Often I can hear my hard disks crunching and I can tell the machine is a
little slow but I don't know what program is crunching the hard drive.

I have run the virus scans but this is NOT a virus scan question.
I repeat (since people will say to run a scan) this isn't a scan question.

It's a debugging question.

The three fingered salute brings up process explorer, which itself is
jumping all over the place until I sort by process name to calm it down.

That nets me something like fifty "svchost.exe" processes among others.
I sort by CPU but what I want to sort by is who is accessing my hard drive?
How do I find out what exactly is making my hard drive crunch like that?

gtr wrote:

> How do I find out what exactly is making my hard drive crunch like that?

From task manager, performance tab, launch resource monitor
from there go to disk tab, and look at the disk activity and processes with disk
activity sections, sort by total bytes/sec and you'll see which process are
accessing which files ...

On 11/19/2021 3:06 AM, gtr wrote:
> Often I can hear my hard disks crunching and I can tell the machine is a
> little slow but I don't know what program is crunching the hard drive.
>
> I have run the virus scans but this is NOT a virus scan question.
> I repeat (since people will say to run a scan) this isn't a scan question.
>
> It's a debugging question.
>
> The three fingered salute brings up process explorer, which itself is
> jumping all over the place until I sort by process name to calm it down.
>
> That nets me something like fifty "svchost.exe" processes among others.
>
> I sort by CPU but what I want to sort by is who is accessing my hard drive?
> How do I find out what exactly is making my hard drive crunch like that?

As a second method, you can use Sysinternals Process Monitor, and
it records ReadFile, WriteFile, CreateFile calls in its log. The
PID is recorded along with the event and the timestamp. The PID does
not identify which Service inside a SVCHOST, is doing stuff.

But be warned, that long sequences of that stuff that you see
in Windows 10 make no sense. You can see scanning activity of
some sort, but why ?

There is also a tendency for Windows 10 to fork off minor
maintenance activity, if it detects you're trying to use the
machine.

It's an altogether unsavory OS. The "noise" from stuff like this,
prevents serious events, like say an intrusion, from being visible
in a ProcMon log, because of all the useless crap the OS is doing.
If the OS was "quiet" like Windows 2000, then activity that does not
belong, would stand out better.

The OS really needs a knob called "Quiet, Please", that suppresses
garbage activity, so you can see what is really going on.

*******

You will notice, that a number of the SVCHOST (each assigned a PID
so you can track them), they happen to have only one "thing" inside.
Thus, if you see them using CPU cycles, and there is only one
thing inside, you know what Service is doing it.

A few of the SVCHOST, to this day, have 15 services inside. If the
CPU starts to spike on one of those, you don't know which one is
doing it.

Sysinternals Process Explorer, if you "Run as Administrator" its EXE,
can provide a limited amount of info about activity on the services.
Which is better than nothing. I think there's a cycle count, so you
can see saintly Services which use no cycles from one second to the
next.

However, if you are desperate, there is another way to do it. You
can "move" the Services, into private SVCHOST. The 15 things don't
need to share a single SVCHOST.

sc config wuauserv type= own # move a Service, outside its SVCHOST.
# It lives in a shack by itself now.

sc config wuauserv type= share # put wuauserv back in its shack with
# the other fourteen services.

It takes a lot of command invocations, like an Administrator
Command Prompt window, to do that.

In at least Windows 10 Pro, this shows you how successful you've
been. You can check for "sharing" of SVCHOST, using this command,
as well as perhaps finding the info in Sysinternals Process Explorer.

tasklist /svc

While that technique "makes your OS debuggable", it is not for
the faint of heart. And the one in my example, that would be
one of the busy boys in that SVCHOST. The others might be
on their best behavior, while that one has gone on a binge.
That's why he was used in the example. Windows Update Automatic Update
Service.

Paul

gtr <xxx@yyy.zzz> wrote:

> Often I can hear my hard disks crunching and I can tell the machine is
> a little slow but I don't know what program is crunching the hard
> drive.
>
> I have run the virus scans but this is NOT a virus scan question. I
> repeat (since people will say to run a scan) this isn't a scan
> question.
>
> It's a debugging question.
>
> The three fingered salute brings up process explorer, which itself is
> jumping all over the place until I sort by process name to calm it
> down.
>
> That nets me something like fifty "svchost.exe" processes among
> others.
>
> I sort by CPU but what I want to sort by is who is accessing my hard
> drive? How do I find out what exactly is making my hard drive crunch
> like that?

