Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Troubleshooting
  New Posts New Posts RSS Feed: csrss.exe hogging IO
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

csrss.exe hogging IO
 Post Reply Post Reply
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Topic: csrss.exe hogging IO
    Posted: 08 June 2009 at 1:37am
I see winlogon.exe also being quite active on the IO side.
What type of IO?

Any idea, what to look for to go in a structured way?
Since it should be pretty obvious when you've hit on something, I suppose I'd first close all apps (other than Process Explorer), one at a time.  Then move on to items that can be closed with a notification icon.  Then, move on to stopping services; once a service is stopped it is just a matter of rebooting to cause the service to start again, so don't hesitate to try to stop any service.  Then, move on to the remaining processes in Process Explorer - perhaps, add the Start Time column to PE and sort the list in descending order.  Then start suspending or terminating processes one at a time, starting with the youngest processes...
Daily affirmation:
net helpmsg 4006
Back to Top
oerly08 View Drop Down
Newbie
Newbie


Joined: 03 June 2009
Online Status: Offline
Posts: 5 		Post Options Post Options   Quote oerly08 Quote  Post ReplyReply Direct Link To This Post Posted: 06 June 2009 at 12:38pm
I haven't tried that yet and there was nothing striking obvious up to now.
Any idea, what to look for to go in a structured way?
I see winlogon.exe also being quite active on the IO side.
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 05 June 2009 at 1:37pm
Yes, the 'IO Other' value jumps by about 250 ticks every second/update.
Have you tried exiting processes, closing apps, stopping services, etc. to see if this increase ceases?  I wonder if some app is sending excessive window messages...
Daily affirmation:
net helpmsg 4006
Back to Top
oerly08 View Drop Down
Newbie
Newbie


Joined: 03 June 2009
Online Status: Offline
Posts: 5 		Post Options Post Options   Quote oerly08 Quote  Post ReplyReply Direct Link To This Post Posted: 05 June 2009 at 12:13pm
Uptime about 24 hours
The dump from PE on csrss can be found at http://drop.io/oerly08_csrss01
Yes, the 'IO Other' value jumps by about 250 ticks every second/update.
These jumps and the high value triggered my awareness of csrss initially...

Thank you for your time!
Oerly08
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 05 June 2009 at 11:44am
What was the system uptime (roughly) when the screenshot was taken (procexpl.rtf)?

What modules are loaded into the address space of csrss.exe?  (Use PE's DLL view in the lower pane)

Does the "I/O Other" value for CSRSS increase substantially on every refresh of PE?
Daily affirmation:
net helpmsg 4006
Back to Top
oerly08 View Drop Down
Newbie
Newbie


Joined: 03 June 2009
Online Status: Offline
Posts: 5 		Post Options Post Options   Quote oerly08 Quote  Post ReplyReply Direct Link To This Post Posted: 05 June 2009 at 9:16am
Hi Molotov,

sorry for the confusion. I used a different computer/keyboard (quertz instead of querty) and mixed up z and y, i.e. the drop.io password is 'szsinternals'.

I'm using FF3.0

Cheers
Oerly08
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 05 June 2009 at 3:18am
if there is a private channel available, please let me know, what kind and how to use it
The forum software offers Private Messaging (PM) functionality.

- I see hundreds of "IO Other" per update (second)  in Process Explorer (see also ProcExpl screendump in rtf file in zip archive at http://drop.io/oerly08_csrss01),  Reads and Writes are pretty static.
Sorry - I meant "operations" instead of "reads" (as opposed to bytes)...
- currently installing symbols to be prepared for next 'slow down'
No need to install symbols, if you configure it to use the symbol server...

What web browser do you use?

I'm not able to access the drop - I input the given password, but I am informed that the login failed...
Daily affirmation:
net helpmsg 4006
Back to Top
oerly08 View Drop Down
Newbie
Newbie


Joined: 03 June 2009
Online Status: Offline
Posts: 5 		Post Options Post Options   Quote oerly08 Quote  Post ReplyReply Direct Link To This Post Posted: 04 June 2009 at 9:33pm
Hi Molotov,

thank you very much for looking into this.

To answer your questions:

- I'm accessing the system locally (Laptop)
- I see hundreds of "IO Other" per update (second)  in Process Explorer (see also ProcExpl screendump in rtf file in zip archive at http://drop.io/oerly08_csrss01),  Reads and Writes are pretty static.
- currently installing symbols to be prepared for next 'slow down'
- the activity is caused mainly by csrss.exe
- I will do as you sugguested. For now I have uploaded a excel spreadsheet with the activity log from csrss.exe for a period of about 2 minutes.
- eventlog shows no significant entries, chkdisk seems to be fine as well. Interestingly the situation seems to become more critical after sleep/wakeup of the laptop (or a couple of those)

You can access the drop at drop.io with the password 'sysinternals'. I don't  see a significant risk to share the zip-file password over this channel but if there is a private channel available, please let me know, what kind and how to use it.

Again - many thanks !!

oerly08
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 04 June 2009 at 2:14pm
Hi Oerly08,

How are you accessing the system? Direct login, or using RDP?

ProcessExplorer showes csrss.exe with high IO-Other rates per second (serveral hundreds).
Hundreds of what?  Reads?

Why is my csrss doing this kind of redundant work several times per second???
Configure symbols, and check the stack of the events to try to get more info.

ProcessMonitor then shows hundreds of IO Accesses, in particular CreateFiles on
By what process - csrss.exe?

Can you configure symbols in Procmon, capture the behavior (unfiltered), save the trace (unfiltered), ZIP the .PML into a password-protected ZIP file, upload the ZIP file somewhere, and privately or publicly share the location of the ZIP file, and privately share the password?

Have you checked the event logs for relevant events?  Or run chkdsk /r?  What about selective elimination of running apps, services, processes, etc.?
Daily affirmation:
net helpmsg 4006
Back to Top
oerly08 View Drop Down
Newbie
Newbie


Joined: 03 June 2009
Online Status: Offline
Posts: 5 		Post Options Post Options   Quote oerly08 Quote  Post ReplyReply Direct Link To This Post Posted: 03 June 2009 at 7:37pm
My XPSp3 is getting extremely slow and sometimes even slower.
During these times the disklight doesn't go off (CPUs nearly idle).
ProcessExplorer showes csrss.exe with high IO-Other rates per second (serveral hundreds).
ProcessMonitor then shows hundreds of IO Accesses, in particular CreateFiles on
C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775
which are closed again right away.
There are hundreds of other accesses per second as well (Registry, etc).

Why is my csrss doing this kind of redundant work several times per second???
Is there a way to get my disk back for normal use?
Maybe I'm on the wrong track...

(Sorry if this has been addressed in another thread - there are tons on csrss but there seems to be very little on csrss & disk or IO)

Many thanks in advance
Oerly08
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down