Initial Boot - excessive disk access

When I booted today, my system was busy. Very busy. Didn't even finish
rendering the desktop icons. Drive light on full time. This lasted for
five minutes

So, I started procexp and took a look. Explorer itself seemed to be
sucking at least 20% of the CPU. It was the only program getting
significant CPU time.

The severe disk access was not showing up as reads or writes. There
was one csrss.exe and one svchost.exe process were steadily doing
repetitive IO, about one read every second each, but that continues
now and has no impact. They each took about 5% of CPU on and off.

Also, the svchost process had a sub/call running under it that was
"wu.....exe" that was identified as "windows automatic update process"
even though I have automatic updates shut off. But again, the IO was
limited to that one per second.

There did not appear to be any network access, at least there were no
connections showing in netstat beyond a couple shared drives that were
just hanging around.

So, what gives? what sucked up my CPU and drive access for so long?
And why didn't the disk access show up in procexp? Is this some sort
of behind the scenes access that MS intentionally or unintentionally
hides from any performance programs?

Thanks,

"+Bob+" <uctraing@ultranet.com> wrote in message
news:rs6v54drpe5rffq440ji5h67emgoguf22k@4ax.com...
> When I booted today, my system was busy. Very busy. Didn't even finish
> rendering the desktop icons. Drive light on full time. This lasted for
> five minutes
>
> So, I started procexp and took a look. Explorer itself seemed to be
> sucking at least 20% of the CPU. It was the only program getting
> significant CPU time.
>
> The severe disk access was not showing up as reads or writes. There
> was one csrss.exe and one svchost.exe process were steadily doing
> repetitive IO, about one read every second each, but that continues
> now and has no impact. They each took about 5% of CPU on and off.
>
> Also, the svchost process had a sub/call running under it that was
> "wu.....exe" that was identified as "windows automatic update process"
> even though I have automatic updates shut off. But again, the IO was
> limited to that one per second.
>
> There did not appear to be any network access, at least there were no
> connections showing in netstat beyond a couple shared drives that were
> just hanging around.
>
> So, what gives? what sucked up my CPU and drive access for so long?
> And why didn't the disk access show up in procexp? Is this some sort
> of behind the scenes access that MS intentionally or unintentionally
> hides from any performance programs?
>
> Thanks,

Do you have indexing enabled?

-pk

On Tue, 24 Jun 2008 12:27:20 -0400, "Patrick Keenan" <test@dev.null>
wrote:

>"+Bob+" <uctraing@ultranet.com> wrote in message
>news:rs6v54drpe5rffq440ji5h67emgoguf22k@4ax.com.. .
>> When I booted today, my system was busy. Very busy. Didn't even finish
>> rendering the desktop icons. Drive light on full time. This lasted for
>> five minutes
>>
>> So, I started procexp and took a look. Explorer itself seemed to be
>> sucking at least 20% of the CPU. It was the only program getting
>> significant CPU time.
>>
>> The severe disk access was not showing up as reads or writes. There
>> was one csrss.exe and one svchost.exe process were steadily doing
>> repetitive IO, about one read every second each, but that continues
>> now and has no impact. They each took about 5% of CPU on and off.
>>
>> Also, the svchost process had a sub/call running under it that was
>> "wu.....exe" that was identified as "windows automatic update process"
>> even though I have automatic updates shut off. But again, the IO was
>> limited to that one per second.
>>
>> There did not appear to be any network access, at least there were no
>> connections showing in netstat beyond a couple shared drives that were
>> just hanging around.
>>
>> So, what gives? what sucked up my CPU and drive access for so long?
>> And why didn't the disk access show up in procexp? Is this some sort
>> of behind the scenes access that MS intentionally or unintentionally
>> hides from any performance programs?
>>
>> Thanks,
>
>Do you have indexing enabled?
>
No, it's shut off on all drives.

Problem happened again today. The "Windows Automatic Update" process
was again running even though I have automatic updates and update
checks disabled.

I killed the process and the drive activity stopped. I just went in
and disabled the process. I'll see if that cures the problem.