I've noticed for some time that with Windows NT 6.1 operating systems there's an enormous amount of disk i-o, even on idle systems. This seems to be a possible sorce for why some users drives won't spin-down on Windows 7 and Server 2008 R2, and is a concern for many SSD users due to the effects high volume write traffic has on write amplification and SSD life.

I've tried in vein to find out what the source of all the disk activity ; I have eliminated a lot of what it isn't, as many processes that read and write to disk like the 'Microsoft .NET Framework NGEN' services only run one time or intermittently when something .NET is updated...

So I fianlly took it all the way and even running a minimal diagnostic setup, with all performance counters disabled, and with just these eight services running:



...and just these 14 essential processes (Explorer was disabled, but reenabled for the screen shot):



Server 2008 R2 still shows an enormous volume of idle disk i/o, and specifically disk writes on the order of dozens per second (which is exactly what you don't want on an SSD due to write amplification):



Windows 7 running a similar minimal service and process payload with performance counters disabled shows even higher disk i-o traffic in a quiescent state (sitting idle for over 15 minutes), and again most of it appears to be disk writes, exactly what you wouldn't want in the case of using an SSD as the cumulative write amplification at this rate over time will be significant.

So, what's going on here; what are all these disk writes? Is the system still attempting to write to the event log? Is there means in the registry to disable all event logging? Is there a tool that will actually monitor what resource is associated with the disk activity shown in the SysInternals DiskMon?

Anyone in the know please chime in; curiosity is killing me!

Possibly it is logging events but you had the Windows Event Log service disabled in your example so you wouldn't think that. Also the Task Scheduler service is not enabled so we can rule out scheduled system tasks that run periodically on the machine are not the culprits either. If you want to see which particular processes are eating up your I/O writes, enable I/O writes in Task Manager.

Open up Task Manager.
Go to Processes tab.
Click on View > Select Columns...
Check I/O Reads
Check I/O Writes

The I/O Reads/Writes field is not limited to disk I/O but a compilation of file, network, and device I/Os. It is a good way to pinpoint which process is causing excessive disk thrashing or in your case which processes are causing the largest percentage of disk writes. These writes which are taking place and which you have recorded may be a normal operation that happens on everyones computer the tricky part is distingushing the culprits. System Restore, Disk Defragmenter, Windows Update, Superfetch are some commonly used programs I can think of that eat up a lot of I/O. Check out that task manager tip to see which process is eating up the most I/O writes on your computer under that configuration. It just may be that what you are seeing is completely normal and nothing to worry about.

Thanks for the tip, will do next benchmark run. I'm farily convinced this is "normal" as I've observed the same behavior on doezens of systems but never bothered to run down what's doing it. The actual disk write activity varies across different disk/controller systems due to how writes get cached, but the drives are still getting written to constantly and regularly.

My interest is in discovering if there is something that can be done to reduce or even stop it alltogether as these are very small frequent disk writes, which is sort of a worst case scenario of what you don't want on an SSD due to write amplification, something the industry probably doesn't give a hoot about, as they'd love to sell more new SSDs.

Worked... It appears to be the "System" (NT Kernel & System) process doing all the disk writing... The questions remain: what exactly is it writing? Why? And can any parameters be passed to the "System" via registry or command line to stop, or at least reduce all these disk writes?

I can't feature the Windows Embedded OS products built on the same kernel could not offer at least some control over this level of i/o traffic, due to the issues this would present in many embedded scenarios -- so it's not difficult to imagine there is some level of control available.

Anyone here have a idea or 'go to' source like an active MSDN, TechNet, or Educational account to find out what's going on here? I've exhausted mine...