Windows 10: Random spikes of 100% disk activity on system drive.

Hello,

I am having issues with my system, or it might be my SSD, I am unsure hence here I am.

Symptoms:
The C:\ drive spikes to 100% activity but 0 avg respone, 0 read/write for 2-5 seconds (usually but it have taken over 40 seconds at a couple of occasions) followed by 5k+ ms respons and then back to normal operation. Most explorer relates things become unresponsive during these spikes like moving windows opening the start menu, scrolling a page in chrome. While other activities like a youtube video being unaffected as long as it has buffered. If another one of my drives are doing anything when a spike occurs they become inactive until the spike is over.

When:
The spikes happen mostly at random intervals, and seemingly after the system have been running for 4+, or so, hours they are gone. But if I open a program or a file explorer it can sometimes invoke but it is not something I can reproduce on command.

Different games seem to be affected differently Arma 3 does not like the spikes at all and seems to be a grand invoker of them. EVE ONLINE does not either like them. While Counter-Strike: Global Offensive does not appear to be affected by the spike at all, neither is Dota 2. [To clarify the spikes still happen but they do not interrupt these two Source engine games.]

They also appear to happen in safe mode so it should not be a 3rd party software issue I think.

I also can't seem to identify if it's a certain process that is causing it.

When did it start:
As far as I can tell it started as soon as I upgraded to Win 10 from Win 7.

Background:
I was going to replace most of the parts in my computer so I waited with my upgrade. On the advice from Microsoft support I installed the new parts and then did a clean install of Win 7 which I immediately upgraded to Win 10 using Windows Media Tool(I think it's called).

Changes between the two computers: New CPU, Motherboard, Ram and I removed a 80gb SSD and replaced it with the Samsung EVO 500gb. The same 240gb INTEL SSDSC2CW240A3 is still the System Drive.

What I have tried.
Repair install,
SFC scan (found corrupt but as far as I can tell it's only the opencl.dll that it could not repair.)
DSIM
Disable: Superfetch, Windows Search and the BISM(the win updated thing) (re-enables when they yielded no result. Did not disables them in the Registry as I assume that would have the same effect as disabling them in Services)
Update my SSD firmware.
Change SATA cables on my SSD
Memory Diagnostics Tool
Maybe something else I have forgotten, I have done my best to test potential fixes suggested to people with 100% activity issues.

If you want me to repeat any of these things I'm all for it. I have spent a lot of time trying to figure this out.

I was going to attach the CBS.log file but it's 8 megs so if you want that please suggest in what manner you want it.

Spec.txt is the Windows Exported system info.
SSD1/SSD2 is just a screen-cap of the performance tab in Task Manager during and after a spike.


I've tried to remember everything that I can think of. But as I can't even Identify the cause of my problems I've hit a wall. If you need me to provide anything else just ask. Also if something I tried to explain is unclear let me know.

:)

 

Disk Click and Activity Spikes

Upgraded to win10 from win7 64.

I now get audible disk clicks from my RAID 1 Samsung F3s. These correspond with 100% disk usage spikes visible in task manager.

I'm getting ~ 200 ms frame freezes in CS:GO every few minutes. Which for an FPS is terrible. Also, disk clicks tend to happen whenever I'm doing anything "new." But also at completely random times.

This NEVER happened in win7.

I have an additional Samsung F3 that acts as a backup for my SSD boot drive.

Was getting random spikes of activity on that too. There should have been no reason for this activity since my boot backup drive should be idle at all times except when doing a backup. Formatted the backup drive and turned off backups, and the random clicks
and spikes still occur on it.

This rules out disk health being suspect as I very much doubt that my ALL my F3's are going bad at the same time.

16GB of RAM so it's not like I'm low on that.

Other details: Asrock pro3. intel i5 4570. Asus gtx750ti.

I have a silent build. Given the extremely annoying, audible, and new disk clicking, it looks like I'll have to go back to windows 7 unless this is resolved.

Anyone got any ideas?

 

Random computer freezes

I believe I have found the problem. I appears that when I monitor the problem, there is a spike in disk usage. It goes up to 100% highest active time. I cannot identify what is causing this. Are there any suggestions on how to determine what causes 100%
disk activity?

 

Hi, similar symptom reported here:
SSD processed 100% - Windows 10 Forums

Can you identify the process related to the high disk use?

Please also see comments here (but noted you have no excessive RAM usage):
Disk and Memory usage spikes in windows 10 - Windows 10 Forums

 

I'm trying to gather conclusive data, between understanding process monitor and the spikes being hard to produce on command progress is slow.



If I give up I will attempt a fresh install of win 10 and if that fails I will do so on my samsung SSD instead. How do I best go about getting a win 10 image? I do not wish to create one from my current system, lest some issue would be passed on to the next install.

Any ideas on filters would be great, I am currently using default filters removing processes that was known to not be active during a spike. I tried removing all filters but that somehow made it count less events, like excluding runtimebroker etc. makes no sense.

I have a couple of logs that where recorded during spikes but I can't find any correlation in the results column. Is there anything else I can look for?

During/post spikes certain events get a duration that is 10-40 seconds, but as far as I can tell those events are occurring without issue during non-spikes, so I am writing them off as symptoms.


Edit: Also I can't really find a good library of what the results mean, so I don't know how I am supposed to figure out if they are something that requires attention.

 

Hi, I copied this to the thread I mentioned above. Have a look before proceeding with Procmon.

Having read a few reports found with a search on "100% disk activity, low cpu use" - from Win 8 onwards, I suggest:

a. disable readyboost if in use
b. disable defragmentation
c. try changing the power plan from balanced to high performance
d. if you use Intel(R) Rapid Storage Technology try updating it- see:
100% Disk Usage - Page 4
e. Windows Defender may be active whilst disk use is high.
f. "I had this issue and it seems some others encountered the bug. What fixed it for me is going to settings, system, notifications, and turning off "show me tips about Windows." I believe that was the one causing problems, though I turned all of them off besides the app notifications. System processes went back down after a restart and haven't spiked since."

These are things people have reported have had an effect. However, this doesn't necessarily identify an exact cause, so is unsatisfactory.

Analysis: run a capture using Sysinternals Procmon.
I suggest you take the time to use the filter to filter out all background tasks when idle, so then the capture may show less extraneous info.
Or you could set up the capture to only include disk read/write ...
Put another way, there will be LOTS recorded if you don't use a filter... on the other hand, if you get a prolonged burst of one kind of activity as you may, and you know when to look, that might be easy to find.

(Presumably your SSD is configured to use AHCI not IDE)

Another think you might try is to download and install ProcessTamer (free)- if a process uses excessive CPU time, this will force it to back off.
That may give you sthg to work with..

 

Windows 10 ISO Download - Windows 10 Forums

If the specific ideas in the previous don't help, you're down to identifying the root cause. That means identifying sthg specifically related to the period of high disk usage.

So, you would have expected to see (I guess) lots of similar activity recorded by Procmon near consecutively, being a contrast to the idle case. Given that, even glancing down a Procmon report where part is 'idle' and part high disk activity, there should be a marked contrast.

However, it seems you're not seeing that.. and that does actually line up with similar reports. Odd..

 

Today while playing eve, taking a break from searching for errors my computer froze and then crashed. I got a screen saying that windows was gathering info and then it rebooted and put me into the bios. Where my system drive was nowhere to be found. I figures I restart again and pressed save and exit in the bios.

I had a black screen so I decided to turn of the PSU and turn it on again. As I did the computer booted and I got a screen that asus surge protection has triggered (blaming it on faulty psu) and sent me to the bios, where I now found my system drive again.

How do I find the error log. Looking though event manager its either of these two, but I am not certain.

