How To Diagnose a Suddenly Slow Windows Computer? 835
Ensign Taco writes "I'm sure nearly every one of us has had it happen. All of a sudden your Windows PC slows to a crawl for no apparent reason. Yeah, we all like Linux because it doesn't do annoying things like this, but the Windows desktop still reigns supreme in most managed LAN work environments. I'm running XP with 4G of RAM and a decent CPU, and everything was fine, until one day — it wasn't. I've run spybot, antivirus, and looked at proc explorer — no luck. There is no one offending, obvious process. It seems every process decides to spike at once at random intervals. So I'm wondering if there's a few wizards out there that know what to look at. Could this be a very clever virus that doesn't run as a process? Or could this just be some random application error that's causing bad behavior? I've encountered this a few times with Windows PCs, but the solution has always been to just add more hardware. Has anyone ever successfully diagnosed this kind of issue?" And whether such a problem is related to malware or not, what steps would you take next?
Check the HDD (Score:5, Informative)
Very commonly this happens when a hard drive reverts to PIO mode after Windows decides it has seen a few errors from the drive. You can verify this by looking at the properties of the IDE Controller to which the drive is connected in device manager. (IDE ATA/ATAPI Controllers/Primary IDE Channel/Advanced Settings tab, for example)
There is a VBScript [winhlp.com] that resets the drive back to DMA mode, and is effective if that is indeed the case.
This could also be an early sign of hard drive failure. I've seen plenty of drives that passed diagnostics but were very, very slow. Try checking the SMART data with something like HDTune [hdtune.com].
Process Explorer (Score:5, Informative)
I'll be the first of many to suggest:
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Use process explorer (Score:2, Informative)
Another option under vista is to use the "Reliability and Performance Monitor" in control panel.
Hmmmm. (Score:5, Informative)
Not a lot to go on, though as a freebie, XP doesn't do jack with that extra gig of RAM...You could put in 100gigs and it won't use any more than 3 (less you're using the 64 bit version, iirc).
Rootkits can run "under the radar". Might want to try software like RootKitRevealer, or Blacklight. A crappy one might grab a ton of cycles for a minute, but most of them are less intrusive.
Everything spiking at once sounds like that stupid "System Restore" process, or maybe a big swap dump (which is weird with that much RAM, but you know, it's windows.) Stupid programs like Norton can grab a huge chunk of resources every now and then for no discernable reason. Maybe some peripheral is crapping out?
Barring malware, I'd start writing down what's running when it spikes, and see if that tells you anything. Lot of programs can cause momentary spikes, but background processes usually don't. You could try testing some of the hardware but without anything specific to look for, you're going to have a hell of a time finding something.
Second on the drive thing (Score:5, Informative)
But rather than just checking SMART, get the manufacturer's test program. All the HD makers have one, just get the one appropriate for yours. It's the sort of thing you boot from CD and let run for a few hours, but it is the way to go. SMART can report ok even when a drive is dying but it is extremely rare (though possible) that the manufacturer's diags give it a pass when it is dying.
Check that, since a dying drive often makes things really slow (in part because it starts remapping lots of bad sectors).
safe mode (Score:4, Informative)
Re:Two biggest things (Score:3, Informative)
Somehow my link didn't appear. Hijack This! [download.com] should be able to be downloaded from http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html [download.com]
Hopefully one of those two will show up.
1. run task manager (Score:1, Informative)
2. look at processes tab
3. go view, select columns, put in all columns
4. now click on the title of each column, which will sort ascending/ descending, and analyze each column by itself, one at a time
5. look especially for processes that are doing heavy cpu or heavy i/o, or other bizarre exotic behaviors, like high thread count
My check list (Score:4, Informative)
My usual check list for this is:
1) Check the hard drive, SMART, or manufacturer diagnostics
2) Get the manufacturer diagnostics, and run a full hardware validation
3) If all is clean, check for things recently updated - a bad update may be clogging things
4) Check your anti-virus/anti-spyware software. Sometimes they can switch into extra-paranoid mode and slow things down horribly.
The Case of the Slow System (Score:5, Informative)
Mark Russinovich has an enlightening blog entry called The Case of the Slow System [technet.com] that might serve as an example of how, if you are are one of the planet's top 10 Windows experts, you can, with persistence, luck, and the proper tools, solve one of the obscure problems that are slowing down your wife's computer. This particular case pertains to Vista, but the general techniques are applicable to XP as well.
bad fan? (Score:5, Informative)
Some systems will slow down the CPU if it gets too hot. Check the fans and the temp in the CMOS if it can report it.
