Over the past couple of months I've noticed that my Win 8.1 x64 MCE system runs one thread and does more or less continuous but low-rate I/O for some minutes right after reboot.  I don't see this very often, as I typically only reboot the workstation after Windows Update has dropped its load on Update Tuesday.

The process that's running is System, and it's using up one of the 24 logical processors (i.e., it shows a continuous roughly 4.2% CPU usage).  After, say, 15 minutes of doing this the System CPU usage just drops suddenly to near-zero (e.g., 0.01%) and the system runs normally thereafter.

During the time System is running that thread I can't start such things as CHKDSK and System Restore (they just hang).

I've watched the Resource Monitor and what the System process appears to be accessing is the master file table of my system volume or backup drive (i.e., G:\$Mft), which is an external Western Digital MyBook drive connected via USB.  I also see it occasionally write to n C:\Windows\System32\config\SOFTWARE.LOG1.  But it's not consistently showing anything, so I suspect whatever I/O activity it is falls outside normal file system access.

My system is otherwise well-tuned and stable, and free of malware, and I actually feel no impact from this - other than if I'd like to do a System Restore or something right after reboot I can't until it finishes.

Nothing is logged in the System Event Log that gives any clue as to why it would be doing this.

SFC /VERIFYONLY reports everything's healthy.

Seems to me I recall a Windows Update that delivered a new Western Digital driver a few months ago.

Could it be Windows Defender doing some kind of after-boot scan (though I'd expect that to busy MsMpEng, not System)?

My question is this:

Is this "System process uses continuous CPU right after reboot" behavior relatively new, normal system maintenance that everyone is seeing, or should I look deeper because something's gotten misconfigured or I may have some kind of failure?

Thanks in advance for sharing your wisdom and experience.

More information...

This activity by the System process shows increasing I/O rates up to a point where it peaks, then it drops to zero and starts up again.  Some of the increases are gradual and some quick.

It's clearly something that's following an algorithm, and not random, and it does finally finish - after something like 20 minutes.

-Noel

NC

Have you thought of running windows performance recorder? 

Thanks. Yes, that's exactly where I was headed next. Andre Ziegler has posted some instructions elsewhere that I was figuring on following. Thanks for the extra info.

-Noel

NC

Andre is long gone but if you want he is on MSFN.ORG

Thanks.  Yes, I know.  I'm on MSFN.org too. :)

I'm not totally incapable of reading an analysis on my own...

Looks like the ntoskrnl.exe!KiStartSystemThread is keeping itself busy after bootup validating my sizeable collection of volume snapshots.  Even though I have an SSD array, I guess 50 GB of snapshots takes a little while.

What I don't yet understand is why this activity seems more noticeable / intrusive than it did a few months ago.  I don't recall increasing the volume snapshot quota, but it's possible I might have.  I do recall making SOME changes to the configuration, but all I remember doing was to turn off volume snapshots on one of my backup drives.  The computer remembers things better than I do, alas.  :-)

-Noel

NC

Didn't say you were which is why I did not offer to analyze them for you.  Only mentioned Andre because you did.  Have been on MSFN for ~5 years.

I have the same problem you do. My computer remembers all, but then I tend to abuse it {grin}

I Do not think your snip is normal behavior and the problem may have just been getting worse over time.

I've finally realized that an increase in number of snapshots I allow on my BACKUP drive is the root cause.  Late last year I had reset that to 900 GB, which allowed some 60+ of them to accumulate.  So the sheer number of volume snapshots is what's causing the validation to run too long.  Explains everything.

I was not previously aware of this downside to having too many snapshots.  Learn something new every week.

-Noel

NC

We both did.  Thats a lot of back ups to save.