How to disable hard disk thrashing with Vista

No, it's not a bad joke. SuperFetch was responsible for all the pre-SP1. All the thrashing = SuperFetch.

 

Yes, I am aware of the Possible Settings for Fetch, and I do not find it to be a problem, nor effective to modify them.

I was just wondering about the two files; guess no one knows. ttfn.

 

What files? I don't wanna read the whole thread...

 

I'm still catching up on on the posts. Some say SuperFech makes no difference, mine is still enabled. Pre-SP1? Unless I add software or reboot, all is quite.

I'm still new to vista so not decided yet to go back to XP.

thx

 

If it works keep it. Pre-SP1 means before SP1. Before SP1 my HDD was spinning more and it was really noticeable almost all the time. Now it's chillin'.

 

To which post are you replying? It really helps if you quote the post when you reply.

 

I haven't found a few writes to the HD every minute affect my battery life to where I notice. Generally, I'll be in situations where I can confidently go off battery life alone (surfing the web at the coffee shop 2-3 MAX) or I have to charge up at least once (Flying to China, but they have plug in in the armrests).

 

I had to go to Linux to get it to stop....Vista's quiet now

 

Duh... I found an easier way to find out what it is... the first Google result... it's the Event Log service. Or rather... at least someone on the internet thinks so, lol.

http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=2669520&SiteID=17

It won't let me stop the service though due to a dependency... blackviper says Task Scheduler depends on Event Log, so that's probably the dependency.

 

My HDD activity is only when installing programs, uninstalling, or booting up.

Otherwise I'm pretty quiet.

 

My disk doesn't thrash at all. Typing this right now the HD light hasn't flashed once. I'm on Vista Home Premium if that matters.

 

Yeah. I found a number of those less-than-definitive "answers", too.

 

AKAJohnDoe wrote: "Has anyone found the definitive answer to what that pair of lastalive files actually are and do?" Yes. LastAlive writes a timestamp and a small amount of other system info to the harddisk on a very frequent, regular basis, with the consequence that if the system should die a sudden catastrophic death, some context information about the catastrophy will be available when the system is rebooted. You can find more info about this on the Internet -- including in Microsoft's official documentation believe it or not -- by searching for the words LastAliveStamp and TimeStampInterval. See e.g. http://technet2.microsoft.com/windowsserver/en/library/5c6e30b2-6803-418d-a7b5-e4eb79323db51033.mspx

TimeStampInterval is a registry key that defines how often the LastAlive info is written to the harddisk. It is at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\
By changing the registry value of TimeStampInterval to zero, you will stop the writes to the lastalive0.dat and lastalive1.dat files on your harddisk. I've done this on my machine. I believe it has no effect on performance one way or another because the amout of data that's being written to the disk by LastAlive is too small, even though it's being written very repeatedly. But as far as I'm concerned it's always nice to eliminate unnecessary disk activity, even when the benefit is imperceptible.

Now I wish I could find out how to eliminate the more heavy unnecessary disk writes that Ari_M was talking about... NTUSER.DAT, USRCLASS.DAT, $LogFile (NTFS Volume Log), etc.

 

I HAVE FOUND THE ACTUAL CAUSE! I am positive this is what has been causing the intense disk activity on my IBM laptop with Vista Business with SP1 and on my desktop with Vista Home Premium with SP1. It is task scheduler but more specifically it is System Restore. Go to your start meu, all programs, accessories, system tools, and then task scheduler. In task scheduler drop down task scheduler library, microsoft, windows, system restore. Now from here check the "triggers". It is scheduled to run on every system startup and every day at 12:00 am. Then check "conditions" and you'll see task scheduler will queue the system restore task on these triggers to run once the computer has been idle for 10 minutes. This is the cause, it's your choice how you want to change this from happening. You can turn system restore off, you can just delete this task completely and run system restore manually, or (I haven't tried this yet though so I don't know how well this will work but) within the task if you double click on the task "SR" you will get a new window, go to conditions, and under where it says "Start the task only if the computer is idle for:" there is a check box that says "Stop if the computer ceases to be idle". Check this box and the hard drive activity should stop if you start working on your computer again. Or you can just delete one of the triggers or you can change the idle time to longer than 10 minutes. Please post and let me know if that fixes your excessive hard drive access issue.

 

Turning off SuperFetch pretty much stopped all of my HD thrashing -- it's been off for months and I haven't missed it. I'm on Vista32 Premium with SP1 loaded.

