Calling Windows Experts

[andrewducker]

My machine is being _really_ slow for the past week. Checking the task manager tends to show that the actual processes are taking a percentage or two - but that the kernel times are at at least 25%. Is there any way of telling what's sucking up all of the kernel time?

Comments

[johnbobshaun.livejournal.com]

It is slow all the time, or are you experiencing "spikes"?

[andrewducker]

Most of the time, verging onto all of it.

[johnbobshaun.livejournal.com]

Is the hard drive whirring like a mofo?

[andrewducker]

Nope.

[poisonduk.livejournal.com]

This is spooky, my laptop has been struggling for the past week too - especially noticable when I'm streaming stuff across my network - Everything has a little hangtime and goes into buffering mode - It's a pain when watching avi's as it's stop start etc. I've closed down processes on the laptop and been blaming my router but I'm wondering if the Microsoft folk have issued an update which is causing slowdown - Do you have automatic Windows Updates enabled?

[andrewducker]

I do. That could be a possibility, I suppose.

[poisonduk.livejournal.com]

It's suspicious that both of us are talkign the same timeframe. And it's not going to be a virus as my laptop never gets used for email and about the only websites it accesses are LJ & Facebook. I'm running Norton on it which has it tied up pretty tightly, but I've even totally disbled that this week as I know that NIS can cause resourcing problems.

[andrewducker]

It is odd.

Just before leaving this morning I unplugged my USB card reader, and that seemed to make a difference - but more playing is definitely in order tonight!

[poisonduk.livejournal.com]

Hmmm, I don't have a card reader attached to my Laptop although I do have an external HDD which I use via USB. I did end up copying the program I was tryig to stream across to the laptop HDD instead of using the external HDD in case the slow down was there bu I was still having problems - I don't know if I specifically pulled out the USB connection though - I may well try that tonight.

[johnbobshaun.livejournal.com]

Funnily enough that was similar to what I was going to suggest: my old MP3 player used to cause similar problems when it was plugged in. I updated the drivers and firmwave and it went away.

However, that was definitely spikes of slowness when the computer was polling the device.

[darkoshi]

Where does it show kernel usage in the Task Manager? Is it a certain task name?

[andrewducker]

Switch to the view with the tall green bar. Click on "view" and choose "kernel times".

[call-waiting.livejournal.com]

Time spent in the kernel is still accounted to the process that's causing the kernel processing: each process's 'CPU time' shown in Task Manager is the sum of its kernel and user times. So fing the process that's using more than 25% of your CPU, and that's your man.

Unless the kernel activity is entirely unrelated to any process, which I didn't think was possible in NT as "everything else" is swept into ntkern. Or so I thought.

Task Manager doesn't give much information, much better is sysinternals' Process Explorer, which should let you track down damn near anything, it'll even tell you precisely which services are running inside those pesky svchost processes (although, obviously but still frustratingly, it won't tell you which of those services is active).

You did mention USB, so that's a likely culprit. You can use the performance monitoring whatsit in the system console to check if there's any background I/O to your card reader that you didn't explicitly know about.

PS. I hereby explicitly state that I am not in any way shape or form a 'windows expert' ;)

[andrewducker]

But still way better than most :->

The total figure was static around 50% of CPU time. The individual percentages were adding up to maybe 5%. The 46% difference is what I'm looking for...

And having whipped out that USB card reader CPU time is sitting around 3%, with no kernel time at all.

So that solves that.

I'll keep a note for Process Explorer for next time!

[call-waiting.livejournal.com]

Hm, so I guess my belief that time spent in interrupt handlers is accounted to a specific process is wrong then. That would at least make NT consistent with every other OS on the planet (and makes sense, too -- it'd add lots of crap to every single interrupt, which would be bad).