system idle process

[BriGy86]

why? i've jsut noticed my computer going very slow

i restarted and it was a bit better

i ran spybot and ad-aware (both up to date) but they didn't com up with anything weird

and i haven't done anything weird to my computer

 

[edro]

System Idle Process should take up 99% CPU if nothing much is running. If it is only taking up 50-60, that means that the other 50% is being used by some other process. Post a screenshot of your processes. Chances are you got some spyware or something running at startup that spybot and adaware aren't seeing. Use HijackThis to see what all is loading at startup (easier than looking through the registry yourself).

 

[BriGy86]

i dunno what was wrong that day but i hasn't done anything weird since then

and what is hijackthis?

is it a prog that just lets you see processes?

 

[Smilin]

Too funny.

 

[CTho9305]

Originally posted by: Smilin
Too funny.

MS should just not show the idle process in task manager unless you enable it in some advanced options somewhere.

 

[Smilin]

Yeah, it's clearly MS's fault.


They should have named it the "system is not doing anything" process instead of the "system idle" process or something. It's so confusing. :roll:

 

[Nothinman]

Apparently it is confusing. Why couldn't they have just excluded it? They already have a bunch of other process name specific code in there, adding one more wouldn't hurt.

 

[Smilin]

I would rather it not be excluded.

If my computer is feeling sluggish, no processes are consuming cpu yet my system idle thread is low I will know something very serious is wrong.

We gripe at them enough about "dumbing things down" with wizards and guis. If a novice user gets confused by the display in task manager, so be it. Heck, it's already got nearly every column in it turned off by default anyway. My grandma can read "system idle process" and put two and two together. Not gonna get much symathy out of me on this one I'm afraid.

 

[Nothinman]

If my computer is feeling sluggish, no processes are consuming cpu yet my system idle thread is low I will know something very serious is wrong.

If the computer seems sluggish and the idle process has no CPU time then it should be allocated to the System process.

 

[Smilin]

Yes. It *should*

If not, disconnect your network cable and commence freaking out.

 

[kylef]

Originally posted by: Nothinman

If my computer is feeling sluggish, no processes are consuming cpu yet my system idle thread is low I will know something very serious is wrong.

If the computer seems sluggish and the idle process has no CPU time then it should be allocated to the System process.

Right, but I think what Smilin' meant is, if your system feels sluggish and yet your "System Idle Process" still reads ~100%, then you've almost certainly been fooled by Task Manager's definition of the "System Idle Process."

It turns out that Task Manager includes interrupts and DPCs (deferred procedure calls, scheduled by drivers) in the Idle Process accounting!

That means that whenever drivers are doing LOTS of work on your system, the Idle Process will still read 100%, despite the fact that your CPU may actually be doing lots of work. This is counter-intuitive, but explains why sluggish systems can still show NO user processes active (e.g., Runaway Drivers).

Process Explorer by SysInternals, on the other hand, separates out Interrupts and DPCs from the Idle Process so that you can really see what's happening. I advise that if you're diagnosing a sluggish system, you should use Process Explorer, as it provides more accurate information than does Task Manager. They both are calling the same underlying NT Native APIs to get this information (NtQueryPerformance), but ProcExp provides more info.

 

[Nothinman]

It turns out that Task Manager includes interrupts and DPCs (deferred procedure calls, scheduled by drivers) in the Idle Process accounting!

Why don't they get accounted to the System process? And why was this never changed if it's a known bug?

 

[kylef]

Originally posted by: Nothinman
Why don't they get accounted to the System process?

Good question. To understand what's going on under the hood you really need to understand a bit about how the accounting system works in NT.

Interrupts and DPCs run at a different IRQL (interrupt request level) than any threads in the System process (or any user-mode process for that matter). Normal user-mode threads and all threads in the System Process run at IRQL 0 (Passive level) or IRQL1 (if in a system call). DPCs always run at IRQL2. Interrupts run at IRQL3 or higher. (Higher IRQL indicates higher priority in interrupt processing.)

All time accounting in NT is performed when the system timer fires, which happens every 10 ms on uniprocessor systems and ever 15 ms on multiprocessor systems. The granularity of the accounting will never be finer than the timer frequency. Note that this means that LOTS of things happen "under the radar". (If a thread just wakes up, checks something quickly, and goes back to sleep it is possible that it may never, ever register any CPU time according to the kernel's accounting system.)

When the timer fires, the timer's ISR examines the system's previous IRQL to determine who is charged the clock tick. (If it was DPC level, the DPC bucket is incremented. If it was higher, the Interrupt bucket is incremented. If it was lower, then the thread's user mode or kernel mode bucket is incremented depending on what it was doing.)

So back to your question: In some sense, you're right: DPC and ISR time is "system time" because it isn't dedicated to your user-mode apps.

But in another sense, one could argue that the "System Process" should only account for *Windows System* time, not time spent running hardware drivers (it's not Windows' fault). (In other words, byt this argument, Windows time and Driver time should be kept separate.)

So as you now know, Windows *does* actually separate these quantities internally. But Task Manager, perhaps out of simplicity, chooses to display only user-mode app time and Windows OS time. Everything else is just lumped uner "System Idle Process."

In Perfmon (the MMC Performance Monitor snap-in), you CAN see these quantities individually. You can separately graph DPC time, Interrupt time, user time, and (correct) idle time. So you can see that the kernel's performance accounting is doing its job, but Task Manager's reporting just doesn't get detailed enough for people like you and me.

And why was this never changed if it's a known bug?

It's not so much a "known bug" as a semantic distinction. I agree, however, that it is confusing. But so are lots of UI elements in Windows...

 

[Nothinman]

But Task Manager, perhaps out of simplicity, chooses to display only user-mode app time and Windows OS time. Everything else is just lumped uner "System Idle Process."

Maybe I'm naive but simplicity seems like a poor excuse since it seems like it would really only be one more exception that the code makes when determining where to charge time, either charging it to System because to most people drivers count as part of the system and don't care about the real distinction or make a new entry and call it something System Driver Process, System IRQ Process or even PageFile time or Virtual Memory time since they like throwing those words around in inappropriate places =)

But so are lots of UI elements in Windows...

Yea, someone should go through and run s/Virtual Memory/Page File/g on all of the resource files or whatever for starters. But you'd think there would be a better excuse since all of the people crying that Linux can't be a good desktop OS because it's so confusing and hard to use seem to forget the fact that they already went through and took the time to figure out all of the quirks with Windows.

That and WTF is up with MS product teams ignoring the UI guidelines? I mean according to MS it's a big thing and all the consistency makes Windows much easier to use, but then whenever products like Visual Studio, Office, WMP, etc get a new release they go and look nothing like the rest of the system. Kind of hypocritical isn't it?

Damn, who left that soapbox there...

 

[Smilin]

Jesus H, Kyle. You busted out chapter two of Goldings' debug class. lol

I was just thinking more along the lines of a root kit loaded as a hidden process or filter driver.

 

[kylef]

Originally posted by: Smilin
I was just thinking more along the lines of a root kit loaded as a hidden process or filter driver.

Oh. Never mind, then.

But seriously, it *is* useful to look at interrupt and DPC time when diagnosing a sluggish system, and Task Manager doesn't display that information. Perfmon and Process Explorer are the tools to use...