Code: L: - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">L: - <System> <Provider Name="EventLog" /> <EventID Qualifiers="32768">6008</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2016-02-26T01:05:09.639310500Z" /> <EventRecordID>6860</EventRecordID> <Channel>System</Channel> <Computer>ElonasReach</Computer> <Security /> </System> L: - <EventData> <Data>01:23:48</Data> <Data>‎2016-‎02-‎26</Data> <Data /> <Data /> <Data>50644</Data> <Data /> <Data /> <Binary>E007020005001A000100170030001C02E007020005001A000000170030001C02600900003C000000010000006009000001000000B00400000100000000000000</Binary> </EventData> </Event> [/quote] Code: L: - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">L: - <System> <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" /> <EventID>41</EventID> <Version>3</Version> <Level>1</Level> <Task>63</Task> <Opcode>0</Opcode> <Keywords>0x8000400000000002</Keywords> <TimeCreated SystemTime="2016-02-26T01:05:02.724220700Z" /> <EventRecordID>6870</EventRecordID> <Correlation /> <Execution ProcessID="4" ThreadID="8" /> <Channel>System</Channel> <Computer>ElonasReach</Computer> <Security UserID="S-1-5-18" /> </System> L: - <EventData> <Data Name="BugcheckCode">0</Data> <Data Name="BugcheckParameter1">0x0</Data> <Data Name="BugcheckParameter2">0x0</Data> <Data Name="BugcheckParameter3">0x0</Data> <Data Name="BugcheckParameter4">0x0</Data> <Data Name="SleepInProgress">0</Data> <Data Name="PowerButtonTimestamp">0</Data> <Data Name="BootAppStatus">0</Data> </EventData> </Event> [/quote]
While browsing the event maneger I found this:

Code: L: - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">L: - <System> <Provider Name="Application Error" /> <EventID Qualifiers="0">1000</EventID> <Level>2</Level> <Task>100</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2016-02-26T01:05:25.039772600Z" /> <EventRecordID>3480</EventRecordID> <Channel>Application</Channel> <Computer>ElonasReach</Computer> <Security /> </System> L: - <EventData> <Data>ATKEX_cmd.exe</Data> <Data>0.0.0.0</Data> <Data>00000000</Data> <Data>KERNELBASE.dll</Data> <Data>10.0.10586.103</Data> <Data>56a853fe</Data> <Data>0eedfade</Data> <Data>000bd928</Data> <Data>18dc</Data> <Data>01d17031c591c427</Data> <Data>C:\Program Files\Realtek\Audio\HDA\ATKEX_cmd.exe</Data> <Data>C:\WINDOWS\SYSTEM32\KERNELBASE.dll</Data> <Data>38e78ff0-8f43-46e5-b1f6-f8d5c3226a63</Data> <Data /> <Data /> </EventData> </Event> [/quote] Which seems to be an error with realtek audio.

Also this error occured at roughly the same time:

Code: L: - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">L: - <System> <Provider Name="Microsoft-Windows-DeviceSetupManager" Guid="{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}" /> <EventID>131</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x4000000000000000</Keywords> <TimeCreated SystemTime="2016-02-26T01:05:13.235828600Z" /> <EventRecordID>1258</EventRecordID> <Correlation /> <Execution ProcessID="412" ThreadID="1628" /> <Channel>Microsoft-Windows-DeviceSetupManager/Admin</Channel> <Computer>ElonasReach</Computer> <Security UserID="S-1-5-18" /> </System> L: - <EventData> <Data Name="Prop_ContainerId">{F2F88A89-C8CD-11E5-94D5-806E6F6E6963}</Data> <Data Name="HRESULT">2147943568</Data> </EventData> </Event> [/quote] Maybe what I'm posting is bull, it's very late and my brain is running with limited function. I will look into all this tomorrow when I get up. If anyone can provide some insight I will appreciate it. I just wanted to report all this while it was fresh.

 

So, a confession is in order. I had no thought in my mind to ever go through the event viewer during my trouble shooting the last months don't really know why, got no good explanation. Kind of embarrassing, my sleep-deprived, vodka-induced self yesterday helped me see a new angle that I hope to pursuit to spike free end user environment.

So I will pursue those error that I posted about earlier eventurally but I can now say with certainty that the previous 10 spikes have happened at the same time as "Reset to device, \Device\RaidPort0, was issued."

Friendly view;
Code: + System - Provider [ Name] iaStorA - EventID 129 [ Qualifiers] 32772 Level 3 Task 0 Keywords 0x80000000000000 - TimeCreated [ SystemTime] 2016-02-26T08:06:07.720402100Z EventRecordID 6963 Channel System Computer ElonasReach Security - EventData \Device\RaidPort0 0F001800010000000000000081000480010000000000000000000000000000000000000000000000000000000000000000000000810004800000000000000000 Binary data: In Words 0000: 0018000F 00000001 00000000 80040081 0010: 00000001 00000000 00000000 00000000 0020: 00000000 00000000 00000000 00000000 0030: 00000000 80040081 00000000 00000000 In Bytes 0038: 00 00 00 00 00 00 00 00 ........[/quote] XML View:
Code: L: - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">L: - <System> <Provider Name="iaStorA" /> <EventID Qualifiers="32772">129</EventID> <Level>3</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2016-02-26T08:06:07.720402100Z" /> <EventRecordID>6963</EventRecordID> <Channel>System</Channel> <Computer>ElonasReach</Computer> <Security /> </System> L: - <EventData> <Data>\Device\RaidPort0</Data> <Binary>0F001800010000000000000081000480010000000000000000000000000000000000000000000000000000000000000000000000810004800000000000000000</Binary> </EventData> </Event> [/quote] As I post I have began looking for solutions.


Also I don't RAID at all.

 

Excellent analysis... now that does seem weird though. It seems you may have multiple drives.. if so, have you considered disconnected non-essential ones as a trial?

Looking at your system configuration you say:
The same 240gb INTEL SSDSC2CW240A3 is still the System Drive.
so is this suggestion (above)
d. if you use Intel(R) Rapid Storage Technology try updating it- see:
100% Disk Usage - Page 4
relevant?

Intel RST is the driver used for drive(s) in AHCI or RAID mode.
Windows has its own AHCI & RAID drivers if you don't wish to install Intel's.
Do I need Intel® Rapid Storage Technology Software? - Hard Drives - Storage

"Intel® Rapid Storage Technology offers new levels of protection, performance, and expandability for desktop and mobile platforms. Whether using one or multiple hard drives, users can take advantage of enhanced performance and lower power consumption. When using more than one drive, the user can have added protection against data loss in the event of a hard drive failure.

The Intel Rapid Storage Technology user interface makes creating and managing your storage simple and intuitive. Combined with Intel® Rapid Recover Technology, setting up data protection can be done easily with an external drive.
Valuable digital memories are protected against a hard drive failure when the system is configured for any one of three fault-tolerant RAID levels: RAID 1, RAID 5 or RAID 10. By seamlessly storing copies of data on one or more additional hard drives, any hard drive can fail without data loss or system downtime. When the failed drive is removed and a replacement hard drive is installed, data fault tolerance is easily restored."

 

It seems that I was confused as to what Intel RST did, due to a breath of factors. I have installed it now by downloading it from my Motherboard's manufacturer. Maybe I should have done it from intel's archives, but this was easier.

It yielded no results first but then I turned off Power Link in RST and that seems to have done it.(Note I previously had tested turning off Power Link in windows power management, before getting RST, but, with no result.)

I expected my Storage controllers in device manager to change to intel now but it's still 'Microsoft Storage Spaces Controller' but maybe they are unrelated and it's all fine?

There have been no spike and/or reset to device for 40 mins, I am going to reconnect my other drives and continue normal operation.

 

Was it previously installed?

 

RST? no. As I recall it after upgrading, I had the issue. Then when I did a repair install I wanted to install as few 3rd party(borderline 3rd party) stuff from my Motherboard software DVD as possible and my conclusion from, mainly the bios, was that RST was a RAID thing and I choose not to install it.

I do believe I had RST on my Win 7 installation though.

In the interest of confirming that RST+Link Power Management off, solved my issue I will not fiddle with anything else, remotely related to this, for 48 or so hours.

 

Don't guess. Open resource monitor, go to disk tab, and expand disk activity section. Then sort by total descending. You'll get to see what is reading / writing a lot.

Common culprits I've seen are

• .NET runtime is optimizing
• Intel security drivers are scanning the system (this is anti-theft drivers, not anti-virus)
• Windows updates

If you let your system sleep, rather than shutdown, these will often occur at night (by auto waking your machine)

The real key is to see the path of the image (application) that is busying your machine. If it's in windows it's less of a worry. But either way you can look it up to see what's up.

I don't recommend changing system settings, MS has a tendency to reset them with new updates anyway

Also older versions of apps sometimes have trouble (winzip, security apps) and should be removed.

 

pete you have not read this thread or the op.

Thanks for trying I guess.