Windows 2000 Pro, System Files Mystery

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi All,

I have a somewhat perplexing problem(at least for me). I recently ran a disk defragmentation on my notebook with Win2K Pro, installed. After the initial analysis, I noticed something strange in the graphic display that was not there before. There was now a green area near the end of the right hand side of the display bar that is about 2-2.5 inches in size. This represents apparently a very large chunk on the hard drive with system files.

As I said, this was never there before. Everything "seems" to be working fine, except for one odd thing I have noticed. When I boot the machine and log onto the system, it takes much longer than it used to to authenticate me. I would say, maybe 4 or 5 seconds. This used to be almost instantly. I am not sure if it is related to the above, but is strange.

My friend has another identical notebook to mine and I compared. There is no large system file chunk. Just several scattered smaller ones as mine also has, but no large chunk. Also, his authenticates almost immediately.

Anyone have any clues what might be going on here and how to fix it?

Oh, I compared the sizes of WINNT and the WINNT\SYSTEM and WINNT\SYSTEM32 folders. While they are different in size of course between the 2 notebooks, they are fairly close. Very strange!

Any ideas? Thanks so much.
 
David,

I've never really done any checking, but I think that any files that reside in the green zone(s) aren't just system files (ie files that are in the system or system32 directories) but also include files that are open in another process or your paging file. Assuming you don't have a database or something opened in exclusive mode, I would say your paging file is making up that large chunk of unmovable hd space in the display.

Check the size of your paging file properties under system properties (hold the windows key and press pause/break) and check the size of it (can't remember which tabs under W2K, but in XP it's Advanced->Performance Settings->Virtual Memory) or you can go to your command prompt, change to the root directory on C: and type "dir /ah" (list all hidden files) -- "pagefile.sys" is your paging file. This size should roughly compare to the graphical representation (for instance, my paging file is 384MB, which is about 1.1% of my hd and compares the graphical display in disk defragmenter).

Sorry, I don't know of any other way to see which files are not moveable while defragmenting that would cause that big of a difference.

If I'm wrong about any this, sorry :)

Another thought I had and haven't been able to confirm is that the hibernation file (hidden in the root directory as "hiberfil.sys") is also unmovable. Can anyone confirm/deny this?

Paul K
 
Paul,
Thank you so much for the info. You may be on to something. I will check it out. I do know my notebook has 512MB of RAM versus my friend who has 128. That might account for a difference in paging files. However, why would it show up all of a sudden?

Also, I remember in the past when I added the 512mb, I went to change the page file by increasing it to 1.5 times the ram value and the machine gave me a BSOD. So, I just left the page file at 192mb that it was set at.

As far as the hiberfil.sys file goes, that shows up as an area of blue on the display because, I have had to reconfigure this before and when I was done it took a very large chunk of blue on the right hand side of the display and reduced it.

Any idea what might be causing the logon delay, all of a sudden?

Thanks again..
 
That new delay of 4-5 seconds might be due to 'thrashing' - the
situation where the system spends a good deal of time waiting while a
very large number of disk accesses occurs (and in the past the # of file
accesses required to do the task were much fewer.) It's possible that
your pagefile capacity is so much smaller than it should be that that's
the cause.

It's also possible that somehow your recent activity, or even the defrag
you ran itself, resulted in extremely inefficient and/or highly
fragmented file layouts on the partition(s). Several seconds' worth of
additional accesses could result.

And there's a (hopefully remote) chance that you're seeing distant early
warning signs of a failing drive, which could be causing "invisible"
hardware access retries; such retry routines are built into the
controller/drive ROM and generally are not detectable by the OS, which
just sits around waiting for an ultimate 'completed' or 'failed'
response to its 'get' or 'put' command. It would appear that if this is
the case, so far the ultimate result has always been successful
completion, unless there's something else you haven't told us.
 
Dan,

Thanks for the response. Well, I hope the drive isn't crashing. When I go to log in you can see there is a wait state as the hourglass sits there foir about 4 seconds.

Well, the pagefile is at 192mb and with 512mb ram installed the OS reccommends about 768mb. When I tried once to increase the amount after adding the new ram, it gave me a BSOD. Still not sure why though. This delay problem began before the defrag. I only noiticed the large area of grren on the right handside of the display bar when I did the defrag and then I started to put things together, possibly.

Any more thoughts? Thanks.
 
Try this from the Recovery Console
http://support.microsoft.com/?id=255205

Can be done sometime by setting both Initial and Maximum to zero and booting and
resetting to 2 times RAM.

If that doesn't work, there is a registry hack to handle it, but you will need
to give NTAUTHORITY/system full control of %SystemRoot% and the directory
pagefile.sys is located at least. This doesn't generally cause loss of security.

--
:o)
don
---------




I
Dan,

Thanks for the response. Well, I hope the drive isn't crashing. When I go to log
in you can see there is a wait state as the hourglass sits there foir about 4
seconds.

Well, the pagefile is at 192mb and with 512mb ram installed the OS reccommends
about 768mb. When I tried once to increase the amount after adding the new ram,
it gave me a BSOD. Still not sure why though. This delay problem began before
the defrag. I only noiticed the large area of grren on the right handside of the
display bar when I did the defrag and then I started to put things together,
possibly.

Any more thoughts? Thanks.
 
Hi dcdon,

Thanks for the tip. By the way are you saying to first try setting the min and max pagefile to zero using the GUI in the OS, reboot, then try resetting and if that fails, try deleting the pagefile via the Recovery Console as mentioned in thr KB link you gave?

Seems strange that when I try to reset the pagefile it gave me a BSOD. I think the problems may have begun after that, but cannot rember the timing. By the way a friend of mine said if I am running 512mb ram and the pagefile is still set to 192mb, don't worry about it, because with that much ram it is not likely it will even use the pagefile. Any thoughtts on that?

Also with 512MB of RAM, what would you recommend as the initial and maximum sizes to use for the pagefile?

Thanks so much. I hope I can get toi the bottom of this.
 
David,

After entering the Recovery Console the way to delete the pagefile.sys is to
write over it with a file like boot.ini and then delete that file.
Then you will be able to rebuild it.

I finally found the KB for that
http://support.microsoft.com/?kbid=259151

--
:o)
don
---------




Hi dcdon,

Thanks for the tip. By the way are you saying to first try setting the min and
max pagefile to zero using the GUI in the OS, reboot, then try resetting and if
that fails, try deleting the pagefile via the Recovery Console as mentioned in
thr KB link you gave?

Seems strange that when I try to reset the pagefile it gave me a BSOD. I think
the problems may have begun after that, but cannot rember the timing. By the way
a friend of mine said if I am running 512mb ram and the pagefile is still set to
192mb, don't worry about it, because with that much ram it is not likely it will
even use the pagefile. Any thoughtts on that?

Also with 512MB of RAM, what would you recommend as the initial and maximum
sizes to use for the pagefile?

Thanks so much. I hope I can get toi the bottom of this.
 
If you're still ahving trouble after this, just let me know.

--
:o)
don
---------



David,

After entering the Recovery Console the way to delete the pagefile.sys is to
write over it with a file like boot.ini and then delete that file.
Then you will be able to rebuild it.

I finally found the KB for that
http://support.microsoft.com/?kbid=259151

--
:o)
don
---------




Hi dcdon,

Thanks for the tip. By the way are you saying to first try setting the min and
max pagefile to zero using the GUI in the OS, reboot, then try resetting and if
that fails, try deleting the pagefile via the Recovery Console as mentioned in
thr KB link you gave?

Seems strange that when I try to reset the pagefile it gave me a BSOD. I think
the problems may have begun after that, but cannot rember the timing. By the way
a friend of mine said if I am running 512mb ram and the pagefile is still set to
192mb, don't worry about it, because with that much ram it is not likely it will
even use the pagefile. Any thoughtts on that?

Also with 512MB of RAM, what would you recommend as the initial and maximum
sizes to use for the pagefile?

Thanks so much. I hope I can get toi the bottom of this.
 
Hi Rick,

There has been some issues with Virtual Memory. I don't know if it is UpDate
related or possibly infection. There is one KB on resetting the pagefile.sys.

Here it is: http://support.microsoft.com/?kbid=257758

This is more likely for rebuilding after the system has created temppf.sys. You
can do a search, but you have to be able to see system files. To do that look in
Folder Options in Control Panel. It's under general[tab].

There is another work around, if there is no temppf.sys created. The reason, you
can not delete the pagefile.sys. You will have to do that from the Restoration
Console by overwriting the file with say the boot.ini.