I'll take another approach, and one you hint is note the cause. Do you
have more than one anti-virus/malware program installed? I'm not
talking about on-demand (manual) scans by one, or more, but on-access
(real-time) scanners concurrently active. I've seen where 2 AV scanners
compete with each other: the first scans a file, the second sees the
file got touched so it scans the file, the first sees the file got
touched so it scans, the second sees the file got touch so it scans, ad
nauseum. Using SysInternals' FileMon, I was the two AV scanners had
opened the same files several thousand times in a minute, and it kept
going until I killed one of the AVs. You may not want the AVs to be
involved, but they could be. This is one of the reasons not to
concurrently run more than one AV's on-access scanner.

In addition, AVs hook into the file I/O stack to interrogate file
traffic, and more than one could end up scanning the same files at the
same time. If you just must have multiple AVs installed, have ony one
running as the on-access (real-time) scanner, and disable the other(s)
to use only on-demand (manual). That won't eliminate conflicts in
multiple AVs hooking into the same system calls for file I/O. In fact,
some will still hook into the OS even when configured for on-demand use
only. A long time ago, I had to use Resplendence's Hook Analyzer to see
when AVs were chaining themselves into the same kernel hook that would
then interfere with each other. The multiple AVs, or any programs
competing for the same hook, might work if they chained in the correct
order, but sometimes they still wouldn't cooperate. This is why
Microsoft deprecated kernel hooks. Deprecated does not mean barred.
Better to install one AV program, and only one, to prevent conflict
between them.

"Often" doesn't say if the busy disk activity is every few minutes, a
few times an hour, a few times a day, or week, or month, or what. After
you use the suggestions of how to see which processes are accessing lots
of files to get the disks crunching away, perhaps some of them are
scheduled in Task Scheduler. However, some programs, like AVs to do
scheduled scans (at a time, when idle, or other condition) and others
(to perform other tasks), run their own scheduler process.

You mention having lots of svchost.exe processes. Services get rolled
together into the same svchost process. SysInternals' Process Viewer
can show you what is inside each svchost instance.

https://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

You could try booting Windows 10 into its safe mode which eliminates
non-critical services on startup along with eliminating loading of
startup programs. Then check if the busy disk activity still occurs
"often". First start by disabling the startup programs. Task Manager's
Startup tab can do that by right-clicking on each item in the list, and
selecting Disable in the context menu. Or use SysInternals' AutoRuns
tool which is far more thorough regarding ALL startup methods, not just
those in the Startup folder or in a couple common places in the
registry. If disabling startup programs doesn't alleviate the problem,
then try Windows' safe mode. You might want to reconsider which startup
programs you allow if you have lots of them. Lots of programs think
they are just so important that you just must have them running all the
time, and many are of dubious value left consuming memory while running
in the background. Many that are startup programs have an option to
"Load on startup", or similarly worded option. Alas, way too many don't
provide a user-configurable option, so you have to delete them from the
Startup folder or Run registry keys (or disable them which really just
moves their registry entries to a holding area, so when reenabled they
can get moved back to reactivate them as a startup program).

>gtr <xxx@yyy.zzz> wrote:
>
>> Often I can hear my hard disks crunching and I can tell the machine is
>> a little slow but I don't know what program is crunching the hard
>> drive.
[]
>> The three fingered salute brings up process explorer, which itself is
>> jumping all over the place until I sort by process name to calm it
>> down.
>>
>> That nets me something like fifty "svchost.exe" processes among
>> others.
>>
>> I sort by CPU but what I want to sort by is who is accessing my hard
>> drive? How do I find out what exactly is making my hard drive crunch
>> like that?

In Windows 7, in Task Manager, under the Performance tab, I have a
button Resource Monitor ...; clicking that brings up a sort of much more
detailed thing (surprisingly called Resource Monitor). which has tabs
including one called Disk; under that, I can see "Processes with Disk
Activity" and "Disk Activity". (The first is one line per PID; in the
second, each PID may appear several times - I think it's a line per file
accessed.) The top one at least can be sorted by reads, writes, or
total, in the last minute (default being total).

