Weird problem with saving/writing files to disk

[Grim667]

Hello everybody,
I have encountered very weird problem with writing files on disk (saving files) in my system.
My configuration is:

• 
  ■ core i5 2500k @ 4.5GHz
  ■ Asus P8Z78-V Motherboard
  ■ 16 GB RAM (2x 4GB + 1x 8GB) @ 1600MHz
  ■ Crucial M4 128GB SSD (system drive)
  ■ WD 2TB (7200rpm) + 2x Seagate 4TB (5900rpm)
  ■ MSI GTX 970 Gaming
  ■ Windows 7

My system is otherwise very stable I have not been experiencing any crashes or any other type of problems but a single and very weird one. I will try to to describe them to as much detail as I can.
Sometimes writing files on disk (all of the disks are affected both SSD and HDD) gets stuck and the only thing that helps is a system restart (logoff -> logon doesn't work). I will list of programs that are affected the most and the ones that are not affected:

• 
  ■ Eclipse IDE - after a random amount of saving project the IDE freezes and does not save anymore
  ■ CodeBlocks - pretty much the same behaviour as Eclipse. The saving option freezes and you are stuck till restart
  ■ Chrome (not very common) - finishes downloading a file till 100% but does not rename the temporary file to its proper name. If you try to access the file manually the explorer gets stuck in loading the green ribbon in the address bar infinitely
  ■ Resident Evil 7 - the game gets stuck with the autosave option after a number of saves. You can play and everything is ok but manual save is not available anymore. When you restart the final autosave is correct and everything behaves normally till the issue appears next time
  ■ Starcraft 2 - I play the game very often and have made a lot of saves during the campaign and it never had any problem whatsoever
  ■ It seems that the rest of the applications are not affected or there is not such obvious sign of malfunction.

Does anyone know what could cause this type of behaviour and if there is any way to fix it?

 

[Ralston18]

Open Event Viewer and look for error codes and warnings just before or at the time the above described problems occur.

Look for some common cause.

Right clicking any given log entry will provide more information. See what you can find.

Note: Event Viewer may first report no entries but it is really still just looking. Allow a couple of minutes if necessary for the log entries to present.

 

[Grim667]

Open Event Viewer and look for error codes and warnings just before or at the time the above described problems occur.

Look for some common cause.

Right clicking any given log entry will provide more information. See what you can find.

Note: Event Viewer may first report no entries but it is really still just looking. Allow a couple of minutes if necessary for the log entries to present.

I have restarted my PC and tried to reproduce the problem. A couple of build+run did it but there are not any errors in the event log. At the same time there are two "information" entries of LoadPerf:

Log Name: Application
Source: Microsoft-Windows-LoadPerf
Date: 4.4.2017 0:29:15
Event ID: 1000
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: Grim-Desktop
Description:
Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-LoadPerf" Guid="{122EE297-BB47-41AE-B265-1CA8D1886D40}" />
<EventID>1000</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-04-04T05:29:15.942702100Z" />
<EventRecordID>178572</EventRecordID>
<Correlation />
<Execution ProcessID="9832" ThreadID="9656" />
<Channel>Application</Channel>
<Computer>Grim-Desktop</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="LoadPerf">
<param1>WmiApRpl</param1>
<param2>WmiApRpl</param2>
<binaryDataSize>16</binaryDataSize>
<binaryData>B64D00005C4E0000B74D00005D4E0000</binaryData>
</EventXML>
</UserData>
</Event>

Log Name: Application
Source: Microsoft-Windows-LoadPerf
Date: 4.4.2017 0:29:15
Event ID: 1001
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: Grim-Desktop
Description:
Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-LoadPerf" Guid="{122EE297-BB47-41AE-B265-1CA8D1886D40}" />
<EventID>1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-04-04T05:29:15.906700100Z" />
<EventRecordID>178571</EventRecordID>
<Correlation />
<Execution ProcessID="9832" ThreadID="9656" />
<Channel>Application</Channel>
<Computer>Grim-Desktop</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="LoadPerf">
<param1>WmiApRpl</param1>
<param2>WmiApRpl</param2>
<binaryDataSize>12</binaryDataSize>
<binaryData>B44D0000B54D000034070000</binaryData>
</EventXML>
</UserData>
</Event>

I will try to test it more with different applications tomorrow after work. Thanks for the idea.

 

[Ralston18]

Yes keep looking.

Would not expect that the symptoms would be related to informational entries.

Explore other logs and watch for error codes and warnings.