 

I had no use for System Restore, nor for Indexing, so they were both turned off/disabled long ago on my PC. Fetching stayed on.

 

Some have disable superfetch to stopped the HDD thrashing.

 

After I did the initial clean install, I disabled all of the usual suspects and Vista went through the process of adjusting to my habits. I had absolutely no disk thrashing after that (took about 1 week). Then, about two weeks ago, I noticed that I was having the problem every 10 or so seconds. I can't do anything about it, though. I can't seem to make it stop no matter what I do. My habits have remained the same, so I don't understand why this is occurring now.

 

AKA, are there any cons to turning system restore off completely? I have Acronis and I use that to back my system up every few days. Is that enough? I really think I would like to disable system restore, but I'm kinda afraid to do that at this point.

 

You know, it really depends upon your backup/restore strategy. If you have none, you should definitely leave Windows Restore on. If you do not regularly (i.e.: at least every 30 days) validate that your backup can in fact be restored, then you should also leave Windows Restore turned on.

Myself, I have a backup strategy and validate it regularly.

 

I'll look this over. Thanks, AKA.

 

I'm going to cry, why is this problem happening to me! My hard drive is just spinning and making noise and I'm sick and tired of search every night for an answer.

Whats the answer?

 

Before all the "tweakers" jump in here and start offering you all manner of fixes, even though they have no clue what is REALLY causing your disk activity, do some investigation and find out yourself. Go to the sysinternals website (now part of Microsoft) http://technet.microsoft.com/en-us/sysinternals/default.aspx and get a copy of FileMon and DiskMon. They will let you see exactly what process is hitting the drive hard. Then armed with REAL information you can find out how to fix it. Or you can just listen to the "tweakers" advice that is sure to show up here any minute now, where they will have you turn off many of the truly useful features of Vista because they think they know more about writing operating systems than Microsoft does.

Gary

 

I usually keep a copy of AutoRun handy, even though I can get much of the same information elesewhere, just because I like the presentation.

There are a number of good tools from SysInternals.

 

i am facing the same problem. i have taken your advice and downloaded the two files (but FileMon is no longer operational, replaced by ProcMon). The information I got from DiskMon is useless because it doesn't say what is hitting the hdd, just lots of activity. The information I get from ProcMon says there are a lot of activity of the following kind:
-almost constant registry editing
-a lot of activity by svchost.exe
-a lot of activity by explorer.exe
-a lot of activity by firefox.exe (even when not surfing, just opened because i am typing this post)

indexing has been switched off

 

Filemon was NOT replaced by ProcMon. http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx But there is a better replacement for ProcMon, called Process explorer. It allows you to click on an instance of SVSHOST and get a list of what services it is actually hosting. Grab FileMon and get the specifics you need.

Gary

 

When I tried to run FileMon, a dialog box pops up to say it has been replaced by ProcMon.

P/S: we are talking about vista btw, just to be clear.

 

Also, a simple tasklist /svc command works

 

Yeah, I see that now. Did ProcMon offer you any sort of IO specific info on each process. Not just which ones were using the CPU but which ones are writing to what files?

Gary

 

no, both diskmon and procmon scrolls so fast i can hardly see anything useful. procmon can filter events - registry, io, etc. the events log gets updated every second - same as my hdd indicator it is blinking every second.

 

Assuming you have SP1 installed already... IMO Superfetch, Defrag (automated to run once a week by default), and Defender (automated to scan daily by default) account for a large fraction of Vista's disk thrashing in the default setup. Turn these 3 things off (you can schedule Defender to run weekly instead of daily, or turn it off if you use something else), and you should see less disk access.

Other things that cause disk access when idle include System Restore and Windows Update. Also if you have WMP or other media players open, they may be indexing your library etc. if you have them running in the background.

Another "answer" is to get a fast and quiet hard drive. Fast makes for less time the drive needs to be accessed, and quiet makes it so you don't really notice it. I don't really notice my drive being accessed with my Hitachi 7K320 drive, unless I'm really paying close attention.

As for process/disk monitoring... Vista's built-in Resource Monitor (accessible from Task Manager, Performance tab) is easier to use IMO than Sysinternals' Process Monitor, mainly because it gives much less information. That's ok though, it's still enough to get started with. Expand the "Disk" section and see what files are being accessed, and by which processes.

