Disk activity ervery second prevents hibernation

[AlanPorter]

XP Pro SP2, latest updates

People are complaining that their notebooks are running through batteries.
Looking at what's going on with Process Monitor I notice this instance of
svchost.exe, allways the same kicking off every 4 seconds and doing a Thread
Create and a Thread Exit.
Looking at the services under that instance, I get a list of about 40.

Is there a way to find out which service is causing all those IOs ?

The file being accessed is WINDOWS\system32\config\system.log

Also explorer.exe is looking for "netshellicon" in the PATH directories and
not finding it, also about every 4 seconds.

I'd be grateful for any help (and yes Indexing is turned off)

 

[Mark L. Ferguson]

There are a number of devices that stop hibernation like that. Most common is
a camera or wireless device driver. I would temporarily disable any
unnecessary hardware in device manager to test.

 

[AlanPorter]

Great piece of advice !
I disabled pretty much everything I could including printer port and almost
all spurious IOs stopped.
By re-enabling the devices one by one, I could narrow it down to a VPN tool
called Kerio.

I still have explorer.exe doing QueryFullSizeInformationVolume once in a
while on C:\ and D:\, and svchost.exe doing FlushBuffersFile on
D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP and INDEX.MAP and
MAPPING.VER

So I'd welcome any further great ideas, and in the meantime I'll have a look
at the remaining devices, although I'm now running short of things to disable.

In any case, the most nagging issue is solved, thanks a lot.

 

[Mark L. Ferguson]

The "system32\wbem\Repository" is part of the "Windows Management
Instrumentation" (WMI). Some app might be using the Management Console to
use some "Snap In".
Start/run, type:
MMC

 

[AlanPorter]

I have noticed that these file accesses don't seem to be causing disk IOs, I
guess all those files are in the memory cache.
The problem with Kerio VPN is that it looks for files that don't exist (it
says NOT FOUND in Process Monitor) and those wouldn't be in the memory cache.
That's why XP keeps on looking for them on the disk, IMO.

If that sounds like a reasonable explanation to you, I'll leave it at that.

Thanks for you help.