Author: skelker
Subject: Procmon Durations wrong?
Posted: 13 June 2013 at 7:58pm
I had a similar issue today. 106 seconds to do a IRP_MJ_READ of 64K. This seems excessive, and doesn't add up based on the Time of Day field. I was researching a period of high disk activity which was bogging down a box. It appeared to be due to defragmenter doing a lot of disk IO. Some other bits of information:
Subject: Procmon Durations wrong?
Posted: 13 June 2013 at 7:58pm
I had a similar issue today. 106 seconds to do a IRP_MJ_READ of 64K. This seems excessive, and doesn't add up based on the Time of Day field. I was researching a period of high disk activity which was bogging down a box. It appeared to be due to defragmenter doing a lot of disk IO. Some other bits of information:
- I'm using 2.95, which I don't believe is the latest version.
- I was running this from a scheduled task using a filter and backed by a file instead of the page file.
- The event that supposedly took 106 seconds did not have an async flag associated with it. It did have Non-cached.
Here are the lines relevant to this issue.
12:00:23.3167032 AM 0.0021588 DkService.exe 3800 IRP_MJ_READ E: SUCCESS Offset: 33,292,525,568, Length: 4,096, I/O Flags: Non-cached, Priority: Normal
12:00:23.3188971 AM 0.0055988 DkService.exe 3800 IRP_MJ_READ E: SUCCESS Offset: 260,320,448,512, Length: 4,096, I/O Flags: Non-cached, Priority: Normal
12:00:23.3245448 AM 0.0068303 DkService.exe 3800 IRP_MJ_READ E: SUCCESS Offset: 211,182,067,712, Length: 4,096, I/O Flags: Non-cached, Priority: Normal
12:00:23.3314259 AM 0.0000111 DkService.exe 3800 IRP_MJ_FILE_SYSTEM_CONTROL E: SUCCESS Control: FSCTL_GET_NTFS_FILE_RECORD
12:00:23.3319325 AM 0.0000115 DkService.exe 3800 IRP_MJ_QUERY_INFORMATION E: INVALID PARAMETER Type: QueryBasicInformationFile
12:00:23.3319956 AM 0.0000058 DkService.exe 3800 IRP_MJ_FILE_SYSTEM_CONTROL E: SUCCESS Control: FSCTL_GET_NTFS_FILE_RECORD
12:00:23.3320314 AM 0.0000039 DkService.exe 3800 IRP_MJ_FILE_SYSTEM_CONTROL E: SUCCESS Control: FSCTL_GET_NTFS_FILE_RECORD
12:00:23.3320587 AM 106.6316446 DkService.exe 3800 IRP_MJ_READ E: SUCCESS Offset: 3,221,225,472, Length: 65,536, I/O Flags: Non-cached, Priority: Normal
12:00:23.3322562 AM 0.0338797 DkService.exe 3800 IRP_MJ_WRITE E:\$LogFile SUCCESS Offset: 49,577,984, Length: 24,576, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12:00:23.3662179 AM 0.0086488 DkService.exe 3800 IRP_MJ_WRITE E:\$LogFile SUCCESS Offset: 12,288, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12:00:23.3841988 AM 0.0047180 DkService.exe 3800 IRP_MJ_WRITE E:\qs\HS22\HS22_sys.log SUCCESS Offset: 2,408,448, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal