Mastermind of Kernel Power id 41 problem

I am not a novice about Kernel Power id 41 trouble ( We Japanese refer as kp41 , hereafter).
Recently I found (one of) its mastermind.     from 2015.03.08
[My PC: Dell , Win7 32bit, 250W power unit, 2GB memory, 2 inner physical hdds (250GB + 250GB) ]

My 3.5 years lesson:   If you have kp41, At first, Remove SERVICES of "Windows Search" and "Superfetch" .
( Request from me: Please tell me, Why does the stopping of "Windows Search SERVICE" cause the stopping of "kp41" ? )
My 4.5 years lesson:   Disable "[Multimedia] SystemSoundsService + [Wininet] CacheTask , in Task Scheduler" both.
and, Disable "Application Experience Service"
and, Disable "Store Common Flash Components To Reduce Download Times." [in Global Storage Settings panel of Flash-Player] --- on 2016/11/29 new

My Conclusion:
kp41 is a "Metabolic Syndrome" of Windows Search Index.
i.e. Windows Search Service is foolish/ defective software.     on 2015/05/28 , by Unbootable
[ MS should improve the dump mechanism for any crash. ]

kp41 is due to file-fragmentation. So, This trouble can be fixed by Freeware Defraggler [← very ordinary specification].
  ( MS Defrag tool is too foolish. ---- foolish specification. )     on 2016/11/21

Latest answer-image on 2015/05/12


Now, Win7 Prefetch/ Superfetch function contains kp41 problem. I found that if ReadyBoot function were disabled, it brings about stopping kp41 problem. I introduce my method to disable ReadyBoot. By using this method, we can get ReadyBoost without kp41.

There was a other culprit. He is Windows Search. Sudden index making causes kp41 power lack.

i.e. One of the mastermind/ culprit of kp41 is SysMain (= Superfetch Service) and SearchIndexer.exe. This is evident from my test.

[ cf. Intro ReadyBoot ; ~After every boot, the ReadyBoot service uses idle CPU time to analyze file trace information from the five previous boots and identifies which files were accessed and where they are located on disk.~   ----- volatile kp41 can be explained by this. (?). ]

And, I introduced SysMain one-person type svchost.exe [ i.e. sc config SysMain type= own ], and controlled its cpu priority. If "Idle" or "Below Normal" are specified, system is considerable stable. --- but, this is not core problem. it's trivial matter.

How to stop annoying Superfetch activity:   on 2015/05/02   [Alias: Read-Only added Prefetch]
My heuristic ANSWER:
(1) Stop SysMain. ( by Task Manager/ "Service" tab/ select "SysMain" line, Do terminate.)
(2) Open Window Explorer,
Delete all files under C:\Windows\Prefetch
Delete all files under C:\Windows\Prefetch\ReadyBoot
Make dummy files:
(2-1) Make dummy C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl (by MEMO pad, contents is any. ).
And, Set "read-only" attribute, by set/ add "read-only" attribute in Property (right click).
( It causes --- Error; event id = 3: Session "ReadyBoot" stopped due to the following error: 0xC0000022   --- very good!! )
(3) Do System reboot.
(4) Stop SysMain at about 5 minutes after startup.
Set "read-only" attribute to all files under Prefetch folder (= C:\Windows\Prefetch\*.*).
(5) Do System reboot, or, Start SysMain by Service tool. (here, Task Manager/ Service/ "Service start" was rejected. why?)
(6) If you find new files (without read-only attribute) under the Prefetch folder. Please set the "read-only attribute" to such files, at any time.
Remark: Excption: "Layout.ini" must not be "read-only". i.e. Don't set "read-only" attribute to Layout.ini.

---- That's all. --- kp41 stopped (?). &, ReadyBoost is running. At least, It restricts the learning. --- i.e. I forbid the (foolish) DB update.
 (This is also absolutely logical result.)
c. why? --- I don't know.
c (2) is the most elegant method in the world to "disable ReadyBoot".
c. Layout.ini will be created by SysMain at few hours after startup. And, Layout.ini can be also created/ edited by "rundll32.exe advapi32.dll,ProcessIdleTasks" DOS command. This good command cause the "local defrag service" disk-space re-allocation.
c. dir c:\windows\prefetch /a:r   [ files with read-only attri.]
   dir c:\windows\prefetch /a:-r   [ files without read-only attri.]
    attrib c:\windows\prefetch   [ pair of (Attributes & file-name) ]
c. My "Read-Only" attribute all files sample name-list, under registry (EnablePrefetcher, EnableSuperfetch) = (2,0). not so many.
 c:\windows\prefetch   directory
2015/05/02  01:50           332,116 AgAppLaunch.db
2015/05/02  01:50               288 AgGlFaultHistory.db
2015/05/02  01:50               288 AgGlFgAppHistory.db
2015/05/02  01:50               288 AgGlGlobalHistory.db
2015/05/02  01:50               128 AgRobust.db
2015/05/04  17:56                 0 Layout.ini  --- Don't set "read-only".
2015/05/02  02:10               108 LongTermHist.db
2015/05/02  02:10            69,631 LongTermHist.db.bt
2015/05/02  02:10            69,631 LongTermHist.db.dx
2015/05/02  01:50           675,898 NTOSBOOT-B00DFAAD.pf
2015/05/02  02:09               508 PfSvPerfStats.bin
2015/05/02  13:45    <DIR>          ReadyBoot

 c:\windows\prefetch\readyboot   directory
2015/05/02  13:44                 0 ReadyBoot.etl   --- dummy file


Perhaps, Win7/ 8's existing kp41, more than 90 % comes from the ReadyBoot failure. Other 10 % cases comes from other reasons. (?!)


Please review my result. And please apply my method.

by Unbootable on 2015.04.11


kp41 monthly numbers on my PC (OS: Windows 7 Professional, 32 bit)
 times 123456789101112 comment 
2012lostlostlostlostlostlost18327>36624613
2013511839367230450000
2014032001619516420922
2015189010674693000000
201600000000478911-12-
20171-2-3-4-5-6-7-8-9-10-11-12-
On 2015. July, kp41 was died. Since, By stopping Windows Search Service.
On 2016. Oct, SATA cable loose connection to the mother board. +
 "[Multimedia] SystemSoundsService & [Wininet] CacheTask ,
 in Task Scheduler" + "Application Experience Service"
 I declare "My kp41 comes from OS bug."

 My only one HW tuning was bios' suspend mode = S1
 (i.e. S3 → S1)

  My opinion: Osama bin Laden of kp41 is related to WmiPrvSE.exe and SysMain Service (= Prefetch/ Superfetch function) and WSearch auto-indexing.
( 2015.Feb. value 90 times/month was occured by WmiPrvSE.exe (= famous gang/ trouble maker) and WMI (= boss).)


2015 / April  total = 74
SunMonTueWedThuFriSat comment 
293 3011 310 16 23 34 46
57 61 70 85 93 102 112Before
120 130 142 150 160 170 180ReadyBoob
190 200 2110 226 231 240/2 256why?
260 270 288 290 300 13 20
30 410 58 60 70 811 914May
100 110 120 130 142 150 161May
179 180 190 200 210 220 230May
240 250 260 270 280 291 3010May
310 10 20 30 40 50 60June
70 80 90 100 112 121 130June
140 150 160 170 180 190 200June
210 220 230 240 250 260 270June
280 290 300 10 20 30 40June
50 60 70 80 90 100 110July
120 130 140 150 160 170 180July
190 200 210 220 230 240 250July
260 270 280 290 300 310 10July
20 30 40 50 60 70 80Aug
90 100 110 120 130 140 150Aug
160 170 180 190 200 210 220Aug
230 240 250 260 270 280 290Aug
300 310 10 20 30 40 50Sep
60 70 80 90 100 110 120Sep
130 140 150 160 170 180 190Sep
200 210 220 230 240 250 260Sep
270 280 290 300 10 20 30Oct
40 50 60 70 80 90 100Oct
110 120 130 140 150 160 170Oct-plan
Daily trace stopped. ∵ OS bug evident.
Effect of ReadyBoob.bat / Read-Only added Prefetch, No auto-indexing --- Effect is evident.

 4/14 value 2 result, comes from ReadyBoot_0.bat model mixed.

 ↑ Before
 ↓ After    

"ReadyBoob.bat" "Read-Only added Prefetch" is a specific cure (/ silver bullet) for "kp41".

Pink color number indicates kp41 at comeback from sleep under ** The maximum file size for session "ReadyBoot" has been reached **. It's no-problem, if you don't use SLEEPING function.
On 4/26 This day, I applied/ started the SysMain cpu priority decrease strategy.
• On 5/2, New solution "Read-Only added Prefetch" was introduced. -- very powerful.
After 5/6, No mount ReadyBoost Flash Memory tip. --→ this is bad idea.
After 5/10, under Force Windows 7 to Clear Virtual Memory Pagefile at Shutdown --- pagefile.sys relative is out of order (?)
On 5/18, Index Option parameters tuning did. Almost disable auto Windows Search function.


Left result shows "Kp41 failure is OS bug.". --- evident.


[ Voice of me. ]
My more than 3 years battle to kp41 will end, perhaps.
If Windows 7 had be created by my-own, I would have suspected SysMain as soon as hearing of the kp41 queer symptom.
For example, Every morning 1st startup is apt to occur kp41 down , and N times continuous down occur. This specific phenomena (= singularity) can be described by ReadyBoot component features.
The true expert would think so, perhaps.
I think, ReadyBoot/ Superfetch development group were dull, neglectful.
MS also is the same. They should be blamed. Memory dump was not supported. It's an OS fatal defect, it should be improved.

[ Another scenario: Or, from the beginning or middle, MS already noticed the true culprit, but by the political judgment, etc., he decided to keep its fact hidden. If usual technique skill he has, being unaware of the fact is very unnatural. --- But, in general, concealing the sin is criminal act. ]

Many how-to were there, but almost downstream strategy, were not upstream strategy.
kp41, its name will be imprinted on PC history. and, as its inept management, MS name also will be imprinted, forever.
--- I dare to say. represent user voice.   on 2015/04/19 ---




WmiPrvSE.exe is a famous high CPU consumer after the startup of Win7 PC.
This nuisance WmiPrvSE.exe can be deleted by restating of the service WMI (Windows Management Instrumentation).
--- This is the tip of the kp41 iceberg. only one tip.

cf. WmiPrvSE.exe high CPU Usage FIX !! (YouTube; 2014/02/12)
cf. Is WMIprvse a real villain? (in MSDN Blogs, 2009/05/26)
 (  |-- in here, Tyson 2013, Berban 2014, already pointed out, "net pause Winmgmt/ net continue Winmgmt" METHOD.)

I found that stopping WmiPrvSe.exe is effective for simple kp41 phenomena, too.


Batch sample. --- Stupid41.bat

("net pause winmgmt" causes to delete the WmiPrvSE.exe (NETWORK SERVICE) and WmiPrvSE.exe (SYSTEM) both. )

■ Improved version   --- This is faster and is free from the depending services.
Rem *** Stupid41.bat (tentative name), elevated privilege.
Rem   Auto run on 3 minutes after startup ***
echo %date%, @%time%
net pause Winmgmt
net continue Winmgmt
pause
c. stupid41 ≒ stopped41 meaning, too.


It causes id=5617; "Windows Management Instrumentation Service subsystems initialized successfully" log into Event Viewer.
in Windows log folder/ Application sub-folder. if condition is satisfied.

i.e. This batch monitor checks the consistency of the WMI subsystem, and if found the illegal (ex. ghost task was found...), initialize the system.
I think now's WMI logic is poor, code spec review is needed, more. QA is poor, too.

■ Additional kp41 phenomenon:   i.e. caused by HW OS, too.
In my case, additional treatment was needed. SouthBridge (one of Chipset for USB/ PS-2/ HDD controller etc.) Overheat Problem/ Overhead Problem might cause kp41.

In order to reduce the SouthBridge overhead, I stopped the ReadyBoost flash memory USB device, and to cool the southbridge IC body, I put the aluminium coin on the IC surface.


(Foolish) accumulated knowledge of Prefetch/ Superfetch caused kp41 in my case.
So, I applied next batch job.

■【Major Premise】 Service Startup Type of "Superfetch" = "Manual". --- not "Automatic" option.
 i.e. In the beginning of startup, Service "Superfetch" is in OFF status.
1st. commander/ caller for "Superfetch (= SysMain task)" is the next Batch (= ReadyBoob.bat , Far_fetched.bat ).

Rem ReadyBoob.bat, Elevated run, auto run @10 sec. @5 min. after startup.
Rem ** This is "Disable ReadyBoot" batch. And "Disable ReadyBoot" brings about "Stopping kp41", too. **
net stop SysMain
del C:\Windows\Prefetch\*.*  /q
del C:\Windows\Prefetch\ReadyBoot\*.*  /q


sc config SysMain type= own

net start SysMain


REM in Batch mode: describe %%a, But, in DOS prompt direct operation mode: %a.
for /f "delims=" %%a in ('tasklist /svc /fi "services eq sysmain"') do @set x=%%a
echo %x%
set x=%x: =%
set x=%x:SysMain=%
set PID=%x:svchost.exe=%
echo %PID%
wmic process where ProcessID=%PID% CALL setpriority "Idle"


Below is banned; very dangerous/ unstable. If ReadyBoot.etl remained, Leave it alone.
dir C:\Windows\Prefetch\ReadyBoot | findstr ReadyBoot.etl || goto ZZ
net stop sysmain
net start sysmain

:ZZ
Above 4 lines was revised as below. i.e. after 30 sec. Cut damned SysMain, Spawn renewal sysmain -- feeling.
timeout /t 30
net stop SysMain
del C:\Windows\Prefetch\AgAppLaunch.dbx
rename C:\Windows\Prefetch\AgAppLaunch.db AgAppLaunch.dbx
& rem ** Great trick **
net start sysmain


wmic service where name="SysMain" get ProcessID | findstr /v P > %0\..\PID_SysMain.txt
set /p PID=< %0\..\PID_SysMain.txt
wmic process where ProcessID=%PID% CALL setpriority "Idle"

pause

Minimize uncolicit SPAM i/o under the "Disable ReadyBoot".  --- This is banned, too. cuz, unstable/ dangerous. inner bug.
• Open the Performance Monitor management console, e.g., "Administrative Tools" -> "Performance Monitor", or, "perfmon.msc /s" from the Command Prompt.
• Under the management console sub-folder "Data Collector Sets" -> "Startup Event Trace Sessions", Open the "ReadyBoot" Trace Session Property Sheet.
• Select the "Stop Condition" panel.
• Set and "1" to the "Maximum Size" value as minimum. [default : 20 MB]
----------------
• Select [File] tab\ Log mode\ Set Circular (requires a non-zero maximum file size)   cf. see. (avoid err event id=4 & 3)
-- Ban may be canceled? Now, It's under the test.
----------------
• Press OK, and exit.
  ■ Latest status: The most clever solution of this issue is adding "read-only" attribute to the ReadyBoot.etl file. No real-i/o.
  From my experience: Stable this function seems be established by using together with "Clearing PageFile.sys at every shutdown" /@reboot.
c. It's not "LadyBoob".
c. Line "del C:\Windows\Prefetch\*.*  /q" is optional. You can/ may remove it later. ---- "del" is effective. Don't remove this line. I think so.
c. From 10 sec. to 5 minutes, this shifting is for congestion mitigation. So, 5 is a rough value.
c. In Maximum Size 1 MB case, Event Viewer log (always) are generated as below. And sometimes kp41 happens, on the timing of call for comeback from SLEEPing. (High probability. but, case by case.) --- Please investigate.

log name: Microsoft-Windows-Kernel-EventTracing/Admin
source: Kernel-EventTracing, Caution; event id =4
session: The maximum file size for session "ReadyBoot" has been reached. As a result, events might be lost (not logged) to file "C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl". The maximum files size is currently set to 1048576 bytes.
Error; event id = 3: Session "ReadyBoot" stopped due to the following error: 0xC0000188

cf. Opinion by MS : MS says that id=3 err, don't mind. --- if so, you should do set MAX = 1 MB, and suffer from kp41. and, don't mind. --- i.e. MS is foolish. theory is good. but, real world has bugs by MS.

c. sc config SysMain type= own --- only one member svchost.exe definition.
c. wmic ~ "Idle" ---- Its svchost.exe process priority is "Idle" definition. i.e. lowest. "Below Normal" is OK, too.
c. output format sample. -- pickup line 2 only.   ex. by: letter "P" not included line. /v option.
C:\Windows\system32>wmic service where name="SysMain" get ProcessID
ProcessId
2380

c. sc config option "type=" is contained "=", so, "type =" becomes error.

c. No redirection file method can be available by "tasklist" command.
DOS command output into variable by set command. For /f loop method.
Output sample format.
C:\Windows\system32>for /f "delims=" %a in ('tasklist /svc /fi "services eq sysmain"') do @set x=%a
C:\Windows\system32>echo %x%
svchost.exe                1300 SysMain------ 【Q:】 How to pick up 1300 only? ---- 【A:】 " " to "", "Sysmain" to "", & "svchost.exe" to "".



Alternative ( existing method )

From my long-time test result, "ReadyBoot\Start = 0" is dangerous. It causes kp41 eventually.
So, I recommend not to apply. There is an OS bug.     i.e. ReadyBoob is safe. but, ReadyBoot_0 is dangerous.

■【Major Premise】 Service Startup Type of "Superfetch" = "Automatic".
Run next Batch (= ReadyBoot_0.bat ) at 10 sec. after startup.

Rem ReadyBoot_0.bat, Elevated run, auto run @10 sec. after startup.
Rem ** This is "Disable ReadyBoot" batch. And "Disable ReadyBoot" brings about "Stopping kp41", too. **

reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\ReadyBoot  /v  Start  /t  REG_DWORD  /d  0  /f
reg.exe query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\ReadyBoot  /v  Start
c. The necessity for Sandwich of "net stop SysMain/ net start SysMain" is unknown to me.  No!, No!. --- You must not to sandwich. Because, Next "net start SysMain" makes "Start = 1" always.
Perhaps, You had better reboot the system just after 1st. applying.

Remark: Foolish 1st launched SysMain initialization routine always sets/ writes 1 to "ReadyBoot\Start" registry value. He is not a gentleman.


-- Original image ( in Far_fetched.bat case, kp41 occurs, yet. but, in ReadyBoo.bat case, no kp41. ) --
Rem Far_fetched.bat ReadyBoob.bat, Elevated run, auto run @10 sec., and + 30 min. cycle after startup.
echo %time%
net stop SysMain
del C:\Windows\Prefetch\Long*.* /q
del C:\Windows\Prefetch\*.db /q
del C:\Windows\Prefetch\ReadyBoot\Trace*.* /q

Rem ** Especially, To delete "ReadyBoot.etl" is indispensable. ∵ It disables to create "Trace~.fx" family. [= Disable ReadyBoot], And "Disable ReadyBoot" brings about stopping kp41, too. **
del C:\Windows\Prefetch\*.*  /q
del C:\Windows\Prefetch\ReadyBoot\*.*  /q

net start SysMain

pause ** end Far_fetched , Please close this before next spawn **
c. far_fetched.bat ≒ far_fetched is bad, meaning too.   i.e. Prefetch/ Superfetch/ Farfetched --- TRIO.
c. This method for "Disable ReadyBoot" is invented/ found by me, perhaps.

Important Remark:
1H cycle is bad. 30 min. cycle is good. (∃ interval = between 30 and 60 min. :⇒ trigger for auto update LongTermHist DB.)
  [ SysMain updates 4 files (= Ag*History.db, AgRobust.db) by 45/40/45/50/35//45/40/45/50/35.. minutes interval cyclic sequence.]
(i.e. Supporse, 1 interval ≡ 1 generation. if so, multi-generations LongTermHist DB causes kp41. So, I forbid the inheritance.)
LongTermHist.db.bt/ LongTermHist.db.dx/ LongTermHist.db should be deleted every time.
  [ and, ~.db (ex. Ag~.db family), ~.fx (ex. Trace1.fx) typed files also should be deleted. -- except Layout.ini (??) ]
( Inheritance routine "old-time data + adding delta ⊿ information" has failure/ bug (, which causes kp41), So I deleted old data. )


c. MS should review the logic of Superfetch, which includes the bug/ foolish intelligence.
It caused kp41, --- this is evident. The culprit is SysMain's implementation of LongTerm algorithm. Power consuming special routine exists...
Algorithm is good, but its implementation is bad. --- in sum, Lack of test.

■ Further Additional:
From my Heuristic experience, I run Stupid41.bat at Time Ti (where, i= 1, 2,....n, ...; (i = 1): T1 = 3 min. after.
and (i ≧ 2): Tn = (n-1) Hour after. [i.e. 