Using Task Manager to find cause of hard drive activity

Every once in a while, my Firefox browser becomes non responsive to
mouse inputs; this could last for as much as 60 seconds. Every time this
happens, the hard drive activity light is on. The Performance tab of TM
shows the Activity Time for the C: as 100%. When I switch to the
Processes tab, nothing to my amateur eye look out of place as to cause
so much hard drive activity. Memory usage is about 92%.

There seems to be some kind of automatic background activity going on
that has higher priority than mouse inputs. If W8.1 (or any other of my
programs) were the cause, could I tell from the Processes tab which was
doing it? Where given an option, I don't allow automatic updates. I
don't know if I have that control over W8.1.

Is there a way of elevating mouse priority to the top of the heap?

Thanks,

R1

Rebel1 wrote:
Every once in a while, my Firefox browser becomes non responsive to
mouse inputs; this could last for as much as 60 seconds. Every time this
happens, the hard drive activity light is on. The Performance tab of TM
shows the Activity Time for the C: as 100%. When I switch to the
Processes tab, nothing to my amateur eye look out of place as to cause
so much hard drive activity. Memory usage is about 92%.

There seems to be some kind of automatic background activity going on
that has higher priority than mouse inputs. If W8.1 (or any other of my
programs) were the cause, could I tell from the Processes tab which was
doing it? Where given an option, I don't allow automatic updates. I
don't know if I have that control over W8.1.

Is there a way of elevating mouse priority to the top of the heap?

Thanks,

R1

If you had a bad sector on a hard drive, it could take up to 15 seconds
for an ordinary desktop drive to give up on it, so that wouldn't
account for 60 seconds. If you were dealing with four bad sectors
in a row, I don't know how many cycles you'd get between the
handling of each bad sector. And the delay in such a case, would
vary with the mood the disk was in.

Other than that, software developers are proud of their ability to
keep as many kernel actions as possible "non-blocking". So if you
manage to tie things in knots for 60 seconds, it would be a really
unusual exception condition, or, it could be that only the GUI is
non-responsive, and the OS itself is running fine. Sometimes, you
can check for this, by using "ping" from a second computer,
and see if the ping is returned with ~1 millisecond latency on
your LAN (the response should be practically instantaneous).

The easiest way to test for that, would be to leave a copy of ping
running in repetitive mode. Some OSes, repetition is the default
operating mode of "ping". On others, it only sends four packets.
And to have it ready to go, it's better to just leave it pinging
the machine continuously.

I would probably try Process Monitor, that is, if the problem is reproducible.
The trace collects ETW events. They can be stored in RAM (which won't
disturb your disk symptoms). Or, the trace can be recorded to disk, but
then you might get pollution of the trace.

The largest trace I've ever run, took 9GB to store, and was collected
on a 64 bit OS, by the 64 bit version of Procmon. If you save a trace
like that, it can only be opened on a 64 bit machine. (Procmon is a
clever little program, that unpacks and launches the right version
when you start it. So you don't have to worry about what to do.
Just click and away you go.)

https://technet.microsoft.com/en-us/...rnals/bb896645

What you would look for in the trace, is readfile and writefile activity.
And try and figure out from the filename, what activity was going on
at the time. If you have a bad sector, perhaps the LED stays
on for a whole 15 seconds ?

In the case of my 9GB trace, I captured all activity during a backup
session. Since I knew the event I was looking for, was near the extreme
ends of the trace, it wasn't that hard to find what I was looking for. If
the event was somewhere in the middle of the 9GB trace, I'd never find
it by scrolling around in there.

Chances are, the kernel is blocked somehow, rather than this being
a regular "busy CPU" problem. If that were to happen, there might not
be an ETW events to trace, and Process Monitor trace might be "very
quiet" during the 60 second interval. Which still tells you something.

In a given second, you might see as many as 200 registry read operations,
so the trace is normally never quiet. Even when the desktop is idle,
you'll see 200 registry accesses a second. Over and over again.

Windows 8 and Windows 10, do not have particularly effective Task Managers,
and if the machine is under stress, you cannot successfully issue commands
from Task Manager to regain control. Windows 8 is the first OS in a long
long time, where I had to use the power switch to regain control. I was
testing a program that leaks Paged Pool, and when the OS runs out of
Paged Pool, things kinda go to hell. If Paged Pool is low, Task Manager
itself uses 35 percent of the CPU, just measuring how much Paged Pool is
being used. I was not able to kill the program that was leaking
Paged Pool. I spent about an hour trying to use cursor keys to work
the Task Manager interface, but the lag and overshoot made it impossible
to do anything. So I had to power cycle. So in terms of how "well behaved"
the OS is, this isn't WinXP by any stretch of the imagination. The theory
says it shouldn't block - the last significant behavior I saw like
that, was certain networking calls in Win98, which could lock
things up.

