Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Recently I noticed some of our machines are getting sluggish, mainly after boot-up. Using the Resource Monitor I detected excessive disk access from the system process with PID 4. Following some tips, I disabled the anti-virus on the System Volume Information folder, hoping it will help (I don't want to disable system restore).

However, it seems like PID 4 is accessing everything. When running a simple extraction of a ZIP file, I can see the WinRAR reading a few hundreds KBs per second from the file, but PID 4 reads dozens of MBs per second from the same file. After cancelling the operation, PID 4 keeps accessing the file for around 30 seconds, reading many MBs per second. This is not a Resource Monitor bug, as the disk is clearly active, and stops once resource monitors says PID 4 is finally resting.

Why is this miraculous process accessing everything every other process accesses?

I'm using the AVG antivirus. Disabling it did not change this behavior/

What is going on here?

share|improve this question
1  
PID 4 is the Process ID for the Windows SYSTEM process. It's a lot like PID 1 on Unix systems, in fact. A lot of services run under PID 4. –  sysadmin1138 Aug 19 '12 at 13:13
    
Don't services run under their own processes? Anyway, even if that is so, why is it ordinary file accesses in regular non-service processes are mostly done under PID 4? –  zmbq Aug 19 '12 at 19:30
    
I have the same problem and can't find any solution too. By any chance, do you use TrueCrypt? I use TrueCrypt system-wide encryption and I suspect that might be the cause, as it is running under "System" as a driver, and it needs to encrypt/decrypt every file access. –  Paya Aug 20 '12 at 0:15
    
No, no TrueCrypt or any form of encryption here. –  zmbq Aug 20 '12 at 4:57
    
Related question here: superuser.com/questions/349349/… –  Paya Sep 5 '12 at 21:03

4 Answers 4

A lot of system services (I don't mean Windows Services) run under PID 4, the "System" process. Every time you open a file, you trigger a slew of background mechanisms such as the virtual memory manager caching the file in memory, moving other things around in memory, servicing page faults, etc. That activity is separate from the disk activity charged against the process that originally accessed the file, e.g. WinRAR.

That said, what you're describing still doesn't sound like normal behavior to me. You should see a quick bump in disk activity from the System process when the file is accessed, and then it should go back to 0 rather quickly - within a couple seconds.

I did a little testing on my own machine using Windows Resource Monitor, and I saw somewhat similar behavior. What I think we're witnessing is Resource Monitor showing us some sort of rolling average that is slow to drop off.

Try looking at PID 4 disk activity using another tool such as Sysintenals' Process Explorer. I got a much different impression from it, as the Read Delta and Read Bytes Delta by the System process seem to return to 0 much faster than when viewed through ResMon.


Edit: If that's not it, then I think a more in-depth analysis is going to be needed in order to answer the question. For instance, you can list the currently-loaded file system filter drivers with fltmc.exe, and kernrate.exe can help you isolate those modules which are causing inordinately high disk I/O.

share|improve this answer
    
OK, sure, I'll try the process explorer and see what's going on. –  zmbq Aug 21 '12 at 6:56
    
@zmbq: Have you managed to find out what's going on? –  Paya Sep 1 '12 at 7:06

This is an older question, but I had this issue, and for me it was SuperFetch. I tried everything I could find on PID 4 excessive hard drive usage, and some of it helped. A RAM upgrade from 4GB to 8GB only made the issue more obvious - RAM usage was low, no paging, but yet the hard drive was lit up for ~10 minutes after my laptop booted.

Long story short, there's a registry setting that controls what level of SuperFetch is appropriate. You can see below the EnableSuperfetch value is now set to 1, which seems to be "prefetch all executables and libraries". The default is a 3, which seems to mean "prefetch all executables, libraries, and documents". I have many documents, so I think this was taking way too long. Every document opened is another one that SuperFetch has to "analyze" to see how you're using it.

The registry key/value in question is: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\EnableSuperfetch

So far the only downside is that my outlook folders take a few extra seconds to open, and some commonly used documents like MS Project files take longer. But those delays pale in comparison to the disk thrash I was getting before!

SuperFetch Registry Key

share|improve this answer

System process is used by Windows Update. If you have selected to install updates automatically, it is probably your systems is currently installing windows software. If you run Windows Update and try to install updates you will receive a message saying you cannot install as Windows is currently updating the system.

Change the Windows Update to not downloading and installing without manual action and wait the current installation to finish.

share|improve this answer
    
This worked for me. My problem was IE made System (PID4) use 100% of the drive. Turning off IE's Automatic Update (Help->About IE->Install new versions automatically) fixed it. –  Coomie Jul 9 '13 at 1:41
    
@Coomie what version of IE has this 'feature'? –  BigHomie Jul 17 '13 at 13:52
    
@MDMoore313 IE 10 –  Coomie Jul 18 '13 at 1:37
    
@Microsoft, Why should IE upgrade itself from kernel-mode/ring0? –  Петър Петров Oct 9 at 20:54

I had the exact same symptoms. In my case they were related to Norton360 and the MS-SQL VSS service. Once I disabled VSS, my activity dropped significantly. System still locks up when Norton does it's thing, but it's semi bearable since it only seem to happen every hour.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.