DfrgNtfs.exe takes up 100% (core) usage

[Ian Boyd]

Windows Vista is scheduled to run a defrag at 1 AM. i came home this evening
to find my machine running very slowly, and Process Explorer's notification
area icon showing continuious 50% CPU usage. It was DfrgNtfs.exe, and this
hasn't been the first time.

It's not doing any I/O. (Process Monitor, Process Explorer and Resouce
Monitor show no file or hard drive activity). It's just continiously using
50% of my CPU (100% of one core).

Task Manager shows its "CPU Time" as 14 hours, so it's been burning up CPU
cycles doing nothing for hours.

Process Explorer shows more of the vitals:
Start: 3:57:52 AM 12/10/2008
Kernel: 0:15:17.488 (constant, 15 minutes)
User: 14:27:16.795 (climbing, 14 hours)
Base Priority: 4
I/O Priority: Very Low
Memory Priority: 3
Cycles: 97,534,870,881,480 (climbing at about 1.8 billion cycles per
second)


Looking at the stack trace of the thread that is taking up all the CPU:

ntkrnlpa.exe!KiSwapContext+0x26
ntkrnlpa.exe!KiSwapThread+0x44f
ntkrnlpa.exe!KeWaitForSingleObject+0x492
ntkrnlpa.exe!KiSuspendThread+0x18
ntkrnlpa.exe!KiDeliverApc+0x138
hal.dll!KfRaiseIrql+0xd1
hal.dll!KeRaiseIrqlToSynchLevel+0x70
hal.dll!HalEndSystemInterrupt+0x73
hal.dll!HalInitializeProcessor+0xcc1
DfrgNtfs.exe!AlgMoveExtentForward+0x486
DfrgNtfs.exe!PartialDefragThread+0x38b
kernel32.dll!BaseThreadInitThunk+0xe
ntdll.dll!__RtlUserThreadStart+0x23
ntdll.dll!_RtlUserThreadStart+0x1b


There are two defragmentation scheduled tasks defined on my computer:
Task Scheduler Library/Microsoft/Windows/Defrag/ManualDefrag
Task Scheduler Library/Microsoft/Windows/Defrag/ScheduledDefrag

neither are running right now. The scheduled defrag is scheduled to start
Wednesday at 1:00 AM (not 3:57 AM)


The system was last restarted 4 days ago (Saturday, December 6, 8:23:22 PM),
so the defrag didn't start at the last reboot.


If i try to manually run the defragmenter (Control Panel->System and
Maintenance->Administrative Tools->Defragment your hard drive), it does not
run. The Vista energy ring (the blue-green spinning busy circle) appears
briefly and the text briefly changes to:
Defragmenting hard disk (D
This may take a from a few minutes to a few hours

before changing back to:
Scheduled defragmentation is enabled
Your disks will be defragmented at the scheduled time.


If i uncheck the option "Run on a schedule (recommended)", close the
defragmentation form, and go back into it, a defragmentation pass
immediately begins - and it uses a second DfrgNtfs.exe process (the initial
CPU hogging process remains in place). If i turn the scheduled
defragmentation option back on and close the form, the 2nd DfrgNtfs.exe
process ends - leaving my initial rogue DfrgNtfs.exe process running.


It's now been an hour since i started researching this, the process is still
running, taking all of a core, and still stuck at "HalInitializeProcessor".



So my question is: What is the proper way to stop a defragmentation pass?

Note: Things that are not proper:
killing the process
renaming DfrgNtfs.exe while in safe mode
disabling pre-fetch
disabling boot file optimization order


The real reason i noted there was a problem is that the lack of CPU cycles
was preventing the WoW client from initializing before the server decided my
client wasn't responding - and booted me. And not being able to play WoW is
serious business.


i dumped the process using Task Manager if anyone with more WinDbg
experience than me wants to take a crack at it, and i'll leave the process
permanently suspended.

 

[Ian Boyd]

Also, the DfrgNtfs.exe process has been started by SvcHost. This particular
svchost hosts the two services:
DCOM Server Process Launcher
Plug and Play

which at first i found strange that it wasn't start by the Task Engine
service. But then i considered the possibility that the task scheduler uses
DCOM to to start the disk defragmenter out of process.


Can anyone confirm this?

 

[Ian Boyd]

bump

 

[Ian Boyd]

sdfsdf

 

[Alex]

Yes, I do confirm this. Have the same problem. Just an idea - do you have any
external usb drives? Smth like Freeagent from Seagate?

P.s.: In MS Knowledge Base there are some articles about this problem, but
for WinXP and Server 2003. It looks like they've fixed this problem in old
OSes, but didn't bother about the newest one. Shame. Will try to concat the
support

 

[Alex]

Yep, it's defragmentation issue of this external usb drive.
If I start the process directly with defrag x: -v, almost immediately get
this issue with dfrgntfs.exe

 

[Ian Boyd]

Bump

Windows Vista is scheduled to run a defrag at 1 AM. i came home this
evening to find my machine running very slowly, and Process Explorer's
notification area icon showing continuious 50% CPU usage. It was
DfrgNtfs.exe, and this hasn't been the first time.

