bundles them together<\/a> under svchost.exe, or Service Host. It’s a design decision that came about in Windows 2000 and makes the OS more efficient. That said, it makes diagnosing resource problems much harder for you when tring to figure out what’s going on. <\/p>\nIn Task Manager, you can see eight or so entries all labeled svchost.exe, each with a different memory and CPU footprint, with no obvious way to tell them apart. Even if you expand the view in the Details tab, you won’t see the type of granular data on individual services inside the shared host process. That’s where Resource Monitor comes in. <\/p>\n
How to open Resource Monitor<\/p>\n
Step by step<\/p>\n
You can get to Resource Monitor in a couple of different ways:<\/p>\n
Press Win + R, type resmon, and hit Enter<\/p>\n
Open Task Manager, go to the Performance tab, and click the three-dot menu in the upper right corner, then Resource Monitor <\/p>\n
Search for Resource Monitor in the Start menu<\/p>\n
Once it’s open, you’ll see a more detailed breakdown than anything Task Manager offers \u2014 separated into CPU, Memory, Disk, and Network tabs, each showing per-process data in real time.<\/p>\n
What you’re looking at<\/p>\n
The Memory tab is where you want to look if you’re investigating RAM issues. It has columns for each process.<\/p>\n
Commit (KB) – the amount of virtual memory reserved by the OS for the process<\/p>\n
Working Set (KB) – this is the actively used memory for that process<\/p>\n
Shareable (KB) these bits of memory could theoretically be shared with other processes<\/p>\n
Private (KB) this is memory held just for that process; not shareable<\/p>\n
If you’re looking for issues, pay attention to Working Set and Private. Sort by descending, and you’ll get the RAM hogs to the top of the list. <\/p>\n
Finding what’s hiding inside svchost.exe<\/p>\n
How to read the service names<\/p>\n
![\"Find](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/04\/find-pid.png\")
<\/p>\n
Here’s why you want to use Resource Monitor. To find which svchost.exe instance is eating your RAM, start in the Memory tab.<\/p>\n
Click on the Memory tab to sort it \u2014 find the svchost.exe entry in the Processes table and sort by Working Set to identify the high-RAM instance<\/p>\n
Note its PID<\/p>\n
Switch to the CPU tab, find the matching svchost entry by PID, check its box, and the Services section below will filter to show what’s running inside it<\/p>\n
The service identifiers aren’t always self-explanatory, of course. If you see a name you don’t recognize, you can cross-reference it fairly quickly. Press WIn+R, type services.msc, hit Enter, and then find the service name in the list (you can look in the Description column to see what it actually does). You can also just Google it; most have well-documented purposes. <\/p>\n
Once you’ve identified the culprit, you have a couple of options. You can stop it temporarily and see if that clears things up, disable it at startup if you don’t need it, or research whether it’s behaving oddly or is just a momentary process that will chill out once it’s done. <\/p>\n
When Resource Monitor isn’t enough<\/p>\n
![\"Sysinternals](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/04\/sysinternals.png\")
<\/p>\n
For most of your RAM mysteries, Resource Monitor will be just fine. But if you’re dealing with a process that’s hard to identify, suspect malware might be involved, or just want deeper per-thread and handle-level data, you can check out Process Explorer (part of the free Sysinternals suite). It can show you more details, like which specific DLLs a process loads, what file handles it has open, and it can verify process signatures against something like VirusTotal directly from its interface. <\/p>\n
Stop guessing and start looking<\/p>\n
You’ve got the tools to see exactly what’s happening under the hood of your Windows PC; it just takes a little know how to find and use them. The next time your machine slows down and you can’t figure out the issue in Task Manager, head into Resource Monitor, sort by Working Set, and expand the resulting svchost.exe entries. The answer is almost always in there. <\/p>\n
![\"Sysinternals](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/04\/sysinternals-suite-logo.png\")
<\/p>\n
\t\t\t\t\t\tOS \t\t\t\t\t<\/p>\n
\t\t\t\t\t\t\t\t\t\t\tWindows<\/p>\n
\t\t\t\t\t\tDeveloper \t\t\t\t\t<\/p>\n
\t\t\t\t\t\t\t\t\t\t\tMark Russinovich<\/p>\n
\t\t\t\t\t\tPrice model \t\t\t\t\t<\/p>\n
\t\t\t\t\t\t\t\t\t\t\tFree<\/p>\n
The suite contains over 70 individual tools covering process and memory management, network monitoring, disk analysis, and security auditing. Standouts include Process Explorer (a powerful Task Manager replacement), Autoruns (which surfaces everything that launches at startup), Process Monitor (which logs real-time file system, registry, and process activity), and TCPView (which maps active network connections to individual processes). You can install it from the Microsoft Store for automatic updates.<\/p>\n","protected":false},"excerpt":{"rendered":"Have you ever gone to Task Manager to figure out why your PC feels so slow, so sluggish?…\n","protected":false},"author":2,"featured_media":614390,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[64,63,105],"class_list":{"0":"post-614389","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-technology","8":"tag-au","9":"tag-australia","10":"tag-technology"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/614389","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=614389"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/614389\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/614390"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=614389"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=614389"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=614389"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Resource](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/04\/resource-monitor-on-windows-11.jpg\"\/)
<\/p>\n![\"Task](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/04\/task-manager.png\")
<\/p>\n