Extremely high disk usage by ekrn.exe on ver 14.2.24

[Mr_Frog 14]

Good morning, 

I found this problem since i upgraded to version 14.2.24.  Every time i turn on the laptop or every time after eset finishes detection engine update and start re-scan startup will make the performance very slow because the disk usage by ekrn.exe is very high.

[Marcos 5,074]

Would it be possible to turn on advanced operating system logging in the advanced setup -> tools -> diagnostics during the scan or better shortly before it starts and disable it after it finishes or after 5 minutes, whichever occurs first?

After disabling logging, collect logs with ESET Log Collector, upload the generated archive to a safe location and drop me a personal message with a download link.

[Mr_Frog 14]

37 minutes ago, Marcos said:

Would it be possible to turn on advanced operating system logging in the advanced setup -> tools -> diagnostics during the scan or better shortly before it starts and disable it after it finishes or after 5 minutes, whichever occurs first?

After disabling logging, collect logs with ESET Log Collector, upload the generated archive to a safe location and drop me a personal message with a download link.

Will do this tomorrow.  I will send you a private message about the log when i have processed it.

 

Thank you.

[Mr_Frog 14]

@Marcos I have sent you a private message about the log file. I have also made a video recording from the update process until the startup scan is complete. If possible, please let me know what caused it.

 

Thank you. 

[Marcos 5,074]

I didn't find any issues with ekrn. While it is true that about 800 MB of data was written during compilation, backgroundtaskhost.exe spent 27s reading 18 MB of data which rather points to a disk problem.

Try disabling the option "Create snaphots of modules" in the update setup to reduce the amount of data written during update and also run a disk scan for possible errors.

 

[Mr_Frog 14]

On 8/28/2021 at 7:10 PM, Marcos said:

also run a disk scan for possible errors

I have done a disk scan in two ways. First with chkdsk and second with HDD Regenerator, it looks like there is no problem. Still confusing about this this case.

Here is the result:

#First:

Level Date and Time Source Event ID Task Category
Information 30/08/2021 17:17:31 Microsoft-Windows-Wininit 1001 None "

Checking file system on 😄
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         

Stage 1: Examining basic file system structure ...
  1018624 file records processed.                                                        

File verification completed.
 Phase duration (File record verification): 30.46 seconds.
  16174 large file records processed.                                   

 Phase duration (Orphan file record recovery): 0.00 milliseconds.
  0 bad file records processed.                                     

 Phase duration (Bad file record checking): 0.90 milliseconds.

Stage 2: Examining file name linkage ...
  98956 reparse records processed.                                      

  1367134 index entries processed.                                                       

Index verification completed.
 Phase duration (Index verification): 6.94 minutes.
  0 unindexed files scanned.                                        

 Phase duration (Orphan reconnection): 8.94 seconds.
  0 unindexed files recovered to lost and found.                    

 Phase duration (Orphan recovery to lost and found): 985.64 milliseconds.
  98956 reparse records processed.                                      

 Phase duration (Reparse point and Object ID verification): 6.35 seconds.

Stage 3: Examining security descriptors ...
Cleaning up 194 unused index entries from index $SII of file 0x9.
Cleaning up 194 unused index entries from index $SDH of file 0x9.
Cleaning up 194 unused security descriptors.
Security descriptor verification completed.
 Phase duration (Security descriptor verification): 399.81 milliseconds.
  174256 data files processed.                                           

 Phase duration (Data attribute verification): 1.02 milliseconds.
CHKDSK is verifying Usn Journal...
  38618544 USN bytes processed.                                                           

Usn Journal verification completed.
 Phase duration (USN journal verification): 876.18 milliseconds.

Stage 4: Looking for bad clusters in user file data ...
  1018608 files processed.                                                               

File data verification completed.
 Phase duration (User file recovery): 1.12 hours.

Stage 5: Looking for bad, free clusters ...
  23856073 free clusters processed.                                                       

Free space verification is complete.
 Phase duration (Free space recovery): 0.00 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

 204799999 KB total disk space.
 107850960 KB in 672047 files.
    386268 KB in 174257 indexes.
         0 KB in bad sectors.
   1138479 KB in use by the system.
     65536 KB occupied by the log file.
  95424292 KB available on disk.

      4096 bytes in each allocation unit.
  51199999 total allocation units on disk.
  23856073 allocation units available on disk.
Total duration: 1.24 hours (4499480 ms).

Internal Info:
00 8b 0f 00 ea e9 0c 00 96 57 17 00 00 00 00 00  .........W......
8a 02 00 00 02 80 01 00 00 00 00 00 00 00 00 00  ................
"

 

#Second:

 

[Marcos 5,074]

The log showed that a standard amount of data was written by ekrn.exe during update. Writing 60 MB/s is ok but it could be less if other processes/tasks with normal or higher priority ran at the same time. Ekrn.exe runs the update thread with the lowest priority possible,