30

My computer is taking a very long time to shutdown.

How can I identify the culprit? I don't want to wait minutes for my computer to shutdown...

Is there a program I can use to track how long it takes to shutdown?

9
  • 1
    We have no idea how your system is set up and what could be running in the background
    – random
    Oct 10, 2011 at 15:43
  • 1
    OK... I saw someone else asked it, then deleted it as I was composing a very long and complete answer... (felt kinda sorry for myself)
    – wizlog
    Oct 10, 2011 at 15:45
  • You can always suggest it for the blog
    – random
    Oct 10, 2011 at 15:47
  • 2
    Press and hold the power button for several seconds. Oct 10, 2011 at 16:05
  • 6
    This question is valid, I can objectively answer this so his problem is resolved. There is nothing ambiguous (the problem is that his shutdown time takes to long), vague (he wants to speed up his shutdown), incomplete (details aren't necessary, of course each computer is different but that doesn't make the technique to identify the culprit any different), overly broad (you might think so, but I do not see any other question troubleshooting shutdown so this is a really valuable question to have; I think it would be broad if he wants to speed up other things) or rhetorical (It involves xperf). Oct 16, 2011 at 16:46

2 Answers 2

33

Windows provides Performance Counters as well as Event Tracing which allows applications to do performance analysis so that one can pin-point the cause of performance problems, amongst those that exist there is one outstanding toolkit: The Windows Performance Toolkit available in the Windows SDK.

In this toolkit you will find xbootmgr.exe, meant for Windows On/Off Transition Performance Analysis.

Although the above linked document goes into all the details for every on/off transition, here is the general idea about tracing and analyzing the shutdown transition using xbootmgr and the xperf GUI:

  1. Download the Windows SDK, then install the Windows Performance Toolkit using it.

  2. Open up a command prompt as an administrator, then run:

    cd %ProgramFiles%\Microsoft Windows Performance Toolkit

  3. If you want help in the future, you can type xbootmgr -help as well as xperf /?.

  4. Do a reboot trace like this:

    xbootmgr -trace shutdown -traceFlags BASE+DIAG+LATENCY -noPrepReboot

  5. After the boot, it will generate a trace within two minutes.

  6. The trace has been saved in %ProgramFiles%\Microsoft Windows Performance Toolkit, you can drag it onto xperf.exe and it will be opened in a GUI.

  7. You will see a GUI with different graphs, the arrow at the left side allows you to add/remove graphs.

  8. Look at the graphs and see if you can identify anything out of the ordinary, you can select an interval and zoom in on it if you want to. Right click and unzoom when you want to see the whole.

  9. For each graph, you can right click to get summary tables for the currently selected interval.

  10. In these tables, sort by weight or by time to figure out which it is spending the most to. Please note that you can drag around columns, so for example the I/O table allows you to check out the highest using process as well as the highest using path.

    The divider (a yellow header column) makes it so that the columns right of it show the total for the columns left of it. So, if you have Path first and then Process, then you can open the tree for a file to see what processes have accessed it and then you get the totals for that process/file combination.

  11. You can find more information on how the graphs and tables function here.

  12. If you somehow need to go down to look into the stack traces; do another boot trace and append the -stackWalk profile parameter, set the _NT_SYMBOL_PATH and right click on any graph and enable "Load Symbols". This will allow you to check what functions it's actually calling, in general you won't need this for a shutdown though; but it can allow for things like discovering that your firewall is interfering with your debugger as a programmer. Pretty nifty...

Good luck, I hope you can find the culprit. If not then drop the trace and we'll take a look for you...

Please note that DPCs are Deferred Procedure Calls and Interrupts are Software Interrupts, both are related to drivers / hardware.

5
  • 1
    Amazing useful answer. Any tutorials on ETW are extraordinarily useful; it's an area of Windows with no documentation and no gui to guide.
    – Ian Boyd
    Oct 22, 2011 at 17:56
  • @Tom Wijsman Links need to be updated
    – Moab
    Apr 20, 2016 at 19:33
  • Now it is part of the Windows Assessment and Deployment Kit, a Link can be found e. g. at msdn.microsoft.com/en-us/windows/hardware/commercialize/test/… or simply by searching for "Windows ADK". During installation, it is possible just to select the Performance Toolkit. Oct 4, 2016 at 6:50
  • Now it is also part ..., because it is still available in the SDK. Oct 4, 2016 at 19:34
  • Thanks for the very useful answer! I tried doing a reboot trace and everything end after ~21 seconds. However, my laptop takes a long time to fully shutdown -- the shutdown first looks normal (for the 21 seconds) and then the bulit-in monitor goes off but the fans are still spinning and the power indicator light remains on. The latter sleep-like status last quite a few minutes before it really shutdowns. Are there any tools that I may use to diagnose what is happening there? Thanks in advance! Mar 21, 2021 at 21:13
23

My shutdowns where taking a long time to run. What follows is my example with Tom's answer.

The first graph shows the problem, Disk I/O:

enter image description here

My shutdown is taking over a minute and it's all hard-drive I/O.

The next graph, Disk Utilization shows a drive is nearly maxed at 100% usage:

enter image description here

The final graph shows Disk Utilization by Process:

enter image description here

Filtering down i realize it's all caused by WinInit.exe:

enter image description here

By right-clicking any of the hard drive graphs and selecting Summary Table, i can get the details of what files were accessed by what process:

enter image description here

56.4 seconds of my shutdown was spent by WinInit writing 6.7GB to C:\hiberfil.sys.


But the question is why is Windows writing to my hibernation file on shutdown?

Then i remembered an option i had turned on to wipe that paging file on shutdown:

  • Start -> Run -> SecPol.msc
    • Security Settings, Local Policies, Security Options
    • Shutdown: Clear virtual memory pagefile

enter image description here

So i disabled the option, and run xbootmgr again. Now my shutdown is 22 seconds:

enter image description here

Now 9s of the 22s shutdown is spent by System writing to some unknown file. That might be worthy of more investigation.

But for now i've solved my minute and a half shutdown.


i went further and solved my 22s slow shutdown. From t=12s to t=21s showed 100% Disk Utilization, but zero Disk I/O. It was baffling.

Until during one shutdown i heard the familiar sound of one of my drives spinning up. The shutdown was stalled for 9 seconds because Windows was attempting to access a disk that had gone to sleep. Nine seconds later the drive responds, and a moment later the machine turned off.

Ironic that Windows wakes up a disk to tell it that it's time to go to sleep.

That would make my actual shutdown 13.5 seconds. That might be worth more investigation. But for now i've solved my 22 second shutdown.

2
  • 1
    +1 Glad you got it solved in your case, and nice post! Nov 1, 2011 at 2:46
  • 1
    These answers deserve a blog post don't you think? ;)
    – Ivo Flipse
    Nov 7, 2011 at 18:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .