System freezes when idle

[ubuysa]

Ah, that's my K: drive - a 32Gb Sandisk Thrumb drive.

I have a KVM which I use to share my Mouse, Keyboard & this drive with my Desktop(PCS) & my work laptop.

I assume when I switch to the laptop using the KVM, the drive goes missing in the PC system & that's why it complains.

K:\>chkdsk /f

The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Chkdsk may run if this volume is dismounted first.
ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismount on this volume? (Y/N) y
Volume dismounted. All opened handles to this volume are now invalid.
Volume label is E220D Map Update.

Stage 1: Examining basic file system structure ...
1024 file records processed.
File verification completed.
Phase duration (File record verification): 48.70 milliseconds.
0 large file records processed.
Phase duration (Orphan file record recovery): 0.25 milliseconds.
0 bad file records processed.
Phase duration (Bad file record checking): 0.23 milliseconds.

Stage 2: Examining file name linkage ...
24 reparse records processed.
1146 index entries processed.
Index verification completed.
Phase duration (Index verification): 68.68 milliseconds.
0 unindexed files scanned.
Phase duration (Orphan reconnection): 0.46 milliseconds.
0 unindexed files recovered to lost and found.
Phase duration (Orphan recovery to lost and found): 1.94 milliseconds.
24 reparse records processed.
Phase duration (Reparse point and Object ID verification): 0.96 milliseconds.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
Phase duration (Security descriptor verification): 10.00 milliseconds.
62 data files processed.
Phase duration (Data attribute verification): 0.47 milliseconds.
CHKDSK is verifying Usn Journal...
381864 USN bytes processed.
Usn Journal verification completed.
Phase duration (USN journal verification): 14.93 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

30044143 KB total disk space.
20698024 KB in 515 files.
264 KB in 63 indexes.
0 KB in bad sectors.
43887 KB in use by the system.
41152 KB occupied by the log file.
9301968 KB available on disk.

4096 bytes in each allocation unit.
7511035 total allocation units on disk.
2325492 allocation units available on disk.
Total duration: 147.07 milliseconds (147 ms).


View attachment 25587


Paging file is 28.7 GB, managed by the system e.g.

View attachment 25588

If that's how things were with the paging file I would check your C: drive too.

IMO it's not wise to use a thumb drive as any kind of permanent drive. There's no doubt that Windows was having problems with that drive. Are you sure a paging file didn't find its way on there?

It's unusual to see two unrelated problems so I'd investigate your paging issues very carefully. Problems there could easily be causing the problems you report.

TBH I'd want to test the PC without the KVM switch for a time to be sure that's not introducing problems. When testing keep things simple.

 

[macjim]

Knew you'd say that!

I've removed the flash drive from the KVM, I've got spare mouse & Keyboard but I'll keep the KVM for switching my two monitors.

I'll scheduled a chkdsk /f on C: for the next reboot, probably a few hours from now

 

[macjim]

Well everyday is a school day!

I rebooted with chkdsk /f.

I can see it saying running at boot up screen.

According to this :https://superuser.com/questions/896...-produce-a-log-file-when-running-before-login

The results should end up in the event viewer under a "Wininit" event, but only event found was from March.

Eventually discovered that reboot didn't start a CHKDSK event only a shutdown, then re-start activates it.

And low and behold it was stored in the event viewer, under winnit category:



Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows.


A disk check has been scheduled.
Windows will now check the disk.

Stage 1: Examining basic file system structure ...
712192 file records processed.
File verification completed.
Phase duration (File record verification): 3.40 seconds.
10400 large file records processed.
Phase duration (Orphan file record recovery): 0.00 milliseconds.
0 bad file records processed.
Phase duration (Bad file record checking): 1.30 milliseconds.

Stage 2: Examining file name linkage ...
6185 reparse records processed.
982174 index entries processed.
Index verification completed.
Phase duration (Index verification): 8.48 seconds.
0 unindexed files scanned.
Phase duration (Orphan reconnection): 817.34 milliseconds.
0 unindexed files recovered to lost and found.
Phase duration (Orphan recovery to lost and found): 336.77 milliseconds.
6185 reparse records processed.
Phase duration (Reparse point and Object ID verification): 15.01 milliseconds.

Stage 3: Examining security descriptors ...
Cleaning up 305 unused index entries from index $SII of file 0x9.
Cleaning up 305 unused index entries from index $SDH of file 0x9.
Cleaning up 305 unused security descriptors.
Security descriptor verification completed.
Phase duration (Security descriptor verification): 23.23 milliseconds.
134992 data files processed.
Phase duration (Data attribute verification): 1.38 milliseconds.
CHKDSK is verifying Usn Journal...
39134472 USN bytes processed.
Usn Journal verification completed.
Phase duration (USN journal verification): 108.72 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

487476223 KB total disk space.
187420620 KB in 487768 files.
229536 KB in 134993 indexes.
0 KB in bad sectors.
839983 KB in use by the system.
65536 KB occupied by the log file.
298986084 KB available on disk.

4096 bytes in each allocation unit.
121869055 total allocation units on disk.
74746521 allocation units available on disk.
Total duration: 13.25 seconds (13257 ms).



Internal Info:
00 de 0a 00 b1 80 09 00 ab 30 0b 00 00 00 00 00 .........0......
58 11 00 00 d1 06 00 00 00 00 00 00 00 00 00 00 X...............

Windows has finished checking your disk.
Please wait while your computer restarts.

 

[ubuysa]

OK. Let's see how it goes then. If the problems continue upload the log files again.

 

[SpyderTracks]

If anything reoccurs, another test we could try is lowering the DOCP on the RAM to 3533MHz which is very straightforward.

That’s a pure stab in the dark from me, @ubuysa dump file analysis is far more targeted, but it’s worth a try.

 

[macjim]

Hi,

I've been away for a few weeks, PC has been off till I came back on Saturday.

Just had the first freeze since I returned, approx 10:44.

I've removed the KVM, PC & Laptop have separate KB & Mice, I did this on Saturday before today's freeze.

They share the dual screens, PCS on DVI, laptop on VGA.

I've dumped the Apps & Sys logs here:- https://1drv.ms/u/s!AoUU74i2sEO7rl4MDnjhqZ-YWk_R?e=CcSMYF

I have tried running @lower clk speed previously, no effects - but that was on the previous BIOS.

 

[ubuysa]

Hi,

I've been away for a few weeks, PC has been off till I came back on Saturday.

Just had the first freeze since I returned, approx 10:44.

I've removed the KVM, PC & Laptop have separate KB & Mice, I did this on Saturday before today's freeze.

They share the dual screens, PCS on DVI, laptop on VGA.

I've dumped the Apps & Sys logs here:- https://1drv.ms/u/s!AoUU74i2sEO7rl4MDnjhqZ-YWk_R?e=CcSMYF

I have tried running @lower clk speed previously, no effects - but that was on the previous BIOS.

There is nothing of much help in either log. I'm not sure how accurate your "approx 10:44" timing is because I can see a reboot start at 11:31 (10:31:57.5Z - UTC or GMT time) which is 45 minutes later than your 10:44 time?

There are a number of entries in the System log prior to 11:31. There is an entry at 10:41 indicating that the BITS service was changed from auto to demand start. There is a log entry five minutes earlier (10:36) indicating that the BITS service was changed from demand to auto start and there are a great many of this messages showing BITS flipping back and forth between auto and demand start. I don't use BITS so I don't really know very much about it but from a quick read of the BITS documentation (https://docs.microsoft.com/en-us/windows/win32/bits/about-bits) it would seem that the BITS startup type depends on whether there are active BITS jobs? Are you a big BITS user? I'm not sure these are relevant though.

The other thing of note is in your Application log. At 10:28 (local time) there are two entries for the Restart Manager...

09:28:49.2935281Z  Starting Session 1 - 2021-05-17T09:28:49.293516100Z
09:28:49.4000039Z Ending Session 1 started 2021-05-17T09:28:49.293516100Z

...but these are a full hour before the reboot, though closer to your "10:44" time.

The Restart Manager is called when updates are installed as a means of avoiding having to do a full system restart. This could potentially be the cause of your freezes because there's a fair but of juggling goes on with the Restart Manager, see https://docs.microsoft.com/en-us/windows/win32/rstmgr/about-restart-manager - though it's likely not significant here since it's an hour before your reboot.

Is it possible the system freeze happened at 10:28 (local time) and you didn't reboot until 11:31 (local time)?? There are no entries in either log between 10:28 (local) and the reboot at 11:31 (local)....

 

[macjim]

There is nothing of much help in either log. I'm not sure how accurate your "approx 10:44" timing is because I can see a reboot start at 11:31 (10:31:57.5Z - UTC or GMT time) which is 45 minutes later than your 10:44 time?

There are a number of entries in the System log prior to 11:31. There is an entry at 10:41 indicating that the BITS service was changed from auto to demand start. There is a log entry five minutes earlier (10:36) indicating that the BITS service was changed from demand to auto start and there are a great many of this messages showing BITS flipping back and forth between auto and demand start. I don't use BITS so I don't really know very much about it but from a quick read of the BITS documentation (https://docs.microsoft.com/en-us/windows/win32/bits/about-bits) it would seem that the BITS startup type depends on whether there are active BITS jobs? Are you a big BITS user? I'm not sure these are relevant though.

The other thing of note is in your Application log. At 10:28 (local time) there are two entries for the Restart Manager...

09:28:49.2935281Z  Starting Session 1 - 2021-05-17T09:28:49.293516100Z
09:28:49.4000039Z Ending Session 1 started 2021-05-17T09:28:49.293516100Z

...but these are a full hour before the reboot, though closer to your "10:44" time.

The Restart Manager is called when updates are installed as a means of avoiding having to do a full system restart. This could potentially be the cause of your freezes because there's a fair but of juggling goes on with the Restart Manager, see https://docs.microsoft.com/en-us/windows/win32/rstmgr/about-restart-manager - though it's likely not significant here since it's an hour before your reboot.

