Constant hard drive activity on new XP Pro install

[Justin]

The HDD light blinks every 1 to 2 seconds while idle on the new box I just
built and installed XP Pro SP2 on. The motherboard has the NVIDIA 570
chipset (SATA and PATA controllers) and 2GB of RAM. This is what I've
learned about the situation:
- it doesn't matter if I install XP on a PATA or SATA drive
- it doesn't matter if the disks have write caching enabled
- the HDD light will blink even during an idle period (like waiting on user
input) during install of the OS
- the light does not blink if using Win98 or booted into DOS
- it doesn't matter if I have the system drivers installed or not
- installed XP three times (using different drives) and get same results

This machine hasn't been on any network or the web (but did a virus scan on
a previous install, but no probs). Right now it is as bare as it can get so
it can't be third-party prgs or junk running in the background. I don't see
anything unusual in Task Mgr except the OS activation notification and I have
all the Windows Security stuff turned off (so I get the neat red shield in
the sys tray). I ran Sysinternals utils trying to track down the HDD hits
and the best I can see there is nothing atypical going on.

I work on several modern XP Pro boxes at work and haven't noticed this. I'd
like to get this resolved before I move to this new box.

What is causing this constant HDD activity on idle and how do I stop it!?!?

Thanks,
Justin

 

[VanguardLH]

in message

The HDD light blinks every 1 to 2 seconds while idle on the new box
I just
built and installed XP Pro SP2 on. ...
What is causing this constant HDD activity on idle and how do I stop
it!?!?

Turn of indexing.
Start -> Search -> For Files or Folders
Click chevron next to "Search Options" to expand the list.
Check if "Indexing Service" is enabled or not.
If enabled, disable it.

Open Task Manager.
Go to the Processes tab.
View -> Select Columns.
Add the I/O Reads and I/O Writes columns.
Might show you which process is doing all the hard disk activity.

Or use SysInternals' FileMon to monitor file activity.

 

[Justin]

Vangaurd,
Indexing was never turned on (it must be off by default). The only process
I see with I/O activity in Task Mgr is lsass.exe and one of the
svchost.exe's. I've seen similar activity on other boxes but there is no HDD
activity.

Justin

 

[VanguardLH]

in message

Vangaurd,
Indexing was never turned on (it must be off by default). The only
process
I see with I/O activity in Task Mgr is lsass.exe and one of the
svchost.exe's. I've seen similar activity on other boxes but there
is no HDD
activity.

You'll need to use SysInternals' Process Explorer to see what NT
services are rolled into the svchost.exe that has the high disk
activity.

 

[Justin]

Vanguard,
There are no children attached to either lsass.exe or the particular
svchost.exe that is producing I/O activity.

I appreciate the info!

Justin

 

[VanguardLH]

in message

There are no children attached to either lsass.exe or the particular
svchost.exe that is producing I/O activity.

svchost.exe is not itself a service. By itself, svchost.exe doesn't
do anything. At least one NT service has to be rolled under an
instance of svchost.exe.

In Process Explorer and when you hover the mouse cursor over an
instance of svchost.exe, a popup window should show what services got
rolled into that instance of svchost.exe. Alternatively, right-click
on the instance of svchost.exe, select Properties, and look under the
Services tab.

 

[Justin]

I get DcomLaunch and TermService. They look like core OS services.

 

[VanguardLH]

I get DcomLaunch and TermService. They look like core OS services.

You sure that instance of svchost.exe is generating all the drive
activity? Doesn't seem those services would do that (although
DcomLaunch might be running something else).

Drive activity go away if you yank the network cable from the host?

 

[Justin]

You sure that instance of svchost.exe is generating all the drive
activity? Doesn't seem those services would do that (although
DcomLaunch might be running something else).

Drive activity go away if you yank the network cable from the host?

Note from the original post that this computer is not on a network, thus
there is no cable to yank. I can't say for sure if this process is causing
the activity, but I do know both the I/O changes and the HDD light flicker
every second, so they are at least the same frequency.

 

[VanguardLH]

Did you ever see what files were getting written and by what process
by using Filemon? With the poll interval used by Task Manager, you
might not ever see the process go up in CPU usage that is causing the
short drive activity.

 

[Justin]

Did you ever see what files were getting written and by what process
by using Filemon? With the poll interval used by Task Manager, you
might not ever see the process go up in CPU usage that is causing the
short drive activity.

I don't see an exact correlation, but the file most commonly accessed is
C:\$logfile. C:\$Directory is hit often, too.

 

[Justin]

New information! If I disconnect the DVD drive (via cables or BIOS) then I
don't get the HDD activity. For some reason the optical drive is causing
this light to come on. It is a SATA drive. Is this typical with SATA drives?

 

[VanguardLH]

New information! If I disconnect the DVD drive (via cables or BIOS)
then I
don't get the HDD activity. For some reason the optical drive is
causing
this light to come on. It is a SATA drive. Is this typical with
SATA drives?

Anything inside the $logfile to tell you what it is used for?

Does Filemon show what process is writing to $logfile? You can
specify a filter so Filemon only reports activity on just this file.
Or does it just show the same svchost.exe process that you saw in Task
Manager?

 

[Justin]

Anything inside the $logfile to tell you what it is used for?

Does Filemon show what process is writing to $logfile? You can
specify a filter so Filemon only reports activity on just this file.
Or does it just show the same svchost.exe process that you saw in Task
Manager?

I can't find any of the $ files (yes, I turned on all the hidden stuff).
Maybe they are temporary files? The process writing is System:4. Anyway, it
looks like more of a hardware issue and how XP uses devices. If I turn off
autorun for CDs, then the problem goes away. I think it is a phenomena with
SATA optical drives.

I'd still like to know if there is a way to keep the motherboard from
causing optical drive activity from causing the HDD light to come on. As it
is, I can't tell truely where the activity is coming from.

 

[Bob I]

Perhaps you installed some "Drag n Drop" writing software for the
Optical drive?