Turn off indexing (Score:3, Informative)
Indexing really slows things down. Also, check you AV and Spyware settings and think about turning off any real-time file monitoring. Indexing plus real time file monitoring equals slowness. Finally, run 'msconfig' and check what is starting up at runtime. If you don't know what it is, get rid of it. You can always add it back.
I once looked at a coworkers system and he had processes starting up at runtime that were called, I kid you not, A, B and blank (no name at all). Removing those restored his system.
Check heatsinks and fans (Score:3, Informative)
background defragmenting (Score:5, Informative)
From: http://www.kessels.com/Jkdefrag/ [kessels.com]
How do I disable the Windows built-in defragger?
Windows 2000 & 2003:
The built-in defragger is not started automatically.
Windows XP:
1. Download the free * Tweak UI utility from Micorosft.
2. Click on 'General' and untick the 'Optimise hard disk when idle' box.
Windows Vista:
1. Start -> All Programs -> Accessories -> System Tools -> Disk Defragmenter
2. Untick the "Run on a schedule (recommended)" box.
Check Harddrive (Score:3, Informative)
Harddrive failure could cause mastery hangup like that. The harddrive will retry for a few times, up to a few good ten seconds, causing all the I/O requests hanged for ten or more seconds.
The harddrive LED might be lit, but might be not. Also pay attention to the access sound, it will become very weird and repetitive when that happens. (Ya harddrive is getting more quiet now and the noise might get overwhelmed by the fan noise)
I experienced this for a few tens in the past ten years or so. (last time it happened on my laptop a few months ago). Again the symptom is - mystery hang up for a few ten seconds, then it went good (either retry success) or some application crashed (I/O error and HDD give up). Smart details usually can't show anything really that usual, or may be just 1 or 2 pending reallocation count, but SMART long SelfTest will usually do the job to catch the bad sector. Use "smartctl -t" in Linux.
At any case, replace the offending harddrive ASAP (after backing up all the data), because bad sector that keep recurring means something wrong with the head or alike, not just the specific spot on the media, and the bad sectors will spread like cancer!
Re:Check the HDD (Score:1, Informative)
actually just seeing the errors slows windows to a crawl. as it writes a log entry to over and over to the already failing disk.
a loose sata cable + windows logging will slow a pc to nothing.
Comment removed (Score:5, Informative)
Comment removed (Score:5, Informative)
Re:Hmmmm. (Score:5, Informative)
Just FYI, the reason for this is because with 32 bits, you're system is limited to 2^32 bits of address space = 4GB of memory in total, which has to include both RAM and the memory on your graphics card.
So in many cases, users with 4GB of RAM will only see 3GB becuase they have a 1GB graphics card. It follows that if a user only have a 512MB graphics card, then they will see (and XP will use) 3.5GB RAM.
This is not a design flaw for XP, it's a limitation if the 32 bit architecture. Switching to 64 bits solves this because then your total address space increases to 2^64 = 16EB. Which ought to be enough for anyone
Re:1. run task manager (Score:4, Informative)
And when it turns out to be svchost.exe, send a nasty email to Balmer.
I've seen systems start crawling on stupid windows background crap that only shows up in the process tab as "System Idle Process."
Compared to using ps or top, I'm not a fan of the scanty process tools in windows. The only decent one is perfmon; it's "Performance" under "Administrative Tools."
Open it up, go down to the bottom, right click on the little window under the graph and choose "add counters." Go ahead and add them all, and start the monitor.
Okay, now that your brain is bleeding, stop it, remove all the counters, and actually read the names and add only the ones you think you need.
Pretty much everything that's going on in the system is measured there, so you can get a pretty good idea of what the problem is, and that may point you in the direction of solving it.
Just as an fyi: if you're dumping to a log, make sure you have an idea of how much space it's eating up. A big perf log can eat up your whole harddrive if you leave it running.
diagnostics (Score:5, Informative)
Re:Check the HDD (Score:5, Informative)
Re:Second on the drive thing (Score:5, Informative)
Re:Use process explorer (Score:5, Informative)
How I do it (Score:4, Informative)
The general procedure I use is:
1) Get and install Debugging Tools for Windows [microsoft.com] for your platform.
2) Run kernrate.exe from the resource kit tools [microsoft.com] to determine if the problem is an I/O or CPU limit. (See here [live.com] for how to get symbolic usage information.) If you do not see anything hogging the CPU, it's an I/O problem and you should go to step 5.
3) It's a CPU problem, so use the information from kernrate to figure out who's bogarting the CPU. If the process is services.exe, rundll32.exe, or System, you need to use something like Process Explorer [microsoft.com] to determine which file actually contains the code which is executing.
4) If that doesn't work, it may really be an I/O problem or a rootkit. If you suspect a rootkit, your main options are reinstallation or forensic analysis using something like a boot CD, TSK [sleuthkit.org], and the NIST hash database [nist.gov] to audit your machine for bad files.
5) Run Process Monitor [microsoft.com] and see who's responsible for all the I/O.
6) If that doesn't reveal anything, it might be a driver problem. Use Process Explorer to see if you have excessive DPCs (the Windows equivalent of a top half interrupt handler). Use kernrate to zoom in and see which driver is causing them.
Re:Second on the drive thing (Score:5, Informative)
But rather than just checking SMART, get the manufacturer's test program. All the HD makers have one, just get the one appropriate for yours.
Careful, some manufactures have utilities that just check SMART and don't actually do a test.
Re:Second on the drive thing (Score:5, Informative)
I've had a Linux box slow to a crawl for the same reason, so definitely good advice if you're experiencing random slowness regardless of what OS you're running. When I ran top I could see the "iowait" percentage was near 100% frequently and also saw many drive-related error messages in the system log.
Re:Check the HDD (Score:5, Informative)
Its also worth mentioning that you'll see disk errors in the event log. The source will be 'disk.' Is the disk working hard. Use filemon to see whats going on.
The asker should also look in the event log for any warnings or errors that started at the time of the slowness.
He should also do a netstat -a to see what active internet connections are working. If youre seeing lots of connects to port 25 someplace then you are running a mass mailing trojan. Investigate any suspicious connections. You can use tcpview for more info.
He should also boot up with a linux live disc or a PE disc like UBCD4WIN. If the slowness is still there then its most likely a hardware issue. UBCD4win also has a bunch of utilities with easy to use GUIs like HDTune. He can run an antivirus or spybot from the PE environment too for a second opinion.
Lastly, when you fix the issue you should remove your wife from the administrators group and just make her a user or power user. When she needs to install software or whatever just have her log in as admin.
Injected DLLs? (Score:3, Informative)
Try and figure out though how it is being "slow"... is it CPU or disk activity or memory or what? Identify what is wrong with Task Manager and you will be much closer to fixing it.
If its coming from random processes... injecteD DLLs live in all processes and thus bugs in them can appear in any random process since the DLL is present in all of them. My personal example is WindowBlinds, which has had some compatibility problems... Visual Studio soared in CPU usage while idle, the last time I used it. A while ago there was a problem where Google Desktop would eat up memory until it crashed if Windowblinds was in use on the system. Use autoruns to check for such DLLs and disable any that belong to apps you don't use, and temporarily disable apps that you are using (such as Windowblinds).
The disk check idea earlier in the page is a good idea too.
As for ideas it might be automatic defragmenting, I looked into the way defragmenting works on NT a while ago to try and figure out if having files open is still a no-no when defragmenting a drive (it's not, the clusters can still be moved, yay) and I found out Vista's defragmenting task is low-priority process and IO... meaning it can't be the cause, as it will defer to anything else on the system that needs process or IO time. You wouldn't notice it running.
Real-Time Virus Scanning (Score:3, Informative)
I went through a similar experience recently with my Windows XP machine - tore my hair out going step-by-step through every possible cause.
It happened after the out of schedule Windows update. Turns out that Microsoft, in their infinite wisdom, turned on my McAfee real-time virus scanner. I't brought my system to a crawl whenever I'd try to play World of Warcraft. I didn't show up anything on Process Explorer and my video worked great, but my latency would slowly spiral out of control until it became uplayable.
I suspect that the real-time scanner was trying to process all inbound trafic before allowing it to pass on the calling process and it just couldn't keep up with the data bandwidth. Even disabling various McAfee security services didn't fix it - only uninstalling McAfee worked. Now my system runs better than ever (after having defragged a dozen times, uninstalled every unnecessary process imaginable, and cleaned the exhast fans).
