I'm trying to understand why my Windows 7 machine is constantly reading/writing to the HDD, making everything go slow. As you can see in the screenshot, resmon reports that there is a lot of disk activity originating from svchost.exe (pid 756). But in Process Monitor, process 756 doesn't seem to do anything at all, except the periodical profiling. How is this even possible? They seem to contradict each other?

I'm dumbstruck. How can I look further into this problem?enter image description here

link|improve this question
feedback

2 Answers

There are a couple of things that Windows does in the background:

  • Search and install updates,
  • Index documents for search,
  • Prefetch frequently used files,
  • Defragment the hard drive.

Installing updates is done by TrustedInstaller.exe so that is not your problem. I do see prefetch showing up so I'm going to assume that Windows is looking for frequently used files and load them in available memory. This way, most of your applications will start faster.

When you install updates you might notice a slight hiccup with your pc's performance but indexing, prefetching and defragmenting are all executed using low priority i/o which means you won't notice it. The moment you do an action that requires something from the hard drive, the low priority stuff will be halted.

link|improve this answer
feedback

Several sub process with the same PID can run inside of svhost.exe

You can see what they are in task manger by right clicking on the svchost process and select go to services, this will list all the services running under that particular instance of svchost. It will highlight them for you, you may have to scroll for them to show. These are all the services running under that specific PID. Another method is to go directly to the Services Tab in Taskmanager and then click the PID column header and this will sort them, then look for your PID's

Tracking down which service is causing the writes will require other software such as process monitor to sort that out. It is very powerful software and you would need to study up on how to use it

enter image description here

.

enter image description here

link|improve this answer
Great, but as you can see in the screenshot, I do have Process Monitor running, and you can see the configuration also in the screenshot. Process monitor is set to show all activity from the svchost pid. Shouldn't any subprocesses running under the same pid also show up in that list? – Mats Ekberg Nov 23 '11 at 22:05
Like I said PM is powerful software with many settings and filters you can use, I am no expert in using it so you will have to rely on someone else for PM expertise in how to show sub processes of svhost. – Moab Nov 25 '11 at 19:48
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.