We have lateley seen several servers with svchost processes consuming 1GB or more memory. The first process identified was for Remote Registry. The Remote Registry component monitor was one of the monitors enabled in the Windows 2003-2008 template. Once we disabled the monitor (and restarted the service), this issues has gone away. This KB article seems to indicate that there is a bug in Win2008 wherein external monitors polling of Remote Registry causes a memory leak. Remote Registry service leaks memory when it handles customized v2 performance counter queries in Windows 7 or in Windows Server 2008 R2
We are also seeing svchost.exe running very high with the netsrvcs processes - there are several in this group, and we haven't isolated it yet, wondering if this to could be caused by SolarWinds polling. Netsrvcs covers winmngt, rpc, etc - all the things that doing WMI polling could affect.wmi Going through the obvious steps- monitoring the process after a reboot, removing component monitors, etc.
This one is causing some headache in our environment. - anyone out there see this as well?