Is it possible the system freeze happened at 10:28 (local time) and you didn't reboot until 11:31 (local time)??

I saw it go @10:44 ish e.g. I saw the clock app freeze on the desktop. I was downloading a large file in the background and wanted to see if it would complete the download, it was @1Gb of 1.4 Gb - it didn't complete. I power cycled @11:32

Don't know much about BITS. I was downloading a few files, so I assume it was calling these services.

It could be freezing sooner than I realise, I normally assume it's freezing when the Desktop Clock app stops. When the desktop freezes e.g. clock stops and can't access the desktop files - I can normally still browse for ~10 mins, then it stops even doing that. So it could be a cascade set of events. freezes starts -> Desktop Clock app stops -> total windows freeze.

 

[ubuysa]

I saw it go @10:44 ish e.g. I saw the clock app freeze on the desktop. I was downloading a large file in the background and wanted to see if it would complete the download, it was @1Gb of 1.4 Gb - it didn't complete. I power cycled @11:32

Don't know much about BITS. I was downloading a few files, so I assume it was calling these services.

It could be freezing sooner than I realise, I normally assume it's freezing when the Desktop Clock app stops. When the desktop freezes e.g. clock stops and can't access the desktop files - I can normally still browse for ~10 mins, then it stops even doing that. So it could be a cascade set of events. freezes starts -> Desktop Clock app stops -> total windows freeze.

I really don't know I'm afraid. You could if you're feeling keen enable forcing a kernel dump from the keyboard, see here for details on setting it up https://docs.microsoft.com/en-us/wi...gger/forcing-a-system-crash-from-the-keyboard.

If you then hit the CTRL + SCROLL LOCK (twice) key combination the moment you think it's freezing you should get a kernel dump (in C:\Windows\Memory.dmp). Upload that to the cloud, I've no idea whether it will help but you never know.....

 

[macjim]

I've setup the crash on scroll previously, I think the keyboard doesn't responded under full freeze - but I may be able to catch it in mid freeze.

It's worth a punt

 

[macjim]

System froze, and I managed to induce a BSOD with the keyboard short cut.


I've uploaded the event logs to here : https://1drv.ms/u/s!AoUU74i2sEO7rl-FhbOHhrup5H3z?e=o6KCza

The MEMEMORY.DMP file was a bit weird, it wouldn't lt me compress it initially or even open it.

I managed to copy it sideways to old..dmp, then I could compress it: https://1drv.ms/u/s!AoUU74i2sEO7rmGcn7bvgQKcKcO3?e=2gmORD

 

[ubuysa]

Ok, I'm not sure what's in which uploaded files but I'm downloading from both links. I'll get back to you on what I find - most likely tomorrow now.

 

[ubuysa]

I've got the kernel dump ok but I'd forgotten you were manually initiating it from the keyboard. Unlike a normal dump where the active thread is already isolated I'm going to have to trawl through every process, locate the active threads in each one, and then look to see whether any of them has stalled. That will take a looong time and probably several days.

Please don't hold your breath....

 

[ubuysa]

I've just had a quick look and the first thing I'd suggest you try is to uninstall Norton. It's know to cause issues for some and isn't recommended by anyone really. See how things go without it, if it freezes with Norton gone then you can reinstall it.

You MUST use the specific Norton uninstaller, using Programs & Features won't do with this monster software.

 

[macjim]

Thanks for the feedback, no rush.


Removed Norton 360 & Norton Utilities, much to my suprise, after a reboot - Windows Virus Protection didn't start Automatically.


Had to google how to get it to restart it, now have windows Virus & Firewall running.

 

[SpyderTracks]

Thanks for the feedback, no rush.


Removed Norton 360 & Norton Utilities, much to my suprise, after a reboot - Windows Virus Protection didn't start Automatically.


Had to google how to get it to restart it, now have windows Virus & Firewall running.

Did you use the Norton uninstaller? If not then it won't be installed yet and that may be why windows defender didn't automatically start, you can't uninstall via programs and features in windows.

 

[macjim]

I used Norton UninstallerNRnR from here: https://support.norton.com/sp/en/uk/home/current/solutions/v60392881

I used remove only.

I ended up in the Local Group Policy Editor, had to turn defender back on - evening though it wasn't configured to be off.

 

[macjim]

Looks like defender found a reg value which had been setup to stop defender from restarting e.g.

Not sure if Norton left it behind or somethere bit of malware,

 

[macjim]

Another freeze, I generated a BSOD using the keyboard short cut method:

I dumped the two logs & Memory dmp into here: https://1drv.ms/u/s!AoUU74i2sEO7rmKjRSVjB_iDejKb?e=IuixAg


I won't re-install Norton at the moment.

 

[ubuysa]

It's going to be a couple of days I'm afraid, I'm busy Monday and Tuesday.

What happens when it freezes? It would seem that the keyboard still works? What else still works when it freezes?

Are you able to note down what was running and what you were doing when it froze?

I've spent some time trawling through the 250-odd processes you have running and nothing has looked out of place so far.