netsvcs image that I do not:

certpropsvc
gpsvc
I KEEXT
sessionenv
shellhwdeteciton

So those might be the first suspects to try disabling first. Either way, it will be a process of elimination. One of these services is causing the netsvcs CPU spike!

Now, whether that is ultimately causing your webapp to run slowly is a whole nother story, but, your hypothesis that it is netsvcs sounds reasonable for now.

Comments

[williamsandonz]

Hey Jon, this is as fantastic post, thank you, I Will give all this knowledge a go and get back to you with the result :)

[williamsandonz]

Damn, it wasn't iphlpsvc, tried disabling it and all the other services from both lists, and no luck. The only service I couldn't shut down was gpsvc, but it looks like I shouldn't shut it down as it could be used by amazon ec2 stuff.

[williamsandonz]

Perhaps the other question is, maybe this isn't an issue at all. Every 5 seconds that services spikes from 1-2% to 11-25%, but the average CPU from the service is around 3%, so maybe its not an issue?

[Jon]

Right, as I mentioned, your hypothesis that it was netsvcs was sound, but not infallible. It could very well be that Amazon ec2 simply uses this amount of CPU to get the job done, and that any perceived slowness in the app is coming from somewhere else. You could try and disabling gpsvc, even if temporarily, to see if really stops the spiking for netsvcs. It should, since it's the only one left. And if it doesn't, then it might suggest you're missing something else in the equation. Otherwise, you might have to look elsewhere on your system for answers!