 

You need to set up the filters to include only the processes that are doing most of the "damage". Also you can pause/halt the monitoring process and then scroll back through the logs to help you determine what is happening.

Gary

 

I address my post to people who experience disk thrashing for more than 2-3 minutes after boot up and logon and have systems with Vista, Hybrid HDD with some amount of NV cache onboard and Superfetch sevice enabled.

There are two separate periods of disk thrashing. It's hard to point them out if you don't look at the PC behaviour too carefully. You can notice the first period by opening Windows Task Manager and carefully watching the "Free" parameter in "Physical Memory (MB)" group. The first period of disk thrashing occures right from the moment after logon till the moment when the "Free" parameter reaches a value of zero or close to zero, which means that Superfetch has cached all the prorgrams it thinks need to be cached into RAM, this period lasts for about 2-3 minutes. The second HDD thrashing period starts some time after the first period is finished with HDD showing constant heads activity (physically audible) and HDD led almost constantly lighting, and it can be from 3-5 to 12-15 minutes long.

The key difference between these two periods of thrashing is that during the first period the disk activity is not too constant and I/O operations are of not too high priority, which means that if you try to start MS Outlook for example, there will be some slight lower performance, but not too annoying. In the case of the second thrashing period, however, if you try to start the same Outlook, it will start much longer performing it's read/write operations in a different manner (the application is only able to read its files during short milliseconds periods which come about one second one after another).

My assumption is that for the first HDD thrashing period you should blame Superfetch, but it's noticeable only for about 2-3 minutes after logon and it still allows you to perform some operations with intensive disk I/O activity. The second thrashing period is connected more with HDD itself and its NV cache functions: sometimes it looks very similar to some high-priority low-level defragmentation of service file tables or something; or re-arrangement of some data to be put to the NV cache.

It's worth adding that if you have your laptop waking up from hibernate, you are likely to witness a situation when the two described periods of high disk activity overlap on each other resulting in a fierce competition between Superfetch and hybrid HDD algorythms for the disks I/O resource. This can make you wait for about 15 to 20 minutes for your system to become more responsive.

On a Vista system with hybrid HDD, if you turn off all the NV cache features (four parameters) through group policies and leave Superfetch service on, you will only experience the first 2-3 minutes period of high disk activity and you're likely to stay happy with that. If you turn off the Superfetch service, but leave all the NV cache features enabled, both periods of thrashing activity will be gone and your system will behave similar to Windows XP in terms of managing memory and programs startup. Same behaviour will be with both Superfetch and NV cache functions turned off.

All what I've written in this post is not meant to be a final solution, as there are still questions and you still want to get the most out of your notebooks, not just disable every and any Vista feature to make your brand new laptop a Windows XP dinosaur (I say this because in spite of all the problems discussed here, I had Vista and XP on the same Vaio notebook and the performance of daily applications for me has improved dramatically in Vista). The purpose of this post is to make our search for answers a bit more directed instead of just collecting posts like "I have Vista and I'm going to migrate back to XP" or "Guys, what are you talking about here? Just turn off Superfetch and everything will be fine". Disk activity caused by scheduled tasks like virus checking, windows update or defrag is nothing compared with high-priority I/Os that I've described above.

P.S. BTW, I've noticed that if you have a PC equipped with a hybrid HDD, if you have the Superfetch service turned off, then Vista makes no use at all of your HDD's NV cache features (even when these features are enabled for Vista through Group Policies), as Superfetch is responsible for watching the contents of memory and moving them around RAM, pagefile and NV cache of HDD.

P.P.S. There are two things worth studying that can be (IMHO) somehow connected with the problem: 1) Windows Search (and its index files that can be eager to get into the NV cache, as they are frequently accessed right after boot up and logon) and 2) option in Vista power plan called "Windows Hybrid Hard Disk Power Savings Mode" (for "On battery" and "Plugged in" cases) in "Hard disk" group; my assumption for this is that if you enable this hybrid power savings mode not only for "on battery" case, but for the "plugged in" case also, you may experience less disk thrashing during the second period, as HDD utilizes its NV cache features in a more efficient way (a guess that I have to check).

 

As an addition to my previous post, I'm adding a YouTube link with an illustration of a hybrid HDD behaviour during the second period of high activity:
http://ru.youtube.com/watch?v=GhZcJLK-jok

Watch the mid yellow LED, blinking almost constantly.