Make sure you allow time for the log entries to load. Event Viewer may indicate no data. However, after a few minutes, all sorts of entries will be listed.

 

[Grim667]

Yes keep looking.

Would not expect that the symptoms would be related to informational entries.

Explore other logs and watch for error codes and warnings.

Make sure you allow time for the log entries to load. Event Viewer may indicate no data. However, after a few minutes, all sorts of entries will be listed.

I got little more time to try it todays and this is what I did. I tried to replicate the error in eclipse this day. After a while I was able to replicate the error and my eclipse got stuck and I was not able to build + run anymore. I leave the event viewer open and I tried to replicate the error in CodeBlocks. I was not able to replicate the error there. I followed with chrome I downloaded more than 30 files and was not able to replicate the error. If I check the event log I was able to find 2 warnings a couple of minutes after the eclipse issue:

Log Name: Application
Source: Microsoft-Windows-Search
Date: 4.4.2017 18:15:23
Event ID: 10023
Task Category: Gatherer
Level: Warning
Keywords: Classic
User: N/A
Computer: Grim-Desktop
Description:
The protocol host process 8636 did not respond and is being forcibly terminated {filter host process 2708}.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
<EventID Qualifiers="32768">10023</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>3</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-04-04T23:15:23.000000000Z" />
<EventRecordID>178623</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Grim-Desktop</Computer>
<Security />
</System>
<EventData>
<Data Name="ExtraInfo">
</Data>
<Data Name="ProtocolHostProcessID">8636</Data>
<Data Name="FilterHostProcessID">2708</Data>
</EventData>
</Event>


Log Name: Microsoft-Windows-Known Folders API Service
Source: Microsoft-Windows-KnownFolders
Date: 4.4.2017 18:23:55
Event ID: 1002
Task Category: None
Level: Warning
Keywords:
User: Grim-Desktop\Grim
Computer: Grim-Desktop
Description:
Error 0x80070002 occurred while verifying known folder {c1bae2d0-10df-4334-bedd-7aa20b227a9d} with path 'C:\ProgramData\OEM Links'.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-KnownFolders" Guid="{8939299F-2315-4C5C-9B91-ABB86AA0627D}" />
<EventID>1002</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-04-04T23:23:55.015984500Z" />
<EventRecordID>11456</EventRecordID>
<Correlation />
<Execution ProcessID="8268" ThreadID="10320" />
<Channel>Microsoft-Windows-Known Folders API Service</Channel>
<Computer>Grim-Desktop</Computer>
<Security UserID="S-1-5-21-2423194430-2415569759-4201157662-1000" />
</System>
<EventData>
<Data Name="hrError">0x80070002</Data>
<Data Name="FolderId">{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}</Data>
<Data Name="Path">C:\ProgramData\OEM Links</Data>
</EventData>
</Event>

I don't know for sure if windows-search could be to culprit but it definitely seems that if you stuck one program with it you don't seem to be able to replicate the same problem with another program. What do you think?

*Edit
If I go manually to the folder of the project that I used to replicate the issue in eclipse and go all the way to bin and the compiled *.class file, right clicking the file causes explorer to hang as if the file was trapped by something and you are not able to access it.

 

[Ralston18]

Not noting any patterns or other consistencies per se. May well be some "perfect storm" scenerio.

Try closing as many background apps as possible and continue to work with eclipse as you have been doing.

The idea being to eliminate as many factors as possible and obtain some consistent pattern in the logs.

 

[RolandJS]

Has the computer been tested in Safe Mode earlier?

 

[Grim667]

Has the computer been tested in Safe Mode earlier?

I have tested the computer in Safe Mode and it does not present the problem. I returned to normal mode and turned off indexing on main drive and turned off Windows Search and I do not seem to be able to replicate the problem.

 

[RolandJS]

And, you have been making, and you're continuing to make, routine restorable full image backups of your OS and Data partitions onto trusted reliable external media, correct?

 

[Grim667]

And, you have been making, and you're continuing to make, routine restorable full image backups of your OS and Data partitions onto trusted reliable external media, correct?

I have my data backed up on external media (I don't have full image backup of OS though). I have already tested the main drive (128GB SSD) with HD tune and it does not present any errors/bad sectors. I have experienced a couple of dead mechanical drives through my life but never a SSD. As far as I have seen it seems more like an indexing problem and the file gets trapped by the service and is not accessible by other applications. The files are perfectly fine after restart. Is there anything I am not seeing?

 

[RolandJS]

Grim667, you're very thorough, I don't believe you missed anything at all