Constant write to $LogFile in Vista?

The hard disk light is constantly coming on for every few seconds, and resource monitor shows that the $LogFile is always being written to along with some $MFT.

Some googling tells me that the files are for NTFS and pretty much works on its own? But is there any way to curb the situation?

I think I only noticed this after upgrading to SP1, but not too sure.

Anyone have thoughts on this?

 

Bump, anyone?

 

As far as I know, $LogFile is the NTFS log, which is used to ensure that operations complete properly. That is, when you start a write, it is put in the log file, and when it successfully completes, the entry is cleared from the log file. (well, there's more to it than that of course...)
Every good filesystem does something like that. (in ext3 it's called journalling, but it's the same thing. It's what allows chkdsk to run in less than 8 hours)

And this implies that the log file is never written to *alone*. It is written because other writes are occurring. So find out what *else* it is that keep being accessed.

 

Go to Sysinternals website (page on Microsoft) get DiskMon and or FileMon. They are invaluable it tracking down this sort of thing.

Gary

 

The system file $Logfile is part of the NTFS file system, and is used to keep track of various I/O transactions, including those that are currently in progress and those that have been deferred. Thus, anytime _Vista needs to read or write to a file, there's going to be a record of it kept in $logfile. One of the purposes for this is to enable the file system to be reconstructed in the case of a corruption event such as the failure of a drive to shut down properly, or an abrupt power cutoff.

Also, as a basic design principle, a lot of basic system disk I/O is done in the background, a little bit at a time as processor availability permits. This is basically a QoS type concept, in which file I/O that can be deferred is done in such a way that it doesn't interfere with the user's perception of performance (one side-effect, however, of systems like this is that, while you may perceive the system to have better performance, it actually has worse performance, particularly when measured on a raw through-put basis). One example of this would be file checking by an anti-virus application. The application is basically going to read every file on the disk before it quits, so if that process were given priority, your system would basically lock up for 5 to 10 minutes while the A/V app did its thing; in particular, the screen would frequently freeze up, so it would look like nothing was happening - not a good way to keep the typical home user happy! So instead, the A/V app's file I/O is given a low priority, which means that it has to defer both to other higher priority file I/O, as well as to any higher priority devices (physical and logical) that interrupt the CPU.

Since there are tons of little background chores _Vista is constantly doing that involve I/O, you will notice a fairly constant background level of disk access, particularly when you're not using the system hard. As a consequence, there will be constant reads and writes to $logfile, as well as to whatever files are actually being read/written.

This link will take you to the basic MS Technet article on How NTFS Works which includes a bit of explanation for how $logfile fits into the grand scheme of things.

This link will take you to the MS webpage for the Sysinternals File and Disk Utilities, from whence you can download a little app called NTFSInfo which will give you the ability to dump some of the NTFS ****-data, including, I believe $logfile, as described on the NTFSInfo webpage.

 

I recently built a machine and put XP with SP3. A 1TB drive NTFS formatted.

I'm seeing similar continuous writing to these NTFS **** files...

6:50:57 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 41984000 Length: 8192
6:50:57 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 12288 Length: 4096
6:50:57 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 0 Length: 4096
6:51:02 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 41992192 Length: 4096
6:51:02 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 8192 Length: 4096
6:51:02 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 4096 Length: 4096
6:51:03 PM System:4 IRP_MJ_WRITE* C:\$Mft SUCCESS Offset: 98443264 Length: 4096
6:51:03 PM System:4 IRP_MJ_WRITE* C:\$Mft SUCCESS Offset: 98533376 Length: 4096
6:51:03 PM System:4 IRP_MJ_WRITE* C:\$Mft SUCCESS Offset: 790528 Length: 4096
6:51:03 PM System:4 IRP_MJ_WRITE* C:\$Mft SUCCESS Offset: 38596608 Length: 8192
6:51:03 PM System:4 IRP_MJ_WRITE* C:\$Mft SUCCESS Offset: 38797312 Length: 4096
6:51:03 PM System:4 IRP_MJ_WRITE* C:\$Mft SUCCESS Offset: 38862848 Length: 4096
6:51:03 PM System:4 IRP_MJ_WRITE* C:\$Mft SUCCESS Offset: 64925696 Length: 4096
6:51:06 PM System:4 IRP_MJ_WRITE* C:\$Directory SUCCESS Offset: 245760 Length: 4096
6:51:06 PM System:4 IRP_MJ_WRITE* C:\$Directory SUCCESS Offset: 28672 Length: 4096
6:51:07 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 41996288 Length: 4096
6:51:07 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 12288 Length: 4096
6:51:07 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 0 Length: 4096
6:51:10 PM System:4 IRP_MJ_WRITE* C:\$Mft SUCCESS Offset: 8192 Length: 4096
6:51:10 PM System:4 IRP_MJ_WRITE* C:\$Directory SUCCESS Offset: 237568 Length: 4096
6:51:10 PM System:4 IRP_MJ_WRITE* C:\$Directory SUCCESS Offset: 16384 Length: 4096
6:51:12 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 42000384 Length: 4096
6:51:12 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 8192 Length: 4096
6:51:12 PM System:4 IRP_MJ_WRITE* C:\$LogFile SUCCESS Offset: 4096 Length: 4096


I've tried Filemon and ProcessMonitor to get more information but all I see is activity in System:4 process and ntfs modules...nothing else.

My disk activity light is flashing pretty much every second or less...even when idle..and all the usual services, e.g. auto update and indexing are turned off.

The same issue crops up in a number of places without resolution...

http://www.theeldergeek.com/forum/lofiversion/index.php?t29412.html
http://www.eggheadcafe.com/software/aspnet/31199540/constant-hard-drive-activ.aspx
http://forum.sysinternals.com/forum_posts.asp?TID=2072

 

MFT = Master File Table -- basically NTFS directory information.

But... look at not just the files but also the processes shown in Resource Monitor. If the process is svchost.exe, look at the PID (process id), and then in Task Manager, Services tab, sort by PID and see why services are running under that PID.

Most likely it's one of these:
- Defrag (automated by default)
- Windows Defender (automated scans by default)
- Superfetch (especially active just after closing a program)
- RACAgent (some performance & reliability data collecting thing that runs every hour by default)
- System Restore (runs once or twice a day by default)
- Windows Update (runs once or twice a day by default)
- Search indexing (doesn't do too much once it's indexed your files though)

Any third-party software you have installed could potentially add stuff to the list.

 

Did anyone find a solution to this problem? Maybe we all have something in common with this problem?

Samsung HD 250gb 7200RPM
I'm on a Dell XPS 1530

What else might be a factor?

I use Verizon Fios
I have a logitech wireless mouse v320
I have logitech speakers
I have 4gb of ram but im on 32 bit vista so only 3.5 is used.


Anyone?

 

I have 4GB RAM also with Windows XP reporting only 3.18GB available.

I read some other forums which indicated that it might be a hardware/bios problem relating to SATA dvd/cd drives...so I physically removed the drive to see if it made a difference - can't say it did So I put it back in.

I also tried swapping the SATA cables and changing which sockets in the motherboard they connected into -all with no effect.

I'm going to try installing to a different and smaller drive and see if that has an effect. Alternatively, I might repartition the 1TB space into 300GB and 700GB spaces to see if that has an effect.

Perhaps I should try taking out one of the memory sticks and dropping down to 2GB RAM to see if that has any impact.

 

you think reformatting windows would do the trick?