hard faults

Topic

New Reply

Every so often my Win 7 Home Premium pc seems to go into a mode where the disk is searching for something and it consumes most of the cpu. I just observed this with the Win 7 Resource Monitor and found it stating that one item (MsMpEng.exe) was experiencing hundreds of hard faults per second, while no other routine showed even a single error.
How should I interpret this? Can the situation be corrected/prevented?
Thanks.

Reply | Quote

Replies

Hopefully this article will help http://helpdeskgeek.com/windows-vista-tips/what-is-msmpeng-exe/

Reply | Quote

The article is very interesting. However, Windows Defender is already turned off on my pcs.

I rebooted, and now I am worse off than ever. I continued to have a “busy” background, with spikes in disk activity about every 18 seconds. The hard faults today seem to be in msfeedssync.exe, SearchIndexer.exe, and svchost.exe (netsvcs).

Any further thoughts?

Thanks again.

Reply | Quote

MsMpEng.exe is also the name of the Antimalware Service Executable (active scanner) part of Microsoft Security Essentials (MSE).

Hard faults are not an error condition, they indicate that blocks of data needed to be pulled from the page file (hard disk swap file), rather than directly from memory (RAM).

High levels might indicate that you need more RAM, so that you can hold more data that is immediately accessible.

With any active antimalware/virus software, it will be checking many times more files than you will need to use in a normal session, as will a poorly setup searchindexer. You might have several TB of data on your drive(s), yet you only have a relatively small amount of working memory, typically 2-8GB, to cache it in.

For malware scanning, you may be able to restrict the activity. Disable scanning on data that doesn’t change (movies, music, photo’s, …?) or restrict the scan to reads or writes – not both.

For search indexing, turn it off if you have a manual filing system or restrict it to only those folders that contain your personal data and only to file types that you actually search for.

Reply | Quote

It’s also possible you have a memory fault and the computer has disabled some of your RAM, resulting in very low available memory.

cheers, Paul

Reply | Quote

Thanks for your answers. Satrow’s response, in particular, makes me feel MUCH better.

Last night the pc got so bad that I could not even edit a Word file, as there was far too much “going on.” I shut down the pc and restarted this morning, and it was much calmer, so I can do work again. This is not the first time that I find that shutting down overcomes things that reboots do not – there must be an incomplete aspect to reboots. While I had very occasional hard faults today, understanding what they really are (as above) makes it seem reasonable.

MANY THANKS!

Reply | Quote

No trouble, Paul.

Re Word, from a reference I checked earlier (my bold):

In other words, applications like Microsoft Word and Microsoft PowerPoint will not load entire documents into RAM. Instead, they memory map the file, so that when you navigate through the document, it loads portions of the document as needed. The act of loading portions of the document from disk to RAM as a memory mapped file causes a hard page fault which is counted in the pages/sec counter.

As Windows puts the application asking for the data into a wait state until it’s loaded while it frees up some space, writes out the data and then loads it, this can cause repeated pauses – very annoying – and the less RAM and the slower the drive, the worse it will be! Yes, a reboot (or shutdown/restart with the later OS’s) is a ‘cheap’ way to bring your PC back up to speed for a while 🙂

Patrick describes it much better than I could in Page Faults Explained:

I described above a very basic page fault process, but it’s a lot cooler/interesting than that! In its basic definition of course, a page fault occurs when a program attempts to access pages that are not currently in physical memory (RAM). This is also known as a hard fault. It’s absolutely imperative you understand the difference between hard fault and soft fault, which I will discuss below.

Hard Fault – Hard Fault (otherwise known/referred to as a major fault) is the exact same thing as Page Fault, and you’ll see its name in Resource Monitor on newer versions of Windows (afaik Vista and later). To expand on why hard faults are defined as they are, and to stress on why they’re expensive, it’s due to the process the page fault handler must follow if one occurs. For example, if the page is not loaded into memory at the time of a program referencing its address, the page fault handler needs to find a ‘free location’. This free location is either a page in memory, or a non-free page in memory.

If the latter is currently in use by a pre-existing process, the operating system needs to spend time writing out the data in that current page, and mark it as not being loaded into memory. Once this is done, it is now a free location and can be used to read the data for the new page into memory, add an entry to its location within the MMU, and finally of course indicate that it is now successfully loaded into memory.

Reply | Quote

Is it just using the Windows Memory Diagnostic tool?

Reply | Quote

Wow! I appreciate all of the learning I’m receiving in this thread. THANK YOU VERY MUCH!

I have 12 GB of RAM installed. How should I check to see if it is all working properly?

Reply | Quote

Task Manager will show you how much RAM Windows thinks you have and how much is in use. Event Viewer will show any memory errors at boot.

cheers, Paul

Reply | Quote

And the Task Manager Performance tab > Commit (GB) # will tell you approximately how much total (RAM + Virtual) memory is in use currently and the maximum set. I have 8GB memory installed and currently it’s showing 1/15 (GB) – but that’s way less usage than would be shown on a ‘normal’ PC!

5 minutes after a boot, I’d expect most PC’s to show between 1-2/Total GB Commit as a baseline, increasing steadily as the computer is used.

Post some screenshot attachments of TaskMan’s tabs for us to take a look at?

Reply | Quote

38943-task-manager-snip-1-11-15

Looks like all of my RAM is available.

Attached is image of Task Manager’s Performance Tab.

Reply | Quote

Yes, memory total looks as it should.

Probably time to work through those 124 processes next, someone might pick up on something potentially ‘bad’. After a fresh boot + 5 minutes resting, how many processes are running?

Reply | Quote

I’ve got 48 processes running and I’m not a light user. 124 is an awful lot, can you post a list of them?
Command Prompt
sc query > %temp%processes.txt
notepad %temp%processes.txt

Post the contents of processes.txt

cheers, Paul

Reply | Quote