But I have another idea first. You can try resetting the virtual Memory size to
below the minimum MS recommends, like 31 MB for both and reboot. Then search for
temppf.sys then. If it shows, you are free to nuke pagefile.sys, so try 257758.

If you can't get it from there here is a KB for clearing pagefile.sys.
http://support.microsoft.com/?kbid=314834

If you have trouble, I am going to give you the instructions to rebuild
pagefile.sys.

--
good computing,
don
--------

If you're still ahving trouble after this, just let me know.

--
:o)
don
---------



David,

After entering the Recovery Console the way to delete the pagefile.sys is to
write over it with a file like boot.ini and then delete that file.
Then you will be able to rebuild it.

I finally found the KB for that
http://support.microsoft.com/?kbid=259151

--
:o)
don
---------




Hi dcdon,

Thanks for the tip. By the way are you saying to first try setting the min and
max pagefile to zero using the GUI in the OS, reboot, then try resetting and if
that fails, try deleting the pagefile via the Recovery Console as mentioned in
thr KB link you gave?

Seems strange that when I try to reset the pagefile it gave me a BSOD. I think
the problems may have begun after that, but cannot rember the timing. By the way
a friend of mine said if I am running 512mb ram and the pagefile is still set to
192mb, don't worry about it, because with that much ram it is not likely it will
even use the pagefile. Any thoughtts on that?

Also with 512MB of RAM, what would you recommend as the initial and maximum
sizes to use for the pagefile?

Thanks so much. I hope I can get toi the bottom of this.
 
Hi again dcdon,

Thanks so myuch for your great input! Well, unfortunately where I am located right now, I do not have my notebook to try tweaking the paging file. However, I will be able to try it tomorrow. I think I will try the easiest route first and try setting the page file initial and max to zero through the GUI and reboot and see what happens.

Oh, by the way, if I need to use thge Recovery Console, don't I need to first install that from the support tools on a Win2K CD?

Also, do yoiu think that the page file might be causing the log on to take so long? I can't see why that should be the case, but who knows.

Anyway, I will keep plugging away, something is causing that big green chunk on the defrag display too, not sure if it is paging file or hibernation file related, but I hope I can get to the route of the problem.

I will keep you posted. Thanks again.
 
Just an update: I was able to first delete and the recreate my hibernation file. I then followed dcdon's advice set the page file to zero rebooted and was able to create a new pagefile of a larger size. I now have a minimum page file of 768mb for the 512mb RAM, I have onboard. That is equivalent to RAM X 1.5

i am not sure why MS suggests a larger page file with more ram, since it is less likely you will ever need to access it

However, while I was able to successfully change the pagefile etc. I still have that very large grreen chunk after doing a defrag, on the right side of the display bar and my log on still takes about 5 seconds to authenticate, which is slower than it used to

Any more ideas?
 
David,

The "green" system files that the built-in defragmenter refers to covers
everything from the $MFT to the non-$MFT metadata. The built-in
defragmenter doesn't provide provide a breakdown so you'll never be able to
know for sure exactly what all of those "green" files are.

- Greg/Raxco Software
Microsoft MVP - Windows File System

Disclaimer: I work for Raxco Software, the maker of PerfectDisk - a
commercial defrag utility, as a systems engineer in the support department.

Want to email me? Delete ntloader.

David said:
Just an update: I was able to first delete and the recreate my hibernation
Click to expand...
file. I then followed dcdon's advice set the page file to zero rebooted and
was able to create a new pagefile of a larger size. I now have a minimum
page file of 768mb for the 512mb RAM, I have onboard. That is equivalent to
RAM X 1.5.
i am not sure why MS suggests a larger page file with more ram, since it
Click to expand...
is less likely you will ever need to access it.
However, while I was able to successfully change the pagefile etc. I
Click to expand...
still have that very large grreen chunk after doing a defrag, on the right
side of the display bar and my log on still takes about 5 seconds to
authenticate, which is slower than it used to.
 
Hi Greg

Thanks for the info. Well, I suspected what you said, but still cannot explain the sudden increase in saize of this green chunk. Also, before most of the system files were scattered in smaller chunks, mostly towards the left hand side of the display. Now, only 2 small chunks of green on the left, the page file in the middle anbd the large chuink on the right. Also, log on locally seems more slkuggish than before

By the way, I have tried your trial defragger on another machine in the past. It seemed very nice! Thanks.
 
Back
Top