hi all, I have a server with Win2k8 R2, that I've seen high cpu usage for over an hour (12% overall CPU usage, that's 1 core out of 2 cpus x 4 cores) for the svchost.exe that encompases *only* the lmhosts, evenlog and dhcp services. This is a SQL server based machine, it does no domain or Active Directory duties. Any reasons why svchost would use so much cpu? or why these services would take so much CPU power? thx much, Cos

start reading it from herer http://technet.microsoft.com/en-us/library/bb643196.aspxhttp://www.virmansec.com/blogs/skhairuddin

hi Syed, I do not have the Windows Forefront Server and these issues, as stated, only point to the lmhosts, eventlog and dhcp services... still puzzled as to what's going on...

The best thing would be donwloading the Process Explorer and analyzing the problem. http://technet.microsoft.com/en-us/sysinternals/bb896653http://www.virmansec.com/blogs/skhairuddin

Hi, I agree with Syed, the best way is to use Process Explorer to analyze the problem. Meanwhile, you could visit the following articles to troubleshoot the high CPU usage related to svhost.exe. Getting Started with SVCHOST.EXE Troubleshooting http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx PRF: High CPU (SVCHOST.EXE) http://blogs.technet.com/b/askperf/archive/2009/04/10/prf-high-cpu-svchost-exe.aspx Best Regards Dale Qiao TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

thx Dale, I will look into the info you provided as Process Explorer did not yield much useful stuff. thx much, Cos

Did you ever find out what was causing these cpu spikes? I have a 2k8 R2 server doing the exactly the same thing w/ exactly the same services. regards j

yeah, it was a security service which was installed by one of the admins. In your case, it could be something else that you may have installed recently, a patch, a service, an application.