SVCHOST.EXE (LocalSystemNetworkRestricted) is using almost 100% disk usage?

Question

I'm not running any other program, only Task Manager and Resource Monitor. It made my machine heavily non-responsive, even cursor sometimes jumps here and there and it's not accepting any keyboard input, even CTRL+ALT+DEL.

In Task Manager it says 47% (it goes between 46%-50%) because I have two disk, the other one has zero activity. Notice my CPU and RAM is idle Is there any way I can pinpoint what is actually causing the problem and how to solve it? What does svchost.exe (LocalSystemNetworkRestricted) do?

UPDATE: Visited this question, but it doesn't apply to me since I'm not running (or having) Chrome nor Skype.

UPDATE2: Note that it's constantly reading.

Solution

The trace was a bit too short (only 5s) so I can only tell you what I see from those 5 seconds.

Most of the Disk IO comes from the superfetch service which reads data from your slow 5400rpm TOSHIBA MK5059GSXP HDD and from the kernel which reads data from the pagefile because you only have 4GB of RAM.

The best way to solve it would be to replace the slow HDD with a SSD.

Comments

[Frank Thomas]

Are you saying its using 100% CPU, or 47% of disk bandwidth? 7.9MB/s is pretty small for most modern hard disks, and SuperFetch could be accounting for it. The process is only using 0.4% CPU in your image. Note that the 47% has nothing to do with the number of disks you have, but on the number of threads the system thinks it can have writing data to disk semi-concurrently without a drop in performance.

[Nur]

@FrankThomas Not CPU, it only 5% as seen on screenshot, but 100% disk bandwidth. I have two disk, that's way it only reported 47% (task manager accounts for two drives), but the disk usage on C: and D drive is 100% (two partition on a drive), and on F: drive it's 0%. Yes but I don't have a modern PC, it 2012-ish, and it's not the number that matter, is that I can't do anything else if that process locking my C: drive at 100%.

[Frank Thomas]

7.9MB/s is small for 2008 models. try disabling Superfetch, and if you are playing audio, stop it, and see if that has any impact. some of the HD audio services for windows are getting out of hand in terms of performance impact.

[magicandre1981]

Install the Win10 WPT (part of the Windows 10 SDK: dev.windows.com/en-us/downloads/windows-10-sdk) next time you see the disk usage, capture a trace with xperf and share the compressed ETL file: pastebin.com/AyxAVU60

[Nur]

@FrankThomas I see but I don't really know whether 7.9MB/s is small or not, it's just that my PC was fine two days ago with disk usage is 5-30% for any activity, MS Office, browsing, even 3D games, idling at 0-3%. Tried disabling SuperFetch but it has no effect, there are like 20 services other than SuperFetch under svchost, can you help me pinpoint which one is constantly reading from disk?

[Nur]

@magicandre1981 There are several features, since I only need xperf then I just want the 'Windows Performance Toolkit' I suppose?

[Frank Thomas]

you can always check out what it is actually reading with Sysinternals FileMon. it may give you some valueable clues. Also check the SMART disk health stats for that drive, to see if its health is on the decline.

[Nur]

@magicandre1981 here is the ETL file 1drv.ms/1k4zLqu

[Nur]

@FrankThomas Good to hear that I can trace it, but can you guide me how to do it, a link to a tutorial for both process?

[Nur]

@FrankThomas I checked the SMART status and all is OK. perfmon already give a good information that svchost.exe (LocalSystemNetworkRestriction) is the culprit, so I guess this is it, it's just become glitchy and won't stop loop reading from disk. I've contacted MS Support and no result whatsoever. I'll spend the night refreshing my PC then hope it will solve my problem..

[Frank Thomas]

thats good news. Your best bet will be to use ProcMon (from Technet/Sysinternals) to determine what service is causing the activity, and what they are accessing. here is some intro info on procmon: blogs.technet.com/b/askperf/archive/2007/06/01/…

[magicandre1981]

@FrankThomas I already posted what causes the activity ;)

[Nur]

Thank you. Just for reference how long should I capture xperf in case this problem happen again? I already refreshed my PC, now every problem is gone for good, now everything open in seconds (2 to 5 seconds!) not minutes anymore. Yes my PC specification is old and low but it always really snappy because I only do little office work and browsing in this PC, 3D and heavy stuff on another one. That was the first time I experienced heavy lag.

[magicandre1981]

you should capture 45s till 2 minutes to have a better overview what happens on your system. After the refresh, all desktop programs were removed, after you install them again and reuse them, Superfetch will start caching them again after some time

[Nur]

I see, so it might come back then, I've installed all the program from previous installation.. I found a similar problem superuser.com/questions/914329/….. Is it possible to decipher the info from diagdiskfileIO.etl by myself so I could know what might be the problem or the file superfetch trying to access?

[magicandre1981]

Microsoft posted a video: channel9.msdn.com/Shows/Defrag-Tools/…