what the hell is that ??

[Bubba]

I believe svchost comprises nearly 300 separate threads/processes in XP and almost double that in Vista. I have no data yet for Windows 7. Not sure what the ratio of processes to threads is or more simply how many actual processes there are as opposed to threads spun off by the processes.

[Sebastiani]

>> I believe svchost comprises nearly 300 separate threads/processes in XP and almost double that in Vista.

Are you serious? That's crazy. What a waste of resources!

[Cactus_Hugger]

Originally Posted by Sebastiani

>> I believe svchost comprises nearly 300 separate threads/processes in XP and almost double that in Vista.

Are you serious? That's crazy. What a waste of resources!

My Build 7000 version of Windows 7 had ~215 threads across 11 processes. That's about how many threads my entire Linux system has...

[Mario F.]

You must remember that svchost.exe is a specialized service for hosting processes that run of DLLs, Sebastiani. The fact that these services run under the same process actually conserves memory and optimizes its use. The disadvantage is that if any of these services crashes, the entire svchost process that is hosting that service is almost certainly going down, taking all the other services with it.

If you go to HKLM\SYSTEM\CurrentControlSet\Services, you'll get a list of installed services. Clicking on each may reveal a key called ImagePath. If that key points to svchost.exe, that's a service that is going to be hosted by this process.

Meanwhile, you can run a command line and type tasklist /svc. This will let you know which services are being used by each of the svchost processes you are currently seeing in your task manager. You can also go to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost. This is where the services groupings are described.

Finally, the Process Explorer from Sysinternals will give you all the details about each svchost process, including the individual services and total number of threads.

EDIT: Currently I'm running 129 threads on 7 svchost images (or groups, or processes , or whatchacallit) hosting 31 services. Seems pretty decent to me. As some of these services wake up from idle time, I'd expect the number of threads to climb considerably. I believe Bubba means the potential of threads/processes. Not an actual constant number across a normal windows session.

[iMalc]

This is why they made the Vista defragmenter show you almost nothing while it works. Too many people asking stupid questions.
Process Explorer FTW!

[Elysia]

Originally Posted by brewbuck

Windows runs services inside host processes which are called, creatively, "svchost.exe." It can run more than one service in a single process, although it doesn't always. It is impossible to kill svchost.exe because that is not the proper way to terminate a service -- you terminate services using the control panel administrative plugin, or by the "net stop" command on the command line.

Ah, here's something even more funny.
If you kill svchost.exe, at least on XP, you will initiate an automatic reboot due to critical system services having been stopped.
I believe in Vista and forward, Windows can recover from it. Nevertheless, if you kill them, they will just restart.

[Sebastiani]

>> You must remember that svchost.exe is a specialized service for hosting processes that run of DLLs, Sebastiani. The fact that these services run under the same process actually conserves memory and optimizes its use.

I know, I was merely shocked at the actual number of threads that it was running. I use Windows 2000, and the total number of svhost threads number less than 25! In fact, my entire system at this very moment has less than 115 threads executing *total*. I guess it's possible that newer versions of Windows have simply broken these down further to make things more efficient, but from my experience, at least, more threads != more efficiency, generally (there are exceptions, of course). Or perhaps the significant increase in threads is due to a dramatic increase in functionality, but from what I've seen with XP and Vista, aside from some of the more advanced graphics, I really don't see much of an improvement in that area to warrant such an increase in threads, IMO. Having said that, I always keep the number of services that run at a minimum, so I suspect that the default is much higher than the numbers I posted. And as far as Systernals goes, I've been using their products for a number of years, and in fact Process Explorer *is* my task manager.

[Sebastiani]

>> If you kill svchost.exe, at least on XP, you will initiate an automatic reboot due to critical system services having been stopped.

That's true of Win2K, as well. I suspect it has something to do with the fact that Windows uses the RPC mechanism internally and so literally cannot run without it.

[Bubba]

Yes I was not indicating that there are always a set number of threads running, however, the potential for a great number does exist and your task manager won't show them as anything but an instance of svchost. This is quite deceptive. So when you see that you have 40 processes running in task manager keep in mind the actual number lurking behind those svchost instances is considerably more.

Usually when your system is sluggish or erratic and yet you cannot see anything in task manager that is causing it I would suspect it's one of the processes/threads being hosted by svchost. I really did not understand svchost till a friend of mine at Microsoft explained exactly what it was. I know that Vista at least has the potential to spawn off twice as many processes/threads through svchost as XP does. This is one of the many reasons that Vista is so slow. Also if you have a bunch of developers thinking they can just use svchost to host their process it quickly becomes abused and over-used and you end up having far more being hosted than is necessary. So if the system is extremely sluggish and unresponsive this is the first place I would look for the answer. I've also heard that many of these probably use DDE which could hamper performance even more.

In short it started out as a great idea and has many benefits as Mario pointed out but it has been turned into a bit of a mess. The biggest issue is most certainly what Mario again pointed out. If any of the processes/threads crash that the svchost instance is hosting it is entirely possible your system will come crashing down as well since that svchost is more than likely hosting far more than just the offending process or thread.

I have never programmed anything that actually uses svchost so my experience with it is pretty much limited to what I've been told firsthand and what I've read about it on the internet. Microsoft does have a tool to view all current threads and processes but it does not make clear which ones belong to which instances of svchost. However it can give you a better picture of your system.