Long story short - uninstall your virus software.
Sincerely,
A Chinese Hacker
Warning: Known sockpuppet/troll (Score:0, Informative)
User maintains more than a dozen sockpuppet accounts [slashdot.org] on Slashdot.
Re:Second on the drive thing (Score:5, Informative)
Checks SMART, can perform all SMART test (e.g. offline), gives loads of information on the drives internals and it can scan the disk surface using the disk-controller chip only (e.g no data transfer over the cable). The latter is really useful to test the surface and speed of a USB-HD.
Re:Sorry (Score:5, Informative)
Congratulations, you just invented a new word [google.com]!
Re:Hmmmm. (Score:5, Informative)
Accurate but oversimplified - video cards aren't the only drivers that are mapped into memory space, just (usually) the biggest thing.
If your drivers support it (many don't, which is why it's disabled by default - a driver which lacks support will cause crashes with this option) you can add /pae
to the boot.ini file to enable Physical Address Extension in the kernel. PAE uses an extra 4 bits for internal memory addressing, resulting in up to 64GB of RAM being addressable. Individual processes will still run with only 4GB memory spaces. However, Windows will map some of its physical memory above the 4GB mark, allowing drivers their accustomed memory mapping (assuming the driver developer didn't make assumptions that PAE violates, like that the address space stops hard at 0xFFFFFFFF).
Re:Check the HDD (Score:3, Informative)
Clearing the prefetch does not improve performance. It generally will decrease performance for a time.
http://lifehacker.com/5033518/debunking-common-windows-performance-tweaking-myths
MSCONFIG is your friend (Score:4, Informative)
If it isn't a virus or hardware issue, perhaps you have too many memory resident programs loaded?
At the Start menu click "Run" and then type in "msconfig" it will allow you to see what services, processes, and start up programs are in use. Naturally you want your Antivirus to load at startup but not your instant messenger programs and other useless junk that clutter up CPU cycles and system memory. Get rid of a few startup programs first and then reboot and see if the system speed improves.
It could be a corrupted registry [microsoft.com] and that link is to Microsoft's site on how to troubleshoot that.
If you cannot resolve the speed problem that way you might have a bad system file or files that went corrupt.
First make sure that you have:
#1 The original XP install CD without any service packs.
#2 The slipstreamed XP install CD [winsupersite.com] with the same service pack you are using.
Click Start and select "Run" and type in "sfc /checknow" and have those CDs ready when prompted for them.
Sfc is the system file checker and oddly enough it needs a non-service pack XP CD and an XP CD with your service pack on it. Best to make the slipstreamed version with SP2 or SP3 whatever you are using on it first. I hope you have the non-SP version of XP, if not borrow it from someone who does have it. This could be a tricky process but sometimes it works, but you need to reinstall all security patches after it runs.
Re:Try this (Score:1, Informative)
Unplug the network cable in the back and see if the problem persists. The network is a common cause of this problem.
Especially if you have any kind of Windows network share drives, printers, etc. setup.
Any latency, etc. on the network and/or devices will cause windows to stall out for long periods while it waits for a timeout. Often this happens even when nothing is apparently accessing the network.
This is especially noticeable when using Microsoft stuff like Office, Outlook, Word, etc. .xls on the network which stops responding, you'll see Outlook & word also start acting up since they have so many shared components.
For example, if you open a shared
So in such a situation, unplugging the network cable might actually make things worse for a couple minutes until Windows stops retrying the network, then you'll see errors or a drastic speed increase.
I've noticed that pretty much anytime I've ever installed ANY printer drivers on a Windows machines I start noticing performance issues.
Antivirus software will often be a problem, check your auto-scan settings as these often get enabled or reset during automatic updates.
Re:Hmmmm. (Score:2, Informative)
Physical Address Extension [wikipedia.org]
If it's Malware You Suspect (Score:2, Informative)
Re:Hmmmm. (Score:2, Informative)
If your machine and 32 bit OS supports Physical Address Extension, it will be able to handle up to 64 GB of RAM. I know because I'm on a 32 bit Win2K3 Server machine that sees all 4 GB of RAM installed just fine.
http://en.wikipedia.org/wiki/Physical_Address_Extension [wikipedia.org]
Recreate your profile (Score:2, Informative)
1. Reboot the machine and log on as administrator (NOT your own account).
2. Rename your old profile -- "C:\Documents and Setting\username" -- to something like "C:\Documents and Settings\username.OLD" (you can't do this if you're logged on as "username" or if you haven't rebooted since you were).
3. Log off admin and log on as yourself. Windows will automatically create a fresh profile for you.
4. Open up applications (Firefox/MS Outlook/etc...) and see how it fares.
5. If it's looking good, go ahead and retrieve stuff from your old profile like your desktop folder and My Documents, or
If that doesn't do it, you could try some sort of registry cleaner, but if you're at that point I'd rather just reinstall Windows. Alternatively swap out for a hard drive from another computer. And if THAT doesn't work, then you know it's a hardware issue.
Re:Second on the drive thing (Score:5, Informative)
What the manufacturer's test programs do is *precisely* run the SMART diagnostic test, so save yourself a CD-R. All they do is run the long self test. All SMART-friendly HDDs support the short (1 to 2 minutes) and long (1 to 2 hours) diagnostic tests, the latter doing an exhaustive sector scan. Boot a Linux live CD and type "sudo smartctl -t long /dev/sda", and voila.
A damaged disk cannot pass that test, not unless something is utterly borked with the firmware (*cough* seagate *cough*).
Re:Hmmmm. (Score:3, Informative)
Re:Second on the drive thing (Score:5, Informative)
Wrong. Some do extended surface read-write-scans and offer options like disk erase etc. Like this here [samsung.com] for example.
Re:Simplest answer (Score:2, Informative)
Actually you can but it takes a little forethought. Get together install media for Windows, all your software, and a large external IEEE1394 or USB disk. If you use a bunch of stuff you downloaded then put the installers on a flash drive. Do clean install of the OS, apps, patch it all up, set up a Desktop the way you want it, yadda, yadda. Now before you junk it up with your data make an image of it. ping.windowsdream.com has a good free tool to do this with though if you have Ghost or whatever then go for it. If this is all too much trouble to start with then do it this way the next time you need to do a therapeutic rebuild of your Windows box.
You should not use an imaging utility like PING or Ghost to backup your personal stuff. Well you can but its unwieldy. GoodSync is a decent free tool that can keep two separate directories in sync like say "Documents and Settings" on your machine and the external disk. The first run will take forever to copy your 40GB porno collection but subsequent runs will only schlep over new or changed files.
Re:Check the HDD (Score:5, Informative)
Lol, that's pretty funny seeing as both are malware. Yeah, I know you know. Others might not.
Re:Check the HDD (Score:5, Informative)
Since we're trying to diagnose a cause of sudden sluggishness, clearing the prefetch won't really do anything unless the HDD is full. A quick review of the prefetch directory, however, is a good indicator of which programs have been running. I usually take a look to see if I can spot anything out of the ordinary.
Other helpful ideas:
- Disable system restore before you do anything...irritating spyware and virii can hide here and restore themselves
- Download and run X-Ray PC [x-raypc.com] (freeware) and run an online analysis of your processes...will give you a good/bad/unknown triage for some processes and allow you to kill them.
- Start>Run> msconfig.exe and check your startup processes...do a quick google search for anything you don't recognize and if it is not a necessary startup process, kill it. Having a shitload of processes running at startup can bring your system to its knees. Usually, for a desktop XP machine, between 28 and 35 processes is ideal on a fresh boot. For a laptop it can be up to 50...depends on what utilities are required to make your touchpad/buttons/wireless/etc work.
- Start>Run> msconfig.exe and check your services. Check 'hide all Microsoft services' and do a quick scan to make sure no extra junk services are hiding here. If you lose functionality to something on startup that you want, you can either just turn it back on or, if necessary, boot into safe mode and turn it on.
- Download Crap Cleaner [filehippo.com] and run the registry scan to see how many junk items you have in your registry. Review the causes and fixes to all the issues you find...you're usually okay doing a fix all but I check them just in case (this is your registry after all...never hurts to back it up either.)
- Add/remove any programs that you don't recognize or don't use. All this extra junk does nothing to help you. Additionally, if you can pinpoint one or two programs that were installed around the time your computer started having issues, definitely uninstall them and check your performance after (probably run ccleaner again to ensure they are completely gone).
- Restart your machine and check msconfig and xraypc again to ensure that nothing you killed came back...if it did, you've got a virus or spyware.
- If you still have issues, try running one of many drive fitness test tools to determine whether or not you have bad sectors or possibly a bad HDD altogether. Some tools will even allow you to repair the bad sectors but usually if you've got bad sectors you should start looking at a new HDD soon.
- If you have the option, pull the HDD and hook it up to a test rig and run a Housecall [trendmicro.com] scan on the drive.
- Run Rootkit Revealer [microsoft.com] to determine whether or not you have a rootkit installed on your machine. Rootkits are nasty as hell but you can usually find additional info via a google search on how to rid yourself of them.
- When all else fails, a clean install is usually the best way to get your system back up to snuff. It is a pain in the fucking ass and no one likes to do it until you remember what it is like having a clean install. Just make a list of your programs, do a backup of your data, and format that sucker.
Hope some of that is helpful...a lot of the other comments I see here are great things to check as well (right below me I see gad zuki! mention netstat -a to check your active connections...also very useful) so bookmark this page and try everything. If nothing else, you'll learn some new tricks.
Re:Check the HDD (Score:1, Informative)
>How do you clear the dll and prefetch cache?
Delete everything in C:\Windows\Prefetch then reboot. Windows will boot more slowly once, and apps will load more slowly, too, until Windows rebuilds the prefetch cache... but it will certainly clear out any stale entries.
Other things to try: Delete Recently Used Documents, especially if there are references to network locations which no longer exist - Windows remembers all kinds of things that can impact Explorer.
Turn off "Automatically Search for Network Files and Folders" (In Explorer: Tools, Folder Options, View, Advanced Settings, uncheck Automatically Search for Network Files and Folders). This will stop Explorer from going out onto the network from time to time to look for shares.
Another quick thing to try: Create a new local Windows user and login as that user. Run programs, etc., and see if you can reproduce the issues... this eliminates issues with the other user's local profile.
Re-Image. (Score:3, Informative)
Storage is cheap, and software doesn't take a lot of space.
For my father, here is what I did:
Pair of 250 gig hard drives (my old ones). One formatted 50 gigs Windows, and 50 gigs just as a second NTFS partition. The other formatted as Linux.
Boot the Linux drive, then ntfsclone the Windows drive (be sure to use the -s option) -- even just with lzop compression, chances are you can fit quite a lot of images. Such as: Just after installing each item.
Standard backup solutions like rdiffbackup can be used for the other drive.
Then, when something goes wrong, boot Linux, use ClamAV to scan the data drive, and re-image the software drive. Problem solved.
Here are the answers! (Yes, really) (Score:4, Informative)
1) Download Malwarebytes' Anti-Malware [malwarebytes.org], and run it. It was the only thing that found a virus on my computer recently, out of six packages (including two commercial ones).
2) Download HijackThis, if that doesn't work. Be careful with this package, though! You can do some serious damage to your computer by blindly following its advice. Read the forums. [majorgeeks.com]
3) How full is your hard drive? If the C: drive is full enough, fragmentation can dramatically mess up performance in a very short time. Clean and defrag. I personally find it worthwhile to use SmartDefrag [iobit.com], a much more powerful defragger than the one that's built into Windows.
4) Read your logs. Yes, Windows actually logs stuff! Go to "Control Panel-->Administrative Tools-->Computer Management" and then dig through "System Tools-->Event Viewer" TONS of useful information about what's not healthy on your system, including complete boot logs.
Good luck.
Re:Second on the drive thing (Score:3, Informative)
Macintosh as well. I've seen an iMac slow to a crawl, with frequent SPODs (spinning pizza of death). All diagnostics, including SMART, reported fine. But a benchmark program reported disk IO throughput of 0.19mB/s. Replaced hard disk, things went back to normal. (BTW, I've seen the similar thing multiple times. I don't even always test the HD anymore...)
Re:safe mode (Score:3, Informative)
If it is a service going haywire, it'll usually show up in the event log.
People have said it a few times, but it needs to be repeated 20 more. Check the event viewer!
Re:Second on the drive thing (Score:5, Informative)
SMART provides a lot of data, some of which is crap :-) but some of which is very useful. In particular, the error log:
# smartctl -l error /dev/sg0
Any disk with a non-empty error log you should consider replacing. Also, always run the short diagnostic tests:
# smartctl -t short /dev/sg0
/dev/sg0
# [wait 2 minutes]
# smartctl -l selftest
Re:Check the HDD (Score:3, Informative)
Re:Still... (Score:3, Informative)
One thing that happened to me, although this probably isn't the poster's problem, is that my pagefile got fragmented. So far as I know, this is the only problem that can be truly said to be unique to Windows. I have no idea why Windows puts its backing store in the filesystem. Surely the overhead of going through the filesystem is unnecessary. Perhaps it is a leacy of a time when the ratio of disk space to physical RAM was smaller, and having a growable swap space was desirable. I've never found dynamically growable swap something I've ever wanted in Unix.
In any case if you want to talk about brain damaged behavior, the way my pagefile got fragmented was that I run virtual machines for development purposes. This behavior has since been fixed (either by MS or VMWare) but launching the first virtual machine on Vista used to nearly crash the system for about ten minutes. What was happening was that Vista had used all the "unneeded" RAM for its various hare brained optimizations, and when you suddenly ask for one GB of virtual memory space it went into an epileptic fit trying to swap all that memory it was using out.
Now here's the really brain damaged part: I ended up (I discovered) with over a hundred thousand fragments in my pagefile.
How is that even possible?
The nearest I can guess is that Windows must, in its desperation to free up RAM with a full page file, take pages of memory and stuff them into the first free bit of space on the filesystem it can. This isn't a problem in Unix, where you just grab (I guess) the first appropriately sized piece of disk off a heap. While I suppose it might be possible for some kind of fragmentation to occur in a Unix swap partition, it's inherently an ephemeral problem that would tend to fix itself as the memory situation improves. In Windows, the problem persists even after you reboot.
When you run several virtual machines, you will swap unless you've got way more RAM than is normal for most users; more than many systems will accept in any case. I was mystified as to why my virtual machine performance, which I was extremely pleased with initially, became utter rubbish after a few months of usage, until I thought to check the pagefile. Ironically, dropping the pagefile altogether greatly enhanced the performance of the system, perhaps because it became more parsimonious with virtual memory space. Adding the pagefile back in, initialized to 4GB, fixed things.
So now, when I get a new Windows machine, I just do what I've always done in Unix: I set the pagefile system right at the start to something like twice the maximum physical memory I think I'll ever install. This leaves a margin of error for unexpected changes, like problems with updated virtual memory algorithms. It may be that most people seldom if ever need a backing store at all with current memory sizes, I do, and in any case at current disk prices 8GB of disk costs less than a cup of coffee at Starbucks.
One thing that occurs to me is that it would be even better to mimic Unix by creating a separate swap partition for the pagefile. It would have to be formatted of course, but if there's some kind of I/O crisis going on in the virtual memory system, this would at least tend to isolate it from the data in the real filesystems.
One question I don't know the answer to is whether on 32 bit windows with 4GB of RAM, there is any benefit to having a pagefile at all, given that RAM is larger than the usable virtual memory space, accounting for the addresses lost to memory mapped I/O. You can use PAE, but that seems kind of pointless to me. If you need it you should upgrade to 64 bit. But I don't know enough about how hardware support for virtualization works and interacts with the host operating system to say whether there might be any benefit when running virtual machines.
Re:Second on the drive thing (Score:2, Informative)
In PC's, some of the BIOSs have an option to enable SMART. Most of them simply send the "-a on" command to enable the drives SMART processes. Many also do a "-H" for a basic health check of the drive, and squawk at you during the post if it fails. I'm wondering if the mac does something very similar. If so, a delay of about a second or maybe less is about right.
Use of smartctl -h /dev/sda is a good measure of how the drive is, but it's very basic. Then again, it sure beats a poke in the eye with a sharp SIMM. Or a drive that dies without any warning.
Re:Second on the drive thing (Score:2, Informative)
'nice' does not affect IO, only process scheduling.
The CFQ scheduler have IO classes with priorities that can be set with 'ionice'. Be sure to use a recent kernel though, I've seen nasty bugs in 2.5.25.
Depending on the typical load type even the IDLE class might be worse than the Deadline or Anticipatory schedulers (they do not support classes even if you can set them) so testing is the key, though for desktops CFQ+ionice should be best in most cases.