Using 7ZIP as a test case, if you start compressing
a large file, and you use as many threads of execution
as possible, Windows 8 program loader won't be able to
start a new program for around 60 seconds. So Windows 8
has relatively poor balance, between new program loading
and existing program execution. Windows 10 fixes this,
and gets the time down into the more reasonable 5-10
second range. While I'm not overjoyed with the result,
I an pleased that they tried to fix it. I get 50 seconds
of my life back :-)

There are other debugging techniques. You can use two
computers. Run Microsoft Windbg on one machine, and
use a serial (RS232) cable to connect to the defective
machine. So it is possible, to attempt to remote debug a
machine with a "broken GUI". But I've never had the
need to do that, and just getting that set up would
probably take you all week :-) And there is no real
way to guess whether you could spot anything useful
that way. If the debugger would not respond during the
60 second interval, at least you'd know things
were seriously borked.

Paul

4.7.2015, 4:15, Paul kirjoitti:
Rebel1 wrote:
Every once in a while, my Firefox browser becomes non responsive to
mouse inputs; this could last for as much as 60 seconds. Every time
this happens, the hard drive activity light is on. The Performance tab
of TM shows the Activity Time for the C: as 100%. When I switch to the
Processes tab, nothing to my amateur eye look out of place as to cause
so much hard drive activity. Memory usage is about 92%.

There seems to be some kind of automatic background activity going on
that has higher priority than mouse inputs. If W8.1 (or any other of
my programs) were the cause, could I tell from the Processes tab which
was doing it? Where given an option, I don't allow automatic updates.
I don't know if I have that control over W8.1.

Is there a way of elevating mouse priority to the top of the heap?

Thanks,

R1

If you had a bad sector on a hard drive, it could take up to 15 seconds
for an ordinary desktop drive to give up on it, so that wouldn't
account for 60 seconds. If you were dealing with four bad sectors
in a row, I don't know how many cycles you'd get between the
handling of each bad sector. And the delay in such a case, would
vary with the mood the disk was in.

Other than that, software developers are proud of their ability to
keep as many kernel actions as possible "non-blocking". So if you
manage to tie things in knots for 60 seconds, it would be a really
unusual exception condition, or, it could be that only the GUI is
non-responsive, and the OS itself is running fine. Sometimes, you
can check for this, by using "ping" from a second computer,
and see if the ping is returned with ~1 millisecond latency on
your LAN (the response should be practically instantaneous).

The easiest way to test for that, would be to leave a copy of ping
running in repetitive mode. Some OSes, repetition is the default
operating mode of "ping". On others, it only sends four packets.
And to have it ready to go, it's better to just leave it pinging
the machine continuously.

I would probably try Process Monitor, that is, if the problem is
reproducible.
The trace collects ETW events. They can be stored in RAM (which won't
disturb your disk symptoms). Or, the trace can be recorded to disk, but
then you might get pollution of the trace.

The largest trace I've ever run, took 9GB to store, and was collected
on a 64 bit OS, by the 64 bit version of Procmon. If you save a trace
like that, it can only be opened on a 64 bit machine. (Procmon is a
clever little program, that unpacks and launches the right version
when you start it. So you don't have to worry about what to do.
Just click and away you go.)

https://technet.microsoft.com/en-us/...rnals/bb896645

What you would look for in the trace, is readfile and writefile activity.
And try and figure out from the filename, what activity was going on
at the time. If you have a bad sector, perhaps the LED stays
on for a whole 15 seconds ?

In the case of my 9GB trace, I captured all activity during a backup
session. Since I knew the event I was looking for, was near the extreme
ends of the trace, it wasn't that hard to find what I was looking for. If
the event was somewhere in the middle of the 9GB trace, I'd never find
it by scrolling around in there.

Chances are, the kernel is blocked somehow, rather than this being
a regular "busy CPU" problem. If that were to happen, there might not
be an ETW events to trace, and Process Monitor trace might be "very
quiet" during the 60 second interval. Which still tells you something.

In a given second, you might see as many as 200 registry read operations,
so the trace is normally never quiet. Even when the desktop is idle,
you'll see 200 registry accesses a second. Over and over again.

Windows 8 and Windows 10, do not have particularly effective Task Managers,
and if the machine is under stress, you cannot successfully issue commands
from Task Manager to regain control. Windows 8 is the first OS in a long
long time, where I had to use the power switch to regain control. I was
testing a program that leaks Paged Pool, and when the OS runs out of
Paged Pool, things kinda go to hell. If Paged Pool is low, Task Manager
itself uses 35 percent of the CPU, just measuring how much Paged Pool is
being used. I was not able to kill the program that was leaking
Paged Pool. I spent about an hour trying to use cursor keys to work
the Task Manager interface, but the lag and overshoot made it impossible
to do anything. So I had to power cycle. So in terms of how "well behaved"
the OS is, this isn't WinXP by any stretch of the imagination. The theory
says it shouldn't block - the last significant behavior I saw like
that, was certain networking calls in Win98, which could lock
things up.

