Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I booted up today and my disk hasn't stopped thrashing in 20 minutes. CPU activity is flat; the only processes using anything right now are firefox and dwm.exe and it's ~1%. So I figured I'd look at what's happening with Procmon.

svchost.exe is making thousands of requests per second. It looks like something or the other is running an install, because it checks HKLM\System\Setup\SystemSetupInProgress every few milliseconds. It's also looking at files in C:\Windows\System32\wbem\repository a lot; I presume that's WMI queries. Everything else looks like random hard drive queries (for example, it looked for "close.WAV" in 7 or 8 program files directories.

I want whatever it is to STFU and stop thrashing my hard drive (since starting this post it sounds like it's calming down.) But since it's hiding in svchost.exe, it's pretty hard for me to tell it to calm down. The Event Viewer doesn't seem to indicate much, though there's about 15 failures that seem to hint it tried to install some automatic updates. I set my computer to ask before installing them; I'm not sure why it'd do this.

Why is there not a "WTF are you doing?" button? Why is it so easy for a process to perform hard drive olympics while I have nothing to do but sit back and hope it's for the better? Is there any way to figure out exactly what's going on when this happens?

share|improve this question
Windows 8 needs a "WTF are you doing?" button somewhere. – Phoshi Oct 2 '09 at 14:23
@Phoshi - I can't think of a single OS that doesn't. – Manos Dilaverakis Oct 2 '09 at 14:37
True, but "Windows 8" was the first "next OS" that came to mind - I'd love a global thing! :) – Phoshi Oct 2 '09 at 14:57
For the record: Both Windows Vista and 7 maintain a pretty comprehensive record about overall system performance. And log when it degrades. – Joey Oct 2 '09 at 18:50
+1 for the "WTF are you doing"? button. :) Would be a really useful feature. – Assad Ebrahim Sep 1 '12 at 5:30
up vote 4 down vote accepted

From my Post on What’s making my disk thrash in Windows XP?

Download Process Explorer from Microsoft / Sysinternals.

Run it and click view > Select columns. Click on the Process Performance Tab, and select "I/O Reads" and "I/O Writes".

You can do this from Task manager, but I prefer using Process Explorer.

You can then sort by these columns and see what is doing the most read / writes.

(if using Vista / 7 remember to run as ADMIN (or click file then "show details for all processes" which will do this for you)

I tend to find that Dropbox and mesh on a few machines I support seem to run wild with read/write bytes 24/7 so if you use any sycn software, first bet is to look at that, however running this tool should tell you exactly what is wrong.

In addition, you can click on any of the graphs at the top of the screen which brings up a "System Information" dialog of historic information. One of the graphs (third one down) is "I/O Bytes", Simply hover your mouse over any of the peaks, and it will tell you what is taking up the most resources. - Exactly what you want!

share|improve this answer
What I don't understand is that my drive is thrashing, and while there are some peaks in the graph, there are also completely flat spots with no activity indicated, yet the drive is still thrashing. When looking at the I/O read/write columns, barely anything is increasing. This drive thrashing is driving me crazy. :) – Dave Aug 31 '10 at 12:55
@Dave, can't say for sure, but it could be mechanical error on the drive.... If you are using Windows Vista or Windows 7, make sure that you are running as administrator. – William Hilsum Aug 31 '10 at 13:18
Hmm.. scary. I can't believe it's still thrashing like this. When things die down at work, I'll start killing processes one by one. :) I always run as an administrator, which is probably frowned upon but I've done it this way for as long as I can remember. – Dave Sep 2 '10 at 15:41
For me, it was Google Desktop. – Benjol Oct 28 '10 at 20:46

Probably about the best solution is to use Process Explorer or Process Monitor to narrow down to a particular svchost instance and get the list of which services are inside it. Then you can individually set each service (1 by 1) to disabled until you figure out which service was the cause of the thrashing.

share|improve this answer
+1: always wondered how to find out what was going on inside an svchost. – Assad Ebrahim Sep 1 '12 at 5:33

Use Process Explorer from the same Syinternals site as Procmon to get the break down of the svchost processes.

share|improve this answer

Go to Task Manager->View->Select Columns.

When you're there you can select new columns for the task manager to display, including things like I/O reads and I/O writes...Hopefully that will let you see some of what is going on.

EDIT: Sorry, no coffee yet. Didn't realize you'd already busted out Procmon.

I have some Vista thrashing myself....Not sure it's not "Windows Defender" but yea, I agree it's a bit annoying.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .