hard drive - Windows 7 svchost.exe (LocalSystemNetworkRestricted) reading/writing like crazy

24
2014-04
  • Mats Ekberg

    I'm trying to understand why my Windows 7 machine is constantly reading/writing to the HDD, making everything go slow. As you can see in the screenshot, resmon reports that there is a lot of disk activity originating from svchost.exe (pid 756). But in Process Monitor, process 756 doesn't seem to do anything at all, except the periodical profiling. How is this even possible? They seem to contradict each other?

    I'm dumbstruck. How can I look further into this problem?enter image description here

  • Answers
  • ZippyV

    There are a couple of things that Windows does in the background:

    • Search and install updates,
    • Index documents for search,
    • Prefetch frequently used files,
    • Defragment the hard drive.

    Installing updates is done by TrustedInstaller.exe so that is not your problem. I do see prefetch showing up so I'm going to assume that Windows is looking for frequently used files and load them in available memory. This way, most of your applications will start faster.

    When you install updates you might notice a slight hiccup with your pc's performance but indexing, prefetching and defragmenting are all executed using low priority i/o which means you won't notice it. The moment you do an action that requires something from the hard drive, the low priority stuff will be halted.

  • Moab

    Several sub process with the same PID can run inside of svhost.exe

    You can see what they are in task manger by right clicking on the svchost process and select go to services, this will list all the services running under that particular instance of svchost. It will highlight them for you, you may have to scroll for them to show. These are all the services running under that specific PID. Another method is to go directly to the Services Tab in Taskmanager and then click the PID column header and this will sort them, then look for your PID's

    Tracking down which service is causing the writes will require other software such as process monitor to sort that out. It is very powerful software and you would need to study up on how to use it

    enter image description here

    .

    enter image description here

  • magicandre1981

    this looks like the Superfetch service. It runs with low IO priority and doesn't impact performance of other applications.


  • Related Question

    hard drive - Windows 7 System process reading/writing like crazy
  • Mats Ekberg

    I have a problem that my windows 7 computer sometimes starts accessing the disk like crazy for maybe 10 minutes at a time. The process in question is the "system" process. I have disabled superfetch and hibernation on my computer, if that makes any difference. I disabled those to see if they were the cause of the problems, but no change. I have 6 GB of RAM and only the web browser was started when I took the screenshot, so I don't think it was thrashing due to page faults.

    Any ideas on how to find the cause of this?

    Screenshot of resmon


  • Related Answers
  • magicandre1981

    Use xperf from the WPT (part of the Windows 8 SDK) to trace disk IO:

    http://blogs.msdn.com/b/ntdebugging/archive/2009/08/17/xperf-to-investigate-slow-i-o-issues.aspx

    Run the script, minimize the CMD Window and when you have the issue again, go back to the cmd, wait 15-20s, press a key to stop logging. Open it with xperfview and look in the Disk IO graph which files the SYSTEM process writes/reads.

  • Coomie

    I had a similar problem. For me the trigger was opening IE10 (why would I use IE? I don't even know). The System process would hit the hard drive incessantly. It wouldn't freeze everything but it made the computer effectively unusable with an average disc response time of 10,000+ms.

    I found the fix at Serverfault: System process (PID 4) constantly accessing the hard disk. My summary below:

    The problem is windows update. When certain programs are started, for me it was IE10, or intermittently the system will check for updates. It takes some time and locks up the machine. To fix: deactivate updates, first for the running programs. If the problem persists, consider deactivating windows updates.