Does 10 not have something similar?
[]
I generally find it is web pages that are causing the accesses -
chrome.exe processes. If you're using Chrome, try its own Task Manager -
shift-Esc (when Chrome has focus) will open it, or More Tools | Task
manager. That shows which tabs have which PIDs, and (assuming you _do_
have something in W10 similar to 7's Resource Monitor) you can thus see
which tabs are causing all the disc access. And it (Chrome's Task
Manager) has its own End process button - which doesn't seem to close a
tab, just stop it doing anything (you might have to reload if you go
back to that tab).

YMMV, as they say.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

A man is not contemptible because he thinks science explains everything, and a
man is not contemptible because he doesn't. - Howard Jacobson, in Radio Times
2010/1/23-29.

"J. P. Gilliver (John)" <G6JPG@255soft.uk> wrote:

> In Windows 7, in Task Manager, under the Performance tab, I have a
> button Resource Monitor ...; clicking that brings up a sort of much
> more detailed thing (surprisingly called Resource Monitor). which has
> tabs including one called Disk; under that, I can see "Processes with
> Disk Activity" and "Disk Activity". (The first is one line per PID;
> in the second, each PID may appear several times - I think it's a
> line per file accessed.) The top one at least can be sorted by reads,
> writes, or total, in the last minute (default being total).
>
> Does 10 not have something similar?

Yep, Resource Monitor appeared a long time ago. While you can see all
files that a process is touching, it shows only for reads and writes. A
process can simply open a file without ever reading or writing to it.
Also, you cannot filter by a mask on which file(s) you want to monitor.
In Resource Monitor, you see ALL files touched. There is no logging in
Resource Monitor. It shows you what is happening now (well, within the
last poll interval), not was happening before. It does have some graphs
for history, but just on overall disk activity, not for specified files.
Resource Monitor is to show you what is happening now. FileMon shows
you what happened before, because FileMon maintains a log. And
filtering is much better with FileMon. In fact, in Resource Monitor,
filtering sucks. Not until a process touches a file (with a read or
write, not with just an open) can you select it to filter on it, and
when the process goes away then so does the filter, so you no longer see
which files got touched, and how often, and magnitude. You see a
snapshot of now, not a history of before. A process that generates tons
of I/O in a couple seconds is hard to see when the process comes and go
in a couple seconds along with the record of files it touched
disappearing after a couple seconds.

I don't see Resource Monitor as helpful when trying to determine not
just what is happening now, but also what happened before. Logs record
history, and why they are useful. Something that shows you just now has
limited usability. Forensics requires seeing more than just now.

Both are useful, but that depends on what you are trying to see; i.e.,
what view you want. If I step into a car, and notice the idle RPM is at
1000, was it that high before, or just now? If RPM has been bouncing
around, when did it bounce? Seeing it was higher when the A/C kicked in
lets you verify the cause. If you were taking a trip, would it be as
fun with you opening your eyes once per minute for a couple seconds, and
waiting an hour before you could blink open again while also having a
memory so short that you don't remember what you saw before?

Users don't report high disk activity was slowing their computer if the
impact was just over a 3-second polling interval. A just-now view is
useful to see the process that lasts for a long time is keeping disk
activity high, but then YOU are the one recording history by remembering
what you saw before. You have to sit there to watch, and remember.

On Sun, 21 Nov 2021 at 16:45:03, VanguardLH <V@nguard.LH> wrote (my
responses usually follow points raised):
>"J. P. Gilliver (John)" <G6JPG@255soft.uk> wrote:
>
>> In Windows 7, in Task Manager, under the Performance tab, I have a
>> button Resource Monitor ...; clicking that brings up a sort of much
[]
>> Does 10 not have something similar?
>
>Yep, Resource Monitor appeared a long time ago. While you can see all
>files that a process is touching, it shows only for reads and writes. A
>process can simply open a file without ever reading or writing to it.

