Hard disk activity every second

[unixfreak]

Hi, drives me crazy listening to a continuous, very regularly noise from harddisk activity occurring exactly every second. How can I find out what is causing this?

Thanks

-----
Cheers,
Henrik Morsing

http://www.aixperts.co.uk/

Join us on irc://chat.freenode.net channel ##aix

 

[danomac]

If you get Sysinternal's Process Monitor it should be able to help you with that.

It provides a lot of output that will require parsing, but it should be able to tell you which process is causing the disk activity.

 

[Diancecht]

Or take a look at DiskMon

Cheers,
Dian

 

[BadBigBen]

Do you have Windows Search 4.0 active?

try turning the Service for it off and the Indexing Service, to see if stops...

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[unixfreak]

"If you get Sysinternal's Process Monitor it should be able to help you with that.

It provides a lot of output that will require parsing, but it should be able to tell you which process is causing the disk activity."

Thanks, I'm completely new to Windows, how do I get to that?

-----
Cheers,
Henrik Morsing

http://www.aixperts.co.uk/

Join us on irc://chat.freenode.net channel ##aix

 

[Lemon13]

here

http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx

M. Knorr

MCSE, MCTS, MCSA, CCNA

 

[goombawaho]

It provides a lot of output that will require parsing"

That doesn't sound like what I'd want to do - a lot of parsing.

Is there nothing that would be just like DiskMon but that shows which process is owning the read/writes????

 

[danomac]

Process Monitor provides a *lot* of output. In a few seconds there can be a couple of thousand entries - but it'll be very obvious what's causing the disk activity.

On my workstation here at work, I can see (for example) that for some strange reason Symantec's software reads and writes to the disk every few minutes. There's at least a hundred entries that indicate this.

In the OP's case, running for a few seconds should be enough and the log will not be insanely large.

 

[JockMullin]

The regularity of these disk events and the fact they are even audible is interesting. Most modern HDDs make very little noise during normal access. However what does make noise is if the disk does a recalibrate/retry for any reason, and that also involves a consistent timeout.

For sure on my systems you can't hear the hard disk above the bleeding blowers and fans.

So I'm wondering about possible drive issues. Maybe try the diagnostic program for your drive?

Also might try safe mode w/o networking and see if it still happens then.

Jock

 

[linney]

Have you tried isolating the cause?

310353 - How to Perform a Clean Boot in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310353&FR=1&PA=1&SD=HSCH

316434 - HOW TO: Perform Advanced Clean-Boot Troubleshooting in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;316434&FR=1&PA=1&SD=HSCH

310560 - How to Troubleshoot By Using the Msconfig Utility in Windows XP

http://support.microsoft.com/kb/310560

 

[unixfreak]

There's nothing wrong with the harddrive and it's nothing coming in from the network. "Isolating the cause"? Maybe over-analysing things here?

I tried the DiskMon tool and it doesn't list anything about processes and the disk access is listed as block number on the disk and I don't have a tool to convert a disk block to an actual file.

I've tried stopping stuff but not sure it helped. I'm guessing it's something like the Virgin Media "Safety package" that's doing it but would just like to have it confirmed.

-----
Cheers,
Henrik Morsing

http://www.aixperts.co.uk/

Join us on irc://chat.freenode.net channel ##aix

 

[Diancecht]

You can try ProcMon instead of DiskMon, filter disk activity and there you will hava a list of processes

Cheers,
Dian

 

[goombawaho]

Ummmm - ProcMon is the same as Process Monitor which was suggested above. Unless you're talking about something different, which you need to provide a link to.

 

[Diancecht]

Actually it is the same, didn't notice.

Cheers,
Dian

 

[rirusstek2]

I have also some constant activity on my HDD.

With the help of JockMullin and every suggestion on this post I used ProcMon and found the culprit that is making the constant activity on my HDD.

Here is the repetative sequence:

http://img19.imageshack.us/img19/9168/activityqz.jpg

Now, any suggestions on what to do to get svchost.exe find that file not found and "calm down"???

Thank you.

 

[goombawaho]

I know somebody is going to have a better suggestion, but here is my "redneck" approach.

Do a registry cleaning with CCleaner or something that you trust and see if it flushes out some problem. Can't hurt.

Look at Event Viewer to see if there are any repeating errors or warnings.

 

[rirusstek2]

I tried CCleaner and ran through and checked everything out... but the small activity did not stop.

What would happen if I deleted that key that svchost.exe keeps referring to? NOT FOUND 144

Any suggestions?

 

[danomac]

Given the output of the screenshot, it looks like Windows is having a problem either with a network interface or the TCP/IP stack.

Have you tried figuring out which interface it is an reinstalling or repairing that connection?

You might find more clues in the registry under those keys. It's possible the DHCP client and/or server service is flaking out.

 

[BadBigBen]

It may sound wierd but have you run alware scans with your AV, and I would suggest that you DL MBAM - MalwareBytes AntiMalware and SuperAntiSpyware and run scans with both also...

this would rule out that you may have an infected PC, that is trying to connect to something on the internet or that it messed with your TCP/IP stack or even DHCP Service and Client...



Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[Diancecht]

I don't agree with the net problem: svchost is used to start a lot of windows services, so you have to find out which one is this.

Open the Task Manager, find the PID, right click, go to services and see which one is (if any)

My bet: Windows Defender

Cheers,
Dian