Hi I'm having a very high CPU usage in the "svchost.exe LocalServiceNetworkRestricted" process when reading an event in a local/remote EventLog in Windows 2008 64 SP02 using WMI. The same happens using Wbemtest or using a C++ WMI code . Using WbemTest ,"Open Instance" (the same as a the WMI GetObject API) to read just one of the latest inserted events in the EventLog: Win32_NTLogEvent.Logfile="Application",RecordNumber=2615657 (in that case this was the id from the latest event in the very big Application EventLog) takes 3/4 seconds consuming more thant 50% of CPU in the monitored computer. This only happens when the EventLog is very large (in my case 1 million of records), when the EventLog has about 10000 events everything goes fine. The problem is that I'm reading the full EventLog from a remote program and this CPU usage produces too high CPU load in the monitored computer. I don't read the eventlog one by one, but I'm using WQL queries but I have to do some GetObjects and the peformance is really awful. Any idea about what to change or look for? Best regards, Jordi

Hi, You can refer to the answer in the thread below to try a clean boot mode to narrow down the root cause: Windows server 2008 Ent 64x is taking High CPU by SVCHOST file http://social.technet.microsoft.com/Forums/en/winserverprint/thread/3b72baa7-9125-4aa3-8e6f-7ccbb36988d0 Besides, the suggested links in the thread can also be reference. I have included them as below: PRF: High CPU (SVCHOST.EXE) http://blogs.technet.com/b/askperf/archive/2009/04/10/prf-high-cpu-svchost-exe.aspx Getting Started with SVCHOST.EXE Troubleshooting http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx Regards, Cecilia Zhou -------------------------------------------------------------------------------- Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.