3

I installed a new HD into a machine and reinstalled Win7 Pro.

The computer is unusable. Every 30 seconds to a minute, the computer completely hangs. Memory never goes above 15%; minimal CPU usage. Nothing open.

The disk monitor, however, acts strange:

The Queue will be pinned, I/O pinned for a few seconds, then I/O drops to zero, queue stays pinned, then eventually all the Processes disappear one by one, then the queue will stay pinned and eventually after some time recover and work properly for another 20-30 seconds.

Frustratingly, as usual, there is nothing helpful at all in eventvwr.

I've tried updating the drivers.

I rand chkdisk and got a clean bill of health (also, there were no pauses like happen in Windows that I noticed--and I was watching closely--so it's not an issue with the HD itself).

Windows becomes totally unresponsive--can't launch taskmgr or make any other changes until it starts responding again. However, resource monitor keeps trucking (kinda). Heres a couple of shots:

First--when the blue line redlines, computer does not respond

Mid-awesome

YAY FEEL FREE TO GET 30 SECONDS OF WORK DONE

Any clues/advice welcomed

Update:

I forgot to mention another oddity. Earlier when trying to track down the issue in eventvwr, I noticed a couple of events from tomorrow(!). Now, it's on a domain which pushed ntp server, if that matters. Also, when going through the install, I accidentally set the timezone to -8, when it should have been -5--still not an entire day.

Also, upon encouragement, I watched the issue with Process Monitor while Resource Monitor was open (so I could see it spike and know it "crashed"). Nothing much of note; the only process that shows while the system is hung is Resource Monitor--no other processes. Directly before the crash, the only thing was a ntp related error. After the crash, a ton of writes.

Could the time setting be messing this up? Would and ntp update cause a hang like that?

Improve this question
10
  • Filter -> Advanced Output and Filter -> Reset Filter should show procmon.exe but I don't see why you would want to do that; the point is that you just start it at an arbitrary point, wait for it to hang and after the hang you save a .PML file which you can analyze. That could outline what NTP is doing. If that's not enough then ADK allows you to check the stack to see what function made the ADK do that and draw a conclusion. Do you know what it wrote after the hang? If it's producing crash dumps, these could be useful too...
    – Tamara Wijsman
    Apr 4, 2012 at 19:33
  • Is it normal to have buffer overflows here and there in the PML?
    – stormdrain
    Apr 4, 2012 at 20:09
  • 1
    Yes, in C++ and with the Windows API it is a common practice to first call an API with a smaller buffer to determine how big the buffer should be and then call the API with a bigger buffer. The first call is a "buffer overflow" because the buffer is too small, if you look carefully you will see a second very similar call that succeeds.
    – Tamara Wijsman
    Apr 4, 2012 at 20:12
  • Basically it requires you to filter things you know it couldn't be and looking around the times the hang starts / stops (correlating the time seen in the event viewer's details with that in the first column of PM), if you zip (or even rar/7z/...) the PML file it becomes a lot smaller in case you want me to take a look.
    – Tamara Wijsman
    Apr 4, 2012 at 20:20
  • There has been little in eventvwr to go on--no errors around the incidents. I just took another glance, though, and saw another ntpclient discovery error. This one states that it will retry in 3473457 minutes (no joke), so we'll see what happens in 6 years. I noticed an error in PML relating to USB, so on a hunch I went to OEM and reinstalled all the drivers--seems OK for now. Could you add your first comment here as an answer so I can accept it? ProcMon seemed to lead to a fix so I'd appreciate getting you the deserved credit. Thanks again.
    – stormdrain
    Apr 4, 2012 at 20:39

1 Answer 1

Reset to default
1

Using Process Monitor you can see what it is doing, look especially at the start and end of the hang for interesting events. You can correlate this with any events you see in the event viewer by taking note of the time it shows in the details of the events in event viewer. On servers Process Monitor will require filtering quite some irrelevant stuff away to bring it to a analyzable level.

There has been little in eventvwr to go on--no errors around the incidents. I just took another glance, though, and saw another ntpclient discovery error. This one states that it will retry in 3473457 minutes (no joke), so we'll see what happens in 6 years. I noticed an error in PML relating to USB, so on a hunch I went to OEM and reinstalled all the drivers--seems OK for now. — ancillary

In case someone ever gets a harder problem than this, my answer on Super User goes past the level of Resource and Process Monitor by using the Windows Performance and Windows Assessment Toolkit.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .