ESET Extremely high disk usage from ekrn.exe at Windows startup

[antoniu200 0]

Hello!

In the last month, ekrn.exe has been reading a lot at the Windows startup, so much that my welcome screen takes about 2 minutes on an SSD. I tried reinstalling ESET with esetuninstaller.exe and disabling startup scan, none helped. I have three more PCs running ESET Internet Security and none of them have this issue.

Using Windows 10 x64, Xeon X5650 CPU, 16 GB DDR3, Kingston A400 as (C:) drive. I have 2 more physical disks in my system, none of them see such read activity.

What could be the cause? Can this be solved without fully reinstalling Windows?

[Marcos 5,231]

Please carry on as follow:
- enable advanced operating system logging in the advanced setup -> tools -> diagnostics
- reboot the machine to reproduce the issue
- after a while (1-2 minutes) stop logging
- collect logs with ESET Log Collector.

When done, upload the generated archive to a safe location and drop me a private message with a download link.

[antoniu200 0]

Thanks for the response! Forgot to mention in the OP that I'm using ESET Internet Security 64 bit.

Sent you a PM with logs collected while the issue was present. However, ESET turns off Advanced OS Logging after a reboot, so I'm not sure if the information collected is good. I reactivated the option after the reboot while the disk was seeing high usage from ekrn, I hope that helps.

As a situation update, it seems the issue only appears if Fast Startup is used. At normal startup, no such high disk activity is present, but the issue completely disappears if ESET is uninstalled.

Edited November 18, 2020 by antoniu200
Grammatical error

[antoniu200 0]

Situation update: after a Wake from Sleep of the system, the disk usage spiked again - something that hasn't happened before. It only happened after a power off, power on cycle.

It seems like the System process (I think explorer.exe, not sure) consistently reads and writes to the disk, then ESET kicks in and reads and writes to the disk.

I will soon send you a new set of logs.

[antoniu200 0]

I couldn't stand the problem anymore, decided to do an in-place upgrade. That only works if the installation media is the same compilation or greater than the installed version of Windows.

That seems to have taken care of the issue for now, but all the installed updates are gone. If it occurs again, I'll update this thread.

If Marcos can notice something out of place in the logs I sent, their reply is welcome.

[antoniu200 0]

It seems that Marcos won't reply if folk drops the logs in his private messages, as per his request. So, here are both my logs. Both on Google Drive, since one is bigger than 100 MB.

https://drive.google.com/file/d/156M_0K-A9QVMmyAdDl9kVNTNd79v8Umz/view?usp=sharing

https://drive.google.com/file/d/1PUg7BTAfHZ_592-8SOniIGBDJzRLQv2r/view?usp=sharing

[Marcos 5,231]

The logs didn't show any excessive reading by ekrn (2,5 MB), however, the IO time spent is extremely high. Looks like a hw issue since this is something that we cannot influence.

[antoniu200 0]

13 minutes ago, Marcos said:

The logs didn't show any excessive reading by ekrn (2,5 MB), however, the IO time spent is extremely high. Looks like a hw issue since this is something that we cannot influence.

That's really bad news.

I checked my SSD just now with CrystalDiskMark, but it shows 94% health. Is that bad?

Should I try to keep Advanced Logging enabled, since I cannot trigger the issue? Basically, is it for sure a HW issue? Is it worth trying to search EIS logs anymore?

If not, can the folks here at ESET Forums help diagnose such HW issues?

[antoniu200 0]

Two days ago, I disabled Fast Startup and eliminated Sleep from the Windows Power Menu. It seems like the problem has disappeared.

So, the final solution was to disable Fast Startup, as, if any system exhibits this symptom, it might not deal too well with Hybernation in general, so both Sleep and Fast Startup should be avoided.