Windows sysinternals

408 Part III Troubleshooting—”The Case of the Unexplained...”
The Case of the Excessive ReadyBoost
The user had been running Windows 7 on his laptop for over a year with no issues at all,
often leaving the laptop running for weeks at a time. However, he had recently begun having
problems when bringing the laptop out of sleep mode. Performance was sluggish and the
hard disk light stayed on solid for at least five minutes.
He started Procexp to see what process or processes were consuming CPU cycles and found
the System process consuming about 35 percent, which is a lot for a dual-processor system.
Double-clicking on the System process to open its Properties and clicking on the Threads
tab, he saw that the culprit had a start address in Rdyboost.sys, the ReadyBoost driver.
(See Figure 17-6.)
FIGURE 17-6 A System thread starting in Rdyboost.sys consuming 35 percent of available CPU.
ReadyBoost is a feature of Windows Vista and Windows 7 that offers performance
advantages by using a solid state drive such as an SD card or USB thumb drive as memory
cache. Such drives are typically faster than traditional disks.
To confirm that the problem was with ReadyBoost, he captured a Procmon trace. At first, he
didn’t see anything interesting, but then he remembered to remove the default filter that
hides System process activity. (See Figure 17-7.)
www.it-ebooks.info