Windows 10 c:\$Mft (NTFS Master File Table) and c:\$LogFile - sustained high Write (B/sec) for 20 to 30 seconds by Windows 10 Pro

  • Thread starter Thread starter Graeme Evans NZ
  • Start date Start date
G

Graeme Evans NZ

Ever since my Windows 10 Pro upgraded to version 1903 (in August last year), it has suffered from lock-up / pregnant pauses of 20 - 30 seconds, seven to ten times per day. It continued to do this with version 1909 (currently OS Build 18363.778).

My workstation has reasonably high specs: a 3.5GHz Xeon processor, 32GB of RAM. two fast SSDs (500GB & 1 TB), and a 4TB hard disk.

During the lockups, Task Manager almost always shows Disk usage of 33%. However this seems to be the average over all three drives - with "Disk 0" running at 100%. The Resource Monitor shows high write activity to "C:\$Mft (NTFS Master File Table)" and "C:\$LogFile (NTFS Volume Log)" files, by "System" and "RuntimeBroker.exe" (and almost zero reads at all) . I can sometimes switch between tasks (which allows me to check Task Manager & Resource Monitor if I have them open, and use Snipping Tool to take a screen shot). But sometimes everything locks up completely for 20-30 seconds, with the cursor displaying as a rotating circle.

In all cases, there is zero (or miniscule) read activity across all processes. It seems that the main SSD has been completely commandeered for 'Writes' (primarily to these main system files), and there is no spare capacity to read anything from this SSD for the applications that are waiting to do so. This state lasts for 20 - 30 seconds. After that, the writes to "C:\$Mft (NTFS Master File Table)" and "C:\$LogFile (NTFS Volume Log)" finish, and things return to normal - except that the sort order of Windows Explorer instances (and sometimes multiple browser windows) is often trashed (see below).

It does not seem to matter what application I am using - the pregnant pauses occur out of the blue in Microsoft and third party applications alike.

I usually work with more than 15 Windows Explorer instances open, displaying various folders that I frequently access for different things during the day. Quite often (about 50%), after these pregnant pauses, the sort order of the Explorer windows has been completely trashed. (This makes it difficult to quickly find a folder I want to switch into it. I usually finish up closing them all, and then running a script to open all the standard ones again - which gets pretty frustrating several time a day, every day.) Quite often, the order of various applications is changed in the Windows Task Bar - which I can live live.

Here (below) is a screenshot of Task Manager and Resource Monitor, showing a pregnant pause caught in the act.

You can see that Task Manager was showing "33% Disk" - which (because this machine has 3 drives) means that Drive C: (a partition on SSD Drive 0) is working at 100%), and everything else (almost) is waiting for it to clear. In this screenshot, "RunTimeBroker.exe" is hogging most of the write activity. But I have other screenshots where "System" is doing so. (You can see that they both are writing to these files.) Extra info: Drive D: is another partition on the same SSD as C:. Drives G: and H: are partitions on the second SSD.

For background understanding of "C:\$Mft (NTFS Master File Table)", see https://www.ntfs.com/ntfs-mft.htm

What is this instability (and corruptions of task / application sort order) that seems to have been introduced with version 1903, and not fixed by any Windows Updates since? How can I fix / avoid it?



Continue reading...
 
Back
Top