Too much disk activity READING event logs

3

1

On Win 7 SP1 x64, I notice that sometimes the disk gets so busy that Windows becomes unresponsive for minutes at a time. I referenced this problem on SU in the past once. I've since replaced the drive, and the problem persists.

My machine is plenty fast - this shouldn't be happening to the extent and duration that it is. The machine should not become unusable for 3, 5 minutes after login/startup or during a VM suspend operation. Yes, the machine will be slower as its saving the state of a VM to disk. And yes, if I have too many startup items, booting will take longer. I appreciate your input, but please spare me from the basics - I've been working with computers for almost thirty years now.

Here is the tallied disk activity, done via Procmon, during startup (after login):

(Click for larger view)
enter image description here

and when suspending a VMware VM:

(Click for larger view)
enter image description here

As you can see, System.evtx and Application.evtx account for a huge share of disk activity. This would probably go by unnoticed if it were writing to the event log, but reading from the logs should not be what my disk spends the most time doing. This is not normal, is it? If not, what would be the tool to find out what in the log is being read?

CPU:           Intel Core i5-2520M (Sandy Bridge-MB SV, J1)
               2500 MHz (25.00x100.0) @ 797 MHz (8.00x99.7)
Motherboard:   LENOVO 423946U
Chipset:       Intel QM67 (Cougar Point) [B3]
Memory:        8192 MBytes @ 664 MHz, 9.0-9-9-24
Drive:         ST320LT007, 312.6 GB, Serial ATA 3Gb/s (SSHD Hybrid)

Gaia

Posted 2013-11-20T22:28:07.420

Reputation: 4 549

What size are the log files in question? The default for Windows 7 is 20MB if I'm not mistaken. – joeqwerty – 2013-11-20T23:53:23.563

They are at default sizes. Good question, thanks! – Gaia – 2013-11-21T00:00:04.800

No answers