svchost – High IO on MS Windows 2003

 

What is svchost.exe?

Wikipedia
Link

svchost.exe (Service Host, or SvcHost) is a system process that hosts multiple Windows services in the Windows NT family of operating systems.
Svchost is essential in the implementation of so-called shared service processes, where a number of services can share a process in order to reduce resource consumption

 

Issue

Hard-drive stays busy.

Indicator

Task Manager

Image

Explanation

  1. Top IO Usage
    • svchost.exe
      • Process ID is 920
      • User name is System

SysInternals

Explanation

  1. Top IO Usage
    • svchost.exe
      • Process ID is 920
      • User name is System

TroubleShooting

Process Management

Tasklist

List all services running under svchost.exe

Tasklist – List all processes running under svchost.exe

Script

tasklist /svc /fi "imagename eq svchost.exe"

Output

Explanation
  1. We are focused on PID = 920

Process Explorer

Tasklist – Dig deeper into process svchost.exe = 920

Services

Own Process

In a nice Server Fault QA post, Peter Mortensen suggested that one could separate out the services into their own process and thus gain clearer understanding of each service resource uptake.

To do one will have to change the service configuration.

Here is the specific QA:

How to find memory usage of individual Windows services?
Link

Run as distinct Process

Syntax

SC Config Servicename Type= own

Run as shared Process

Syntax

SC Config Servicename Type= share;

Run as distinct Process

Sample Code

rem  1. "Automatic Updates"
SC Config wuauserv Type= own

rem  2. "COM+ Event System"
SC Config EventSystem Type= own

rem  3. "Computer Browser"
SC Config Browser Type= own

rem  4. "Cryptographic Services"
SC Config CryptSvc Type= own

rem  5. "Distributed Link Tracking"
SC Config TrkWks Type= own

rem  6. "Help and Support"
SC Config helpsvc Type= own

rem  7. "Logical Disk Manager"
SC Config dmserver Type= own

rem  8. "Network Connections"
SC Config Netman Type= own

rem  9. "Network Location Awareness"
SC Config NLA Type= own

rem 10. "Remote Access Connection Manager"
SC Config RasMan Type= own

rem 11. "Secondary Logon"
SC Config seclogon Type= own

rem 12. "Server"
SC Config lanmanserver Type= own

rem 13. "Shell Hardware Detection"
SC Config ShellHWDetection Type= own

rem 14. "System Event Notification"
SC Config SENS Type= own

rem 15. "System Restore Service"
SC Config srservice Type= own

rem 16. "Task Scheduler"
SC Config Schedule Type= own

rem 17. "Telephony"
SC Config TapiSrv Type= own

rem 18. "Terminal Services"
SC Config TermService Type= own

rem 19. "Themes"
SC Config Themes Type= own

rem 20. "Windows Audio"
SC Config AudioSrv Type= own

rem 21. "Windows Firewall/Internet Connection Sharing (ICS)"
SC Config SharedAccess Type= own

rem 22. "Windows Management Instrumentation"
SC Config winmgmt Type= own

rem 23. "Wireless Configuration"
SC Config WZCSVC Type= own

rem 24. "Workstation"
SC Config lanmanworkstation Type= own

rem End.

 

Remediation

Once we ran the code to start all the aforementioned svchost.exe services in their own process space, restarted the machine.

SysInternals – Process Explorer

Took the SysInternal’s Process Explorer, arranged based on IO, and noticed that WMI is the culprit.

Images

svchost.exe – Services

Here are the services that are using our cited svchost.exe process.

Services

Took to Control Panel, services applet to stop that service and see if it things slow down.

Dependent Services

Reviewed Dependent Services

And, I really will rather than not stop the local system firewall service.  And, start to wonder why so busy anyways.

But, all that will wait another post as it is Saturday and I have errands to run.

Dedicated

Dedicated to Peter as in Mortensen.

 

References

  1. How to find memory usage of individual Windows services?
    Link
  2. How do I discover which process is making my hard drive go crazy? (need disk io equivalent of task manager’s cpu % column)
    Link
  3. YongRhee ( MSFT )
    • How to troubleshoot Service Host (svchost.exe) related problems?
      Link

SQLServer – BCP Optimization via Running Multiple Instances in Parallel

Background

Here is another in our series “Optimizing SQL Server BCP”.

 

Code

Original Code

 

invokeBCP.cmd

The original code looks like this:


	bcp %DBTargetDB%.dbo.[tblUser] in %TEMP_SESSION%\dbo.tblUser.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%
	bcp %DBTargetDB%.dbo.[tblInternalUser] in %TEMP_SESSION%\dbo.tblInternalUser.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%
	bcp %DBTargetDB%.dbo.[tblUserDefaultView] in %TEMP_SESSION%\dbo.tblUserDefaultView.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%
	bcp %DBTargetDB%.dbo.[tblUserBusinessUnitAccess] in %TEMP_SESSION%\dbo.tblUserBusinessUnitAccess.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%
	bcp %DBTargetDB%.dbo.[tblUserLocationCountryAdmin] in %TEMP_SESSION%\dbo.tblUserLocationCountryAdmin.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%
	bcp %DBTargetDB%.dbo.[tblLocationBusinessUnit] in %TEMP_SESSION%\dbo.tblLocationBusinessUnit.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%

Revised Code

Here is the revised code:

 

waitOnChildTasks.cmd

@echo off
setlocal

	@REM Reset Error Level
	set ERRORLEVEL=
	set ERRORLEVEL_LOCAL=

	set SLEEP_TIME_IN_SECONDS=5
	set "EXE=bcp.exe"

	:WAITLOOP

		@REM Using TaskList get list of matching processes
		@REM Send list to FIND.exe
		@REM Find returns 0 if match found, else 1
		tasklist /FI "IMAGENAME eq %EXE%" 2>NUL | find /I /N "%EXE%">NUL

		@REM Save ERRORLEVEL into ERRORLEVEL_LOCAL
		set "ERRORLEVEL_LOCAL=%ERRORLEVEL%"

		@REM If ERRORLEVEL_LOCAL is 0, then goto RUNNING BLOCK
		if %ERRORLEVEL_LOCAL% equ 0 goto :RUNNING

		@REM Else, assume not running
		goto :NOTRUNNING

	:RUNNING

		echo "Running  - %EXE% @ Check performed @ %time%"

		@Rem sleep for SLEEP_TIME_IN_SECONDS seconds
		Echo "Sleeping for %SLEEP_TIME_IN_SECONDS% (secs)"
		sleep %SLEEP_TIME_IN_SECONDS%

		goto WAITLOOP

	:NOTRUNNING

		echo "Completed Check for determining whether %EXE% is running!"

endlocal

invokeBCP.cmd

	echo "Bulk coppying data from datafiles " @ %DATE% %TIME% " ...."

	start bcp %DBTargetDB%.dbo.[tblUser] in %TEMP_SESSION%\dbo.tblUser.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%
	start bcp %DBTargetDB%.dbo.[tblInternalUser] in %TEMP_SESSION%\dbo.tblInternalUser.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%
	start bcp %DBTargetDB%.dbo.[tblUserDefaultView] in %TEMP_SESSION%\dbo.tblUserDefaultView.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%
	start bcp %DBTargetDB%.dbo.[tblUserBusinessUnitAccess] in %TEMP_SESSION%\dbo.tblUserBusinessUnitAccess.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%
	start bcp %DBTargetDB%.dbo.[tblUserLocationCountryAdmin] in %TEMP_SESSION%\dbo.tblUserLocationCountryAdmin.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%
	start bcp %DBTargetDB%.dbo.[tblLocationBusinessUnit] in %TEMP_SESSION%\dbo.tblLocationBusinessUnit.data -T -E -n -b%BATCH_SIZE% -S%DBTargetServer%

	Rem wait on all child processes
	waitOnChildTasks.cmd

	echo "Bulked copied data from datafiles " @ %DATE% %TIME% 

Environment

SLEEP.EXE

Depending on your version of MS Windows, ours is MS Windows 2008/R2, you might get an error stating that

‘sleep’ is not recognized as an internal or external command, operable program or batch file.

If so, please download “Windows Server 2003 Resource Kits” from http://www.microsoft.com/en-us/download/details.aspx?id=17657.

And, perform a deep extract to get you a nice version of the sleep.exe