Is there a convenient tool for finding out why the hard disk is working furiously?

(Windows Vista or 7, but it’s been annoying me since Windows 95.)

We’ve all lived through several minutes of the hard disk scrubbing frantically, with the access LED flashing like crazy, with no readily apparent cause.

If the user didn’t explicitly ask for a disk-intensive operation (check the disk for errors, search for a certain unindexed file, etc.), the causes are usually :

  • Memory pages being swapped between core and the page file;
  • Antivirus or anti-malware scanning the disk;
  • A file indexer (Windows Search, X2, etc.) doing its indexing thing;
  • Maybe a Web browser cleaning out its cache;
  • Actual malware doing its nefarious work;
  • Windows Update checking which parts of your system are still worth keeping;
  • If there are virtual machines (VMWare, Virtual PC, etc.) running, their operating systems may be doing all of these too.
    So, when this kind of thing happens, and your protected user asks you what the computer’s doing, you need to check about 5 different places to be able to explain what’s happening.

Is there a simple tool (Microsoft or not) that can serve as a monitor for this kind of thing?
(I know that Task Manager can show additional columns about I/O operations by individual processes, but it doesn’t cover all cases and it still requires interpretation.)

You can open up Resource Monitor from within Task Manager (Performance tab) and it lists the key performance (bottleneck) categories and shows you a lot of useful information on what is happening and why, but I don’t know if this meets your criteria for simple.

This is Vista upwards.

Thanks, I’d never actually bothered to click this. It’s certainly easier for me to interpret than the raw Processes page in Task Manager.

But what I’m hoping for is a tool that could be used by anybody, with obvious messages like “Indexing some files”. As a desktop widget maybe.

maybe one of the SysInternals tools? Something like Process Explorer might work.

Unless there’s been an update since the version I’m running, it’s not much better than task manager. Much interpretation needed. Of course I’ve not tried all the SysInternals tools, so there may be one I’ve missed that does it. I eagerly await someone to answer this, too.

ETA: I’ve invented a technical term for all that apparently useless HD activity: Gatesing, named after “you-know-who” :smiley:

Maybe your spouse signed up for SETI@home without telling you.

How much RAM is installed?

Sysinternals has a file monitor that will work, the only problem is that it monitors ALL file activity making it next to useless to lambda users. I have used it with success as a last end solution.
Process explorer is not bad, mainly for unblocking XP hangs (except network).

You probably don’t want a permanent monitor on that level anyway, it will slow down even further the whole gook.

my son refers to random hard drive action as “making pants” as in
“Dude your hard drive has been going nuts for like 5 minutes what are you doing over there?”
“My hard drive is making pants”

FYI, there already is a technical term for this phenomenon, it’s known as thrashing.

I know, but I like mine better, since it’s almost always my Winblows machines that do it. I have hardly ever seen it from any other machine, but it’s a daily (or hourly, even) occurrence in Winblows… :smiley:

This. If it happens regularly, you probably have insufficient memory to run whatever all you have installed (with Windows itself counting as an installed program), so it will use the hard disk as an alternative to killing the applications (and itself). The speed difference between a hard disk and RAM is like 10,000 to 1.

Thrashing is specifically excessive swap file activity. I’d wager that for most sporadic disk activity for most users for most times, there’s one thing we know for sure it *isn’t *: thrashing. Malware or disk file indexing for search are far more likely causes for that “disk activity runs crazy for 2-3 minutes then subsides.”

Or . . . you have too much crap running in the background.
Several of the things you mentioned (anti-virus scanning, file indexing, update checking) should, IMO, NOT be running when you are using the machine. They ought to be scheduled to run at some other time, like in the middle of the night.

Yes, they should, and on my computers they are (indexing is disabled because I rarely need it, virus scans occur around 2 AM, etc). I’m talking about other people’s computers.

Typical exchange:

Other: Oh, why is my computer doing all these disk accesses? I can’t get to my favorite silly-cat videos on YouTube!
Me: Well, I’m not sure. Could be your virus scanner, could be a program taking up too much memory.
Other: No, no, all I have is Firefox and Outlook.
Me: Well, would you like me to spend a few minutes in your seat to find out what’s happening?
Other: I thought you knew everything! Why can’t it just work? Stupid computer!

and so on.

So I was hoping for a big, friendly desktop widget that could show, in big, friendly letters:

**Swapping to disk because Firefox needs more memory.
**

or:

Indexing the removable disk that was just plugged in.

etc. And, ideally, a big, friendly Never mind button where possible.

Clearly this doesn’t exist on Windows. Anything on other platforms (OS X, Linux, BeOS, OS-9, GEOS, MVS/XA)?

I know exactly what you’re asking for, and (as a Windows/Linux programmer) I’ve often thought of writing something exactly like this. I always thought it would do something like average the HD activity over the last 10 seconds (configurable). There would be an icon in the tray, and when you mouse over it, it would tell you which process/app is hitting the hard drive most heavily. I can’t believe something this simple doesn’t exist.

You can go into Windows Task Manager (Control-Shift-Escape should work) and add more columns to monitor I/O (Input-Output, AKA read/write). Pull down the View menu and pick Select Columns. I like to add I/O Read Bytes and I/O Write Bytes. Then you can double-click the column headings to sort Task Manager by that.

By doing that you can at least see which processes are actively reading/writing and how much. On mine jqs.exe, avguard.exe, and plugin-container.exe are the top readers. jqs is Java, I must be running some web app that does a lot of reading. Avguard is the anti-virus, and plugin-container is part of Firefox.

One thing I like to do is make sure my virus scanner doesn’t do it’s daily scan during hours I am using the computer. That makes things really slow, with lots of HD access. I honestly just turn my daily scan off, because I figure any file that is read will be scanned anyway.

Really? I’ve always called it the WGU, the “whirring grinding unit.” As in, “Hold on, the WGU has to finish.”