Page 1 of 2 12 LastLast
Results 1 to 15 of 25
  1. #1
    2 Star Lounger
    Join Date
    Apr 2002
    Location
    East Tennessee
    Posts
    179
    Thanks
    3
    Thanked 0 Times in 0 Posts

    Hard Drive Activity (XP Home)

    Recently while sitting at my computer desk without any computer action, I noticed that my hard drive seems to be almost continually cycling. I thought that perhaps this was due to activity on my cable modem, so I turned off my network adapter, however the activity continued. I opened the Task Manager and noted that there were a couple of dozen processes active.

    While my system seems to be functioning properly, I am bothered by this apparent activity. Should I be concerned and is there some way to determine what is really going on.
    Win 8, Firefox 16.0.2, Thunderbird 15.0.2

  2. #2
    Banned Member
    Join Date
    Jul 2002
    Location
    Newport Richey, Florida, USA
    Posts
    2,149
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    Have you ran a Spyware Program,,,such as Adware 6.0 or Spybot to see if ya have any Spyware? Also you might go online and run a Trojan Scan.

  3. #3
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    A good way to check for the source of this activity is using the Task Manager. To open it, press CTRL+SHIFT+ESC, right-click on the taskbar and choose Task Manager, or press CTRL+ALT+DEL.

    When Task Manager opens, click on the tab titled Processes. You can then click on column headings to sort the list of running processes. Choose CPU and watch when the disk becomes active. Whatever is causing the disk activity will likely peg the CPU usage.

    Another thing that you can do to help isolate this using Task Manager is to click on the View menu and then select Select Columns... - from there, put a check next to Page Faults. This will add a column in the Processes tab that shows the Page Faults for each process. Page faults are disk read/writes, so you can easily see what is hitting your disk the most, but it is important to note that this value is cumulative. Sorting the processes by this column will not be an absolute, but it will help you determine what processes make the most use of the disk (and you will probably be surprised).
    -Mark

  4. #4
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Hard Drive Activity (XP Home)

    Trundle across to SysInternals and download a copy of their DiskMon utility which will show you what's happening -- if you can understand it! Another similar tool is FileMon.

    With either lay aside LOTS of time for studying the output...
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  5. #5
    2 Star Lounger
    Join Date
    Apr 2002
    Location
    East Tennessee
    Posts
    179
    Thanks
    3
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    Thanks to all for rapid helpfull advice!!!

    When I ran Spybot, it found several questionable items that I deleted. Not exactly sure of cause and effect, but the drive is quiet now.

    I will try the sugestion about using Task Mgr > Processes if it acts up again. The hint about sorting for page faults should get me there.

    I also have D/L FileMon for potential use
    Win 8, Firefox 16.0.2, Thunderbird 15.0.2

  6. #6
    2 Star Lounger
    Join Date
    Apr 2002
    Location
    East Tennessee
    Posts
    179
    Thanks
    3
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    Mark;
    Was experimenting with your sugestion of adding columns to the Task Mgr>Processes that bring new questions.

    You said Page Faults are disc read/writes, how is that different than the I/O reads & writes?

    As you said I was surprized by the fact that explorer.exe was continually registering Page faults even when I was just watching the Process screen. Is that unusual or did it generate a pagefault each time the screen updated?

    I can recognise some of the processes, but many are a mystery. BTW I showed 5 separate instances of svchost, Is that a problem?
    Win 8, Firefox 16.0.2, Thunderbird 15.0.2

  7. #7
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    I/O read/writes are usually system memory, and do not involve physical writing to a disk or other media. I/O stands for Input/Output, it is the process of data moving in and out of the CPU and/or system memory.

    The term page faults comes from the process of writing a page of memory to disk. At the lowest level, computer instructions on the CPU (your Intel or AMD processor) are handled in pages. Page faults are slower than I/O operations because of the physical movement of the disk and its read/write armature (mechanical operations as opposed to electrons moving about on a circuit will by nature be slower). In this case I was suggesting that you look at what was causing page faults because that means that data in memory is being swapped to and from the disk.

    It is quite normal for EXPLORER.EXE to generate a lot of page faults. Explorer is the part of Windows that you interact with, the GUI as it's called, and it's got a lot of things on its mind at all times. Does it generate a page fault every time the screen is updated? Well, sometimes. It depends on whether the memory page that the operating system needs is in RAM or on the disk.

    Windows manages memory by swapping less used portions of code to the disk - virtual memory, which you have probably heard of. This is also what the swap, or page, file is for - shuffling less used pieces of data to disk because memory-only operations are much faster. Windows XP handles this in the background so to reduce the impact of disk operations. This is why you will see a performance boost by adding system RAM (to a point, anyway); it allows more of what Windows is working with to remain in memory and the disk is needed as a memory substitute far less.

    The multiple instances of SVCHOST.EXE are also normal. SVCHOST.EXE is a generic process that allows certain services and programs to run that do not have an EXE of their own - kind of like a surrogate parent.

    Hope that helps a bit, if you have more questions, fire away. <img src=/S/smile.gif border=0 alt=smile width=15 height=15> Understanding how all the pieces fit together makes your computing experience better.
    -Mark

  8. #8
    2 Star Lounger
    Join Date
    Apr 2002
    Location
    East Tennessee
    Posts
    179
    Thanks
    3
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    Mark; thanks for your info!
    Well you more less and asked for it what follows. <img src=/S/devil.gif border=0 alt=devil width=15 height=15>

    I started up my Computer this morning and again it went into the cycle of much hard drive activity. While this was happening I ran SpyBot again to see if any new spyware programs had started, but none were found. I then open the program FileMon that John Gray had suggested. Sure enough it showed much activity. Perhaps the most significant part that I found was that explorer.exe appeared to be cycling through all the files on my hard drive. It had a pattern where it opened a Directory, ending with the note
    Win 8, Firefox 16.0.2, Thunderbird 15.0.2

  9. #9
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    I suspect that you have the Indexing Service running. It is notorious for this type of activity. If you see a process with the name cisvc.exe in Task Manager, that's the indexing service.
    Try disabling it through the Services applet (Start - Run - services.msc) and see if that quiets the drive down.

    For the record, the Indexing Service periodically scans your hard drive(s) and creates an index to speed up disk searches. The net result is a busy hard drive with minimal returns for most folks. In my experience, the benefit is not worth the performance issues it creates.
    -Mark

  10. #10
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Hard Drive Activity (XP Home)

    Do you remember the facility called "Find Fast" (or was it "Fast Find"?), that was all overhead, and no benefit? Much the same as the Indexing Service of which you speak...
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  11. #11
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    Yes, I have wondered if the Indexing Service was borne of that idea.
    -Mark

  12. #12
    2 Star Lounger
    Join Date
    Apr 2002
    Location
    East Tennessee
    Posts
    179
    Thanks
    3
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    The Mystery contiues!
    I did have the Indexing service enabled, and disabled it.
    The drive activity continues however, maybe? at a slightly reduced level. In the FilMon output the culprit still shows up as explorer.exe.

    I have another mystery that may or may not be related. <img src=/S/confused.gif border=0 alt=confused width=15 height=20>

    There are 3 icons on my Task Bar that I can not identify nor eliminate. They appear as 3 squares, one with a gray down arrow, the second with a gray A, the 3rd with a green background and a 1. I have attempted to ID them using a program "Autoruns" that shows all the auto start programs, to no avail. There is no name, and neither right or left clicks produce any action. I went to the customize Task Bar box and set their propeties to "hide", but on next boot they are back.
    Any Thoughts?
    Win 8, Firefox 16.0.2, Thunderbird 15.0.2

  13. #13
    Plutonium Lounger
    Join Date
    Oct 2001
    Location
    Lexington, Kentucky, USA
    Posts
    12,107
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Hard Drive Activity (XP Home)

    <hr>...There are 3 icons on my Task Bar that I can not identify nor eliminate... <hr>
    I'm jumping in here rather late, but this worries me. You said you ran Spybot - maybe you should try AdAware also to see if it finds anything. Do you have any "file sharing" programs like Kazaa or something like that? How 'bout plain old MSCONFIG to see what being run? Let's see, other categories of legit stuff to consider might be download accelerators and the like.

  14. #14
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    Can you post a screen capture of these icons? To do so, press the PrtScr key and then open your image editor of choice, paste the shot, and crop it down to the icons only (the entire screen would be much too large).