Using 7ZIP as a test case, if you start compressing
a large file, and you use as many threads of execution
as possible, Windows 8 program loader won't be able to
start a new program for around 60 seconds. So Windows 8
has relatively poor balance, between new program loading
and existing program execution. Windows 10 fixes this,
and gets the time down into the more reasonable 5-10
second range. While I'm not overjoyed with the result,
I an pleased that they tried to fix it. I get 50 seconds
of my life back :-)

There are other debugging techniques. You can use two
computers. Run Microsoft Windbg on one machine, and
use a serial (RS232) cable to connect to the defective
machine. So it is possible, to attempt to remote debug a
machine with a "broken GUI". But I've never had the
need to do that, and just getting that set up would
probably take you all week :-) And there is no real
way to guess whether you could spot anything useful
that way. If the debugger would not respond during the
60 second interval, at least you'd know things
were seriously borked.

Paul


How much would memory swapping cause?? OP did state mem usage at 92%...

--
-----------------------------------------------------
Thomas Wendell
Helsinki, Finland
Translation to/from FI/SWE not always accurate
-----------------------------------------------------

tumppiw wrote:
4.7.2015, 4:15, Paul kirjoitti:
Rebel1 wrote:
Every once in a while, my Firefox browser becomes non responsive to
mouse inputs;
FWIW, this has happened to me once, possibly twice over the last 6
months. I just close it and reopen it. I spent much 10,000 times as
much time screwing around with why Norton Antivirus updates would
consistently give me the bluescreen on updates almost everyday (while
the computer was asleep). No more Norton, no more problems.

Update from MS Windows 7 to MS Windows 10? -- When they make an effort
to make better use of my multicore processor (parallelism)--I mean geeze!

Bill

On 7/4/2015 3:26 AM, Bill wrote:
tumppiw wrote:
4.7.2015, 4:15, Paul kirjoitti:
Rebel1 wrote:
Every once in a while, my Firefox browser becomes non responsive to
mouse inputs;
FWIW, this has happened to me once, possibly twice over the last 6
months. I just close it and reopen it. I spent much 10,000 times as
much time screwing around with why Norton Antivirus updates would
consistently give me the bluescreen on updates almost everyday (while
the computer was asleep). No more Norton, no more problems.

Update from MS Windows 7 to MS Windows 10? -- When they make an effort
to make better use of my multicore processor (parallelism)--I mean geeze!

Bill

They want the masses to become beta testers.

http://www.tomshardware.com/news/mic...159,29486.html

Al Drake wrote:
On 7/4/2015 3:26 AM, Bill wrote:
tumppiw wrote:
4.7.2015, 4:15, Paul kirjoitti:
Rebel1 wrote:
Every once in a while, my Firefox browser becomes non responsive to
mouse inputs;
FWIW, this has happened to me once, possibly twice over the last 6
months. I just close it and reopen it. I spent much 10,000 times as
much time screwing around with why Norton Antivirus updates would
consistently give me the bluescreen on updates almost everyday (while
the computer was asleep). No more Norton, no more problems.

Update from MS Windows 7 to MS Windows 10? -- When they make an effort
to make better use of my multicore processor (parallelism)--I mean
geeze!

Bill

They want the masses to become beta testers.

http://www.tomshardware.com/news/mic...159,29486.html



I want to hear them talk about parallelism in their announcements, not
new buttons!
If the problem too difficult for them, maybe they are in the wrong
business. If I was working
there, I would have at least made progress on the problem by now! ; )

On Fri, 03 Jul 2015 20:15:34 -0400, Rebel1
wrote:

Every once in a while, my Firefox browser becomes non responsive to
mouse inputs; this could last for as much as 60 seconds. Every time this
happens, the hard drive activity light is on. The Performance tab of TM
shows the Activity Time for the C: as 100%. When I switch to the
Processes tab, nothing to my amateur eye look out of place as to cause
so much hard drive activity. Memory usage is about 92%.

There seems to be some kind of automatic background activity going on
that has higher priority than mouse inputs. If W8.1 (or any other of my
programs) were the cause, could I tell from the Processes tab which was
doing it? Where given an option, I don't allow automatic updates. I
don't know if I have that control over W8.1.

Is there a way of elevating mouse priority to the top of the heap?


Try the freeware version of Process Lasso. It doesn't elevate the
mouse, what it does is to restrict free-wheeling programming radicals'
liberal libidinal gratifications.

Might check your virtual memory page usage/assignment, as well
adequate physical memory population.

Not that I know squat about W8.1, not when I avoid W7 as much as
possible while delaying exploring WINE for salvaging what's left, that
I can, from Microsoft's OS ****storms. (Of course, there's no excuse
for me not to know, whatever else *nix may, or not, provide, given a
tradition in MS dealings.)

IOW, I would presume Process Lasso is up to par for W8.1
comparability;- A hot program and presently very popular. I also use
it even if I needn't really. Might help in organizing your resource
draws.

On 7/4/2015 4:46 AM, Bill wrote:
Al Drake wrote:
On 7/4/2015 3:26 AM, Bill wrote:
tumppiw wrote:
4.7.2015, 4:15, Paul kirjoitti:
Rebel1 wrote:
Every once in a while, my Firefox browser becomes non responsive to
mouse inputs;
FWIW, this has happened to me once, possibly twice over the last 6
months. I just close it and reopen it. I spent much 10,000 times as
much time screwing around with why Norton Antivirus updates would
consistently give me the bluescreen on updates almost everyday (while
the computer was asleep). No more Norton, no more problems.

Update from MS Windows 7 to MS Windows 10? -- When they make an effort
to make better use of my multicore processor (parallelism)--I mean
geeze!

Bill

They want the masses to become beta testers.

http://www.tomshardware.com/news/mic...159,29486.html



I want to hear them talk about parallelism in their announcements, not
new buttons!
If the problem too difficult for them, maybe they are in the wrong
business. If I was working
there, I would have at least made progress on the problem by now! ; )



Their business is to sell as much as they can so they have to spin to
the majority which is dumbing down more and more as time goes on.


Hmmmm..............Me like buttons..........More buttons.....

Al Drake wrote:
On 7/4/2015 4:46 AM, Bill wrote:
Al Drake wrote:
On 7/4/2015 3:26 AM, Bill wrote:
tumppiw wrote:
4.7.2015, 4:15, Paul kirjoitti:
Rebel1 wrote:
Every once in a while, my Firefox browser becomes non responsive to
mouse inputs;
FWIW, this has happened to me once, possibly twice over the last 6
months. I just close it and reopen it. I spent much 10,000 times as
much time screwing around with why Norton Antivirus updates would
consistently give me the bluescreen on updates almost everyday (while
the computer was asleep). No more Norton, no more problems.

Update from MS Windows 7 to MS Windows 10? -- When they make an effort
to make better use of my multicore processor (parallelism)--I mean
geeze!

Bill

They want the masses to become beta testers.

http://www.tomshardware.com/news/mic...159,29486.html




I want to hear them talk about parallelism in their announcements, not
new buttons!
If the problem too difficult for them, maybe they are in the wrong
business. If I was working
there, I would have at least made progress on the problem by now! ; )



Their business is to sell as much as they can so they have to spin to
the majority which is dumbing down more and more as time goes on.
Yes, I find it annoying to see. And they need to label it a new
version? Is it too much trouble to improve the OS when they create a
new version... sorry, it just bugs me

Bill

On 7/4/2015 5:41 PM, Bill wrote:
Al Drake wrote:
On 7/4/2015 4:46 AM, Bill wrote:
Al Drake wrote:
On 7/4/2015 3:26 AM, Bill wrote:
tumppiw wrote:
4.7.2015, 4:15, Paul kirjoitti:
Rebel1 wrote:
Every once in a while, my Firefox browser becomes non responsive to
mouse inputs;
FWIW, this has happened to me once, possibly twice over the last 6
months. I just close it and reopen it. I spent much 10,000 times as
much time screwing around with why Norton Antivirus updates would
consistently give me the bluescreen on updates almost everyday (while
the computer was asleep). No more Norton, no more problems.

Update from MS Windows 7 to MS Windows 10? -- When they make an effort
to make better use of my multicore processor (parallelism)--I mean
geeze!

Bill

They want the masses to become beta testers.

http://www.tomshardware.com/news/mic...159,29486.html




I want to hear them talk about parallelism in their announcements, not
new buttons!
If the problem too difficult for them, maybe they are in the wrong
business. If I was working
there, I would have at least made progress on the problem by now! ; )



Their business is to sell as much as they can so they have to spin to
the majority which is dumbing down more and more as time goes on.
Yes, I find it annoying to see. And they need to label it a new
version? Is it too much trouble to improve the OS when they create a
new version... sorry, it just bugs me

Bill

No apology needed. It bugs me too. The older I get the more things like
this do bug me. Dumb bugs me even more. This is why we're where we are
now. Dumb bugs.

It get easier all the time to make things idiot proof. They continue
to make bumber idiots.