Disk thrashing after reboot

[bob]

Here's my situation. After rebooting, the disk activity is so heavy
(after logging in) that I almost can't do anything until it stops. The
activity lasts anywhere from 5-10 minutes. I am able to run Process
Explorer from sysinternals and it shows that the "System" process is
the only thing occupying the CPU and that it is doing a massive amount
of writes. After the last reboot, it wrote 5 billion (yes with a "b")
bytes. However, Filemon shows little to no activity during this time
so I have no idea what file(s) the process is writing to. I just now
right-clicked on my computer to get the CPU speed and another thrashing
event occurred (5 minutes and counting). This time I can't even get
process explorer started. Anyway I have 2 GB Ram, XP sp2, indexing is
turned off, in system.ini I have ConservativeSwapFileUsage=1,
system-managed virtual memory (I've tried moving/defragging that to no
avail), and the CPU is a Pentium D 2.8Ghz. No idea what to do. Any
help would be appreciated.

Thanks,
Bob

 

[R. McCarty]

ConservativeSwapFileUsage is Registry key/value for 9X/ME. I
don't believe it applies under XP's memory management. You
may want to use Perfmon.Msc and add counters for your drives.
I'd also look at the System Event Logs and check for errors. Even
though you've disabled the Indexing service - did you remove the
Indexing attribute from the drive/volume itself ? Sometimes the
system performs "Idle Time" processing of Prefetch/Layout - but
that wouldn't normally occur at startup.

 

[bob]

I have used perfmon to some extent, but I'm not sure what counters to
use. Also how do I remove the indexing attribute from the drive?

Thanks for your input.

 

[R. McCarty]

After thinking about it, Perfmon probably won't provide the details
you need. I would instead run SysInternal's "Process Explorer" and
add 2 columns:
1.) I/O Reads
2.) I/O Writes
Using this in Real-Time monitoring mode you should be able to find
the process that's generating all the Disk I/O.

On removing the Indexing Attribute: Open Windows Explorer and
Right Click on each volume. From the context menu take Properties.
On XP NTFS volumes you'll see a check box that says
"Allow Indexing Service to index this drive......"
Remove the tic/check and apply to all. You may get a few files or
folders that are restricted - on those just click Ignore.

 

[bob]

That I did do (see first message). It is the "System" process that is
doing all the disk I/O. No process in the tree under "System" is doing
any of the I/O - it is simply the "System" process. And Filemon won't
tell me what file(s) the process is accessing.

 

[R. McCarty]

Sorry - must have missed that in the earlier posting. Is it possible you
have Offline Files enabled and perhaps a Synchronization is being done ?
Only other thing that comes to mind is how XP searches for Shared
resources at boot ( _Use Simple File Sharing ). Are you joined to any
kind of network ?

 

[Guest]

Maybe you have a filter turned on in filemon. This might prevent you from
seeing what's happening.

Just a guess.

Maybe you could see something using the sysinternals registry activity
monitor.

Another guess.

 

[bob]

I am on my own internal network, and the only filter set in Filemon is
include "*". On another board someone suggested I do away with the
swap file altogether given that I have 2GB of ram. I can't help but
think that this has something to do with the swap file.

 

[bob]

Well I guess its not the swap file. I disabled the paging file and
still had an issue, even though it did not occurr on the reboot. Now I
am running chkdsk on the disk as I am running out of ideas. I tried
searching for files modified during the last thrashing event, but
nothing looked out of the ordinary. I saw ntuser.dat and a few others.

 

[R. McCarty]

I would download/run the Raxco Perfect Disk 8.0 trial edition.
Make sure to set options and 1st do a Offline defrag followed
by an on-line. Would be interesting to see an initial fragmentation
analysis of the XP volume.

 

[bob]

I use and have used diskeeper for quite some time. It reports that the
disk fragmentation level is "healthy".