Excessive hard drive activity

[Wally E]

My desktop home PC is running XP Professional SP3. The HDD activity light on
the front of the case flashes constantly at the rate of about one quick flash
per second.

This does not really affect the speed of the machine, but as a result of the
constant activity, the hard disk will not turn off at the delay specified in
Control Panel/Power options.

I have 2 GB of ram, and the I have the page file size set to "system managed".

The problem is constantly there even with no aplications running. I don't
think this is a problem due to lack of memory.

What can be causing this activity? Where do I start looking?

Any help appreciated.

 

[JS]

Is this a new problem that just started?
If so see below.

You need to find and identify the specific process or application that's
runs every second or so. You can do this with Windows Task Manager
(Ctrl+Alt+Del key), select the Processes Tab,
Next, click on the CPU column twice, this should bring the System Idle
process to the top (as long as you are not using any other applications).
Then about every few seconds you should see another process
(the one that's slowing down your PC) float to or near the top of the list.

For more exploratory and detailed look, download and try Process Explorer:
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Once you have Process Explorer installed and running:
In the taskbar menu select View and check 'Show Process Tree'
and 'Show Lower Pane' options.
(This will provide the detailed info you need)

Next click on the CPU column to sort processes by %CPU usage.
Every few seconds you should see another process (the one that's slowing
down your PC) float to or near the top of the list.

Now quickly click (before it drops back down the list) on the process
of interest that's listed in the CPU % column.
An alternate method of identifying the process causing the CPU usage
to spike is to double click on the Graph just below the Menu bar.
This will open the 'System Information' window, which has a larger
display of all three graphs. Now move your mouse over any spike in the
CPU Usage graph to see what process/application or service is the
cause of the spike.

Notes:
1) Some entries like Explorer and svchost may need to be expanded
to show the detail, (sub processes), in this case click on the + located
to the left of the entry.

2) Once you select/highlight a process, right click and from the
options listed select the: 'Search Online' option.
This should display what out there on the web about that process.

 

[Twayne]

My desktop home PC is running XP Professional SP3. The HDD activity
light on the front of the case flashes constantly at the rate of
about one quick flash per second.

This does not really affect the speed of the machine, but as a result
of the constant activity, the hard disk will not turn off at the
delay specified in Control Panel/Power options.

I have 2 GB of ram, and the I have the page file size set to "system
managed".

The problem is constantly there even with no aplications running. I
don't think this is a problem due to lack of memory.

What can be causing this activity? Where do I start looking?

Any help appreciated.

No, it's not lack of RAM.
There could be quite a few things causing that, all of them normal. And
a few not so normal of course, but if as you say everything is working
fine, you most likely can troubleshoot at your leisure and use it as a
learning expedition. Some possibilities, and things you can research
easily with a search engine are:

-- Have you changed anything at all on the machine just before that
started?
-- Indexing is working to index the files on the drives. You could
turn it off if you want; it's not critical but sometimes can be useful;
depends on how you use the machine.
-- You may have antivirus checks going on. Many operate in the
background and when the machine is "idle", e.g. the user is not doing
anything.
-- It could be idle time being used to defrag the drive when the
computer isn't in use.
-- You could have sometign set to check for updates periodically and
it's set wrong.
-- there could be a problem somewhere and it's writing error events to
the Event Viewer logs, or warnings, or just plain recording every event
on the computer, depending on the settings.
-- You could have several other background tasks running that your'e
not aware of and could turn off; check them out.

There are a lot more possibilities, but in general it's not a bad thing.
Being aware of what IS causing the periodic activity is a good thing,
and helps you to know what's up in your system. So, in my case, I would
(and did in years past) use as an excuse to learn how to troubleshoot
various areas of the operatng system. Just be certain you BACK UP your
important data first, that's all, just in case you get a finger-flip
that does someting unintended<g>?
And, if you aren't backing up regularly on a schedule, you should
actually make learning about backups and how to do them reliable your
first project! Without a backup you can lose everything in the blink of
an eye.