It's not doing any I/O. (Process Monitor, Process Explorer and Resouce
Monitor show no file or hard drive activity). It's just continiously using
50% of my CPU (100% of one core).

Task Manager shows its "CPU Time" as 14 hours, so it's been burning up CPU
cycles doing nothing for hours.

Process Explorer shows more of the vitals:
Start: 3:57:52 AM 12/10/2008
Kernel: 0:15:17.488 (constant, 15 minutes)
User: 14:27:16.795 (climbing, 14 hours)
Base Priority: 4
I/O Priority: Very Low
Memory Priority: 3
Cycles: 97,534,870,881,480 (climbing at about 1.8 billion cycles per
second)


Looking at the stack trace of the thread that is taking up all the CPU:

ntkrnlpa.exe!KiSwapContext+0x26
ntkrnlpa.exe!KiSwapThread+0x44f
ntkrnlpa.exe!KeWaitForSingleObject+0x492
ntkrnlpa.exe!KiSuspendThread+0x18
ntkrnlpa.exe!KiDeliverApc+0x138
hal.dll!KfRaiseIrql+0xd1
hal.dll!KeRaiseIrqlToSynchLevel+0x70
hal.dll!HalEndSystemInterrupt+0x73
hal.dll!HalInitializeProcessor+0xcc1
DfrgNtfs.exe!AlgMoveExtentForward+0x486
DfrgNtfs.exe!PartialDefragThread+0x38b
kernel32.dll!BaseThreadInitThunk+0xe
ntdll.dll!__RtlUserThreadStart+0x23
ntdll.dll!_RtlUserThreadStart+0x1b


There are two defragmentation scheduled tasks defined on my computer:
Task Scheduler Library/Microsoft/Windows/Defrag/ManualDefrag
Task Scheduler Library/Microsoft/Windows/Defrag/ScheduledDefrag

neither are running right now. The scheduled defrag is scheduled to start
Wednesday at 1:00 AM (not 3:57 AM)


The system was last restarted 4 days ago (Saturday, December 6, 8:23:22
PM), so the defrag didn't start at the last reboot.


If i try to manually run the defragmenter (Control Panel->System and
Maintenance->Administrative Tools->Defragment your hard drive), it does
not run. The Vista energy ring (the blue-green spinning busy circle)
appears briefly and the text briefly changes to:
Defragmenting hard disk (D
This may take a from a few minutes to a few hours

before changing back to:
Scheduled defragmentation is enabled
Your disks will be defragmented at the scheduled time.


If i uncheck the option "Run on a schedule (recommended)", close the
defragmentation form, and go back into it, a defragmentation pass
immediately begins - and it uses a second DfrgNtfs.exe process (the
initial CPU hogging process remains in place). If i turn the scheduled
defragmentation option back on and close the form, the 2nd DfrgNtfs.exe
process ends - leaving my initial rogue DfrgNtfs.exe process running.


It's now been an hour since i started researching this, the process is
still running, taking all of a core, and still stuck at
"HalInitializeProcessor".



So my question is: What is the proper way to stop a defragmentation pass?

Note: Things that are not proper:
killing the process
renaming DfrgNtfs.exe while in safe mode
disabling pre-fetch
disabling boot file optimization order


The real reason i noted there was a problem is that the lack of CPU cycles
was preventing the WoW client from initializing before the server decided
my client wasn't responding - and booted me. And not being able to play
WoW is serious business.


i dumped the process using Task Manager if anyone with more WinDbg
experience than me wants to take a crack at it, and i'll leave the process
permanently suspended.

 

[John Galt]

I'm on a Win Xp pro SP3 and I also have this problem with defrag.

[snip]

Then it might be wise to ask your question in an XP group, rather than
in a Vista group... whaddaya think?

 

[Tae Song]

I'm on a Win Xp pro SP3 and I also have this problem with defrag.

[snip]

Then it might be wise to ask your question in an XP group, rather than
in a Vista group... whaddaya think?

I have already done that. No solution.
I don't see anything wrong to add a note that this issue happens on XP
also.

I'm also interested in the solution for Vista.
*bump*

You could rename it, but you need to take ownership of the file first.

If you don't want to do that, you'll have to dig around the system for it
under task scheluding on XP.


For Vista:
Click on Windows Orb (Start) and type DEFRAG and start Disk Defragmenter
Uncheck "Run on a schedule (recommended)"

and then

Right-click My Computer
Select Manage
Under Computer Management (Local) // System Tools // Task Scheduler // Task
Scheduler Library // Microsoft // Windows // Defrag

Disable ScheduledDefrag


I did this for two reasons on my Vista system. It would start using up 25%
CPU on one of the cores on Q9550 Core 2 Quad while doing absolutely nothing
to the hard drive. And it also fixed a problem with the system not
responding when I was away from the keyboard for a period of time. It
stopped reading and writing to the disk, so I couldn't close or open any
applications. All I could do was move the mouse around and the system would
stop responding.