The OP wanted to see what processes were doing disc accesses, because he
thought that was slowing down his PC sometimes (I agree, he didn't
qualify "sometimes" to the precision you wanted). I would _imagine_
that, at least most of the time, disc accesses which actually impact PC
performance are likely to involve real reads and writes, not just
opening(s).
[]
>In Resource Monitor, you see ALL files touched. There is no logging in
>Resource Monitor. It shows you what is happening now (well, within the
>last poll interval), not was happening before. It does have some graphs
>for history, but just on overall disk activity, not for specified files.

In W7, the column headings say (if you hover over them) something like
"in the last minute". Assuming W10 is similar, that seems a reasonable
compromise: I don't want to know what was accessing the disc five
minutes ago, but equally I want to see accesses in the very recent past
(i. e. what triggered me to look), not just what's accessing _right
now_.
[]
>I don't see Resource Monitor as helpful when trying to determine not
>just what is happening now, but also what happened before. Logs record
>history, and why they are useful. Something that shows you just now has
>limited usability. Forensics requires seeing more than just now.

Well, the OP implied, at least, that he wanted a way of knowing what was
accessing the disc _now_ - or, at least, in the _very_ recent past, not
just at the moment he looked. Anyway, I think "the last minute" is
reasonable.
[]
>Users don't report high disk activity was slowing their computer if the
>impact was just over a 3-second polling interval. A just-now view is
>useful to see the process that lasts for a long time is keeping disk
>activity high, but then YOU are the one recording history by remembering
>what you saw before. You have to sit there to watch, and remember.

I've generally found (in my W7-32 with 3G) that it's often web pages in
tabs in Chrome other than the one I'm currently looking at, and the
combination of Resource Monitor and Chrome's own Task Manager (so I can
cross-refer PIDs with tabs) _does_ let me kill (without actually
closing) the offending tabs. YMMV.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Anything you add for security will slow the computer but it shouldn't be
significant or prolonged. Security software is to protect the computer, not
the primary use of the computer.
- VanguardLH in alt.windows7.general, 2018-1-28

"J. P. Gilliver (John)" <G6JPG@255soft.uk> wrote:

> Anyway, I think "the last minute" is reasonable.

Resource Monitor back on Windows 7 lets you configure the polling
interval? Not in Windows 10 where the polling interval is 1 second.
When the process doing the disk activity unloads, it disappears from the
list, and so does the list of files it was touching. With 1-second
polling intervals, the process could come and go before you realized it
was there, and even if you noticed it you couldn't click on it to show
just the files it touched.

On Mon, 22 Nov 2021 at 10:23:46, VanguardLH <V@nguard.LH> wrote (my
responses usually follow points raised):
>"J. P. Gilliver (John)" <G6JPG@255soft.uk> wrote:
>
>> Anyway, I think "the last minute" is reasonable.
>
>Resource Monitor back on Windows 7 lets you configure the polling
>interval? Not in Windows 10 where the polling interval is 1 second.
>When the process doing the disk activity unloads, it disappears from the
>list, and so does the list of files it was touching. With 1-second
>polling intervals, the process could come and go before you realized it
>was there, and even if you noticed it you couldn't click on it to show
>just the files it touched.

I don't know if it can be configured; I just know that if I hover over
the column headings in RM's Disk tab, they say (e. g.) "Total (B/sec.):
Average number of bytes per second accessed by the process (read and
write) in the last minute". [Or "written" or "read" for the other two
columns.] I've just had a very quick poke around, and I couldn't see
anywhere obvious where the "last minute" could be changed.

The "last minute" seems a reasonable period; as you say, if it was just
a second, an offending process would have disappeared by the time you
decided to look at the usage statistics. The actual figures seem to
update about every two or three seconds, so I presume if a process has
closed, the figure shown will just go down to zero during the minute
after it does so, and then disappear; I can't confirm that.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Train sets are like breasts: they are intended for children but it's dads who
have the most fun playing with them.
- Nick Odell (quoting someone else) in UMRA, 2021-2-10

VanguardLH wrote:

> Resource Monitor back on Windows 7 lets you configure the polling
> interval? Not in Windows 10 where the polling interval is 1 second.

I've not tried fiddling, but it wouldn't surprise me if the sample period and
duration of resource monitor's alter-ego, performance monitor, had an effect?