HTH

Twayne

 

[VanguardLH]

My desktop home PC is running XP Professional SP3. The HDD activity
light on the front of the case flashes constantly at the rate of
about one quick flash per second. ...

Did you install or enable any file indexer programs, like MS Search,
Google Desktop, or Copernic?

 

[JS]

If there is, it's most likely registry activity.

 

[VanguardLH]

If there is, it's most likely registry activity.

During Windows boot, the registry is read from the .dat files and copied
into memory. Thereafter, Windows and applications access the registry
from the memory copy, not from the .dat files on the hard disk. They
may add or change values but those are to the memory copy (which Windows
will refresh back to the .dat files on the disk).

This is why defragmenting the memory or compacting it by removing
orphaned entries does NOT speed up Windows. Memory is random for reads:
one byte reads as fast as another. Reducing the size of the .dat files
for the registry and defragmenting them only helps during bootup of
Windows when it reads the registry to copy it into memory.

http://www.dfrws.org/2008/proceedings/p26-dolan-gavitt.pdf
Section 3 discusses the Configuration Manager used to manage the
registry that has been copied into memory.

Windows Kernel-Mode Configuration Manager
http://msdn.microsoft.com/en-us/library/cc264540.aspx

Configuration Manager Programming Fundamentals
http://msdn.microsoft.com/en-us/library/cc143918.aspx
Configuration Manager Reference
http://msdn.microsoft.com/en-us/library/cc144814.aspx
Maybe some programmer can make sense of this stuff to figure out just
when the CM decides to refresh the .dat files after registry additions
or changes.

 

[JS]

If you are using any Symantec security application,
this could be the cause of the problem.

I tracked down the "one quick flash per second"
hard disk activity to a process named "ccSvcHst.exe"
which performs a "Read File" and a Registry Query Value"
about one per second.

Note: The 'ccSvcHst.exe' process can not be stopped
or disabled since it apparently is the heart of this security
software.

All three computers have NIS 2009 installed.
2 of the 3 computers have the drive light flashing,
the third and older P3 933Mhz PC does not show
the drive light flashing although the same activity is
occurring.

I used Process Monitor to track the problem.
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Be aware that there may be other activity which occurred at about
the same frequency and you will need to use "msconfig" to disable
one at a time, reboot, run Process Monitor and repeat this process
until you isolate the culprit.

 

[Twayne]

During Windows boot, the registry is read from the .dat files and
copied into memory. Thereafter, Windows and applications access the
registry from the memory copy, not from the .dat files on the hard
disk. They may add or change values but those are to the memory copy
(which Windows will refresh back to the .dat files on the disk).

There is a lot more going on than working with only the .dat files.
Not just .dat files; many other TLDs may be involved too. But otherwise
correct: Overall, the actual "registry" only exists in memory in the
strict sense. Data writes to the disk, or needed reads from the disk
can happen often and do, but it's not usually something to cause the
described symptoms here.

This is why defragmenting the memory or compacting it by removing
orphaned entries does NOT speed up Windows. Memory is random for
reads: one byte reads as fast as another. Reducing the size of the
.dat files for the registry and defragmenting them only helps during
bootup of Windows when it reads the registry to copy it into memory.

Wellll, sort of. If that's the only part of the picture you consider,
and the reads/writes are onesie/twosie affairs, it would hold up. And
in the overall scheme of things, it does hold up most of the time. It
does not have to though; Some instances can require thousands of
read/writes to the registry during operation and you can even come upon
the default 20S wait period for something to appear to the OS but does
not create an error message, but instead a simple info or warning log
entry.
It's necessary to consider the whole picture when one gets into these
areas, not just a nominal and/or theoretical case.

That said, I think the links below are pretty good ones from MS although
not really 100% applicable in this case. They are good links, though.

Twayne