    You might also use Task Manager to look at the running processes on the computer and see if you can identify any of them that way.
    -Mark

  15. #15
    2 Star Lounger
    Join Date
    Apr 2002
    Location
    East Tennessee
    Posts
    179
    Thanks
    3
    Thanked 0 Times in 0 Posts

    Re: Hard Drive Activity (XP Home)

    The Icons are attached (Icons.gif)

    I have again checked the task manager>processes. The hilites of the results are that explorer.exe is far and away the leader in "page faults". The only other processes that seem to update activity, mostly with I/O reads and writes are crss.exe and isass.exe.

    Listed below is a small sample of the output from FileMon while the disc activity is underway. I'm not sure if it is the relavant portion but it shows the pattern that seems to repeat but not show up once the disc quiets down.

    446 9:45:39 AM explorer.exe:1332 IRP_MJ_READ* C: SUCCESS Offset: 610304 Length: 4096
    447 9:45:40 AM explorer.exe:1332 IRP_MJ_CREATE C:I386GMREADME.TXT SUCCESS Options: Open Access: All
    448 9:45:40 AM explorer.exe:1332 IRP_MJ_READ* C: SUCCESS Offset: 21876736 Length: 4096
    449 9:45:40 AM explorer.exe:1332 FASTIO_QUERY_STANDARD_INFO C:I386GMREADME.TXT SUCCESS Length: 646
    450 9:45:40 AM explorer.exe:1332 FASTIO_QUERY_STANDARD_INFO C:I386GMREADME.TXT SUCCESS Length: 646
    451 9:45:40 AM explorer.exe:1332 IRP_MJ_READ* C:I386GMREADME.TXT SUCCESS Offset: 0 Length: 4096
    452 9:45:40 AM explorer.exe:1332 IRP_MJ_CLEANUP C:I386GMREADME.TXT SUCCESS
    453 9:45:40 AM explorer.exe:1332 IRP_MJ_DIRECTORY_CONTROL C:I386 SUCCESS FileBothDirectoryInformation
    454 9:45:40 AM explorer.exe:1332 IRP_MJ_READ* C: SUCCESS Offset: 126976 Length: 4096
    455 9:45:40 AM System:4 IRP_MJ_WRITE* C:$LogFile SUCCESS Offset: 24670208 Length: 16384
    456 9:45:40 AM System:4 IRP_MJ_WRITE* C:$LogFile SUCCESS Offset: 8192 Length: 4096
    457 9:45:40 AM System:4 IRP_MJ_WRITE* C:$LogFile SUCCESS Offset: 4096 Length: 4096
    458 9:45:40 AM explorer.exe:1332 IRP_MJ_CREATE C:I386H323LOG.TXT SUCCESS Options: Open Access: All
    459 9:45:40 AM explorer.exe:1332 IRP_MJ_READ* C: SUCCESS Offset: 22183936 Length: 4096
    460 9:45:40 AM explorer.exe:1332 FASTIO_QUERY_STANDARD_INFO C:I386H323LOG.TXT SUCCESS Length: 0
    461 9:45:40 AM explorer.exe:1332 FASTIO_QUERY_STANDARD_INFO C:I386H323LOG.TXT SUCCESS Length: 0
    462 9:45:40 AM explorer.exe:1332 IRP_MJ_CLEANUP C:I386H323LOG.TXT SUCCESS
    463 9:45:40 AM explorer.exe:1332 IRP_MJ_CLOSE C:I386H323LOG.TXT SUCCESS
    464 9:45:40 AM explorer.exe:1332 FASTIO_QUERY_OPEN C:WINDOWSsystem32rpcss.dll SUCCESS Attributes: A
    465 9:45:40 AM explorer.exe:1332 IRP_MJ_CREATE C:WINDOWSsystem32rpcss.dll SUCCESS Options: Open Access: Execute
    466 9:45:40 AM explorer.exe:1332 FASTIO_QUERY_STANDARD_INFO C:WINDOWSsystem32rpcss.dll SUCCESS Length: 260608
    467 9:45:40 AM explorer.exe:1332 IRP_MJ_CLEANUP C:WINDOWSsystem32rpcss.dll SUCCESS
    468 9:45:40 AM explorer.exe:1332 IRP_MJ_CLOSE C:WINDOWSsystem32rpcss.dll SUCCESS

    I hope this is not becoming too much of a chore for you, but I really appreciate all your help and the info that you are providing.
    Win 8, Firefox 16.0.2, Thunderbird 15.0.2

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •