trying to debug slow shutdown

[nyg]

I'm trying to debug a slow shutdown on my laptop with an SSD.

I've done the msconfig to so non-microsoft services and other startups do not start at boot but this doesn't make a big difference.

One thing is that although the shutdown takes 2 minutes, and the disk activity light is pinned solid in those 2 minutes, so something is going on, I can't seem to figure out how to get information about what is going on. The big problem is that 7 seconds after the shutdown command, the event log service shuts down. After that point there are no log entries.

Is there a way to configure the event log service so that it doesn't stop right after the shutdown command? If there were log entries this would probably be quick debugging.

Also while I am at it, here are my theories for what is going on (1) the disk is busy in those 2 minutes doing some sort of registry backup, or (2) also running through a journaling file system log to update disk blocks to a consistent state, or (3) or running the search indexer.

What does Windows 7 do to the disks when it is shutting down?

 

[Maguscreed]

Are there any major software packages at work here?
Antivirus/firewall?
Anything made by autodesk?

 

[nyg]

There's boatloads of stuff on my machine (Dynamics, Adobe Creative Suite, ...)
Now that you've got me thinking about it, Dynamics runs a local version of SQL server.
That would be just the ticket for something that wants to do a lot of IO before it closes down.
That would show up in the Event Log if I could get the Event Logger to stay alive longer.
But I could try disabling that service.

 

[nyg]

Thinking about it I suspect this might be due to VSS, the shadow copy. In fact SQL server has some sort of service that does a VSS backup of the database. Hard to confirm though without event log staying alive.

 

[Maguscreed]

Yeah, sorry I don't know of a way to set a shutdown order, since the event logger requires several services running to work right, it shutting down early kind of makes sense actually.

Your line of thought regarding the local sql seems logical. I would give that a look over.

 

[OldMX]

Look at the registry for a key called ClearPageFileAtShutdown which value should be 0 (zero) you can find it here: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, it the value is 1, then it may cause the long shut down.

 

[Maguscreed]

As a footnote to that, I would put the pagefile on a mechanical drive just to prevent the massive read/writes to the ssd.

 

[nyg]

Putting the pagefile on the SSD is exactly what the SSD ought to be good at, especially for Windows, where bloated applications like Outlook spend most of their time crushing the IO system with page faults. That is why SSDs make such a big difference in the performance of running Outlook. So it makes no sense to move it off. Clearing the page file on a mechanical disk will be even that much slower.

A question on the ClearPageFileAtShutdown flag. I'd imagine that a danger of this would be that the disk would be that much more vulnerable to cracking with latent passwords, etc. sitting in the clear on the disk from poorly written applications. But is there any other downside? I was experimenting with this flag yesterday -- it did seem to make the shut down faster but then I had trouble rebooting - to the extent that for a moment it looked like I was going to have to do a full system restore from backup disks in order to get my computer back. Luckily it did come back and I quickly changed the flag back, but maybe this was coincidental.

 

[nyg]

Also if one is running full disk encryption such as bitlocker or PGP whole disk encryption, the clearing of the page file would be relatively pointless, right?

 

[Maguscreed]

My pagefile resides on my slowest and oldest disk.
My shutdown time is approximately 9 seconds. (assuming rocketdock doesn't hang which it does now and then.)
I've never done anything to try and speed it up I've not altered the shutdown process or even bothered to remove a few superfluous startup items I have running. I simply put the page file on the least used drive because it made logical sense.

 

[nyg]

Setting ClearPageFileAtShutdown to zero changed the shutdown time from 2.5 minutes to about 30 seconds.
I am not so worried about the security concerns because I am using PGP Whole Disk Encryption. On security Windows is a sieve anyway for anyone determined to crack in, so it's not clear that it matters all that much.

 

[nyg]

I am trying to figure out now what is changing the value back to 1. I haven't isolated when it happens, maybe within a few days of my editing my registry to set it to 0.

I have a theory that this is somewhere in the Domain policy for my company that it should be 1, or that there is some security software running on my machine (Security Essentials, Lenovo Toolkit) that sets it to 1.

Anyone have ideas?

One additional benefit of setting it to 0 is to limit the number of writes to the SSD, since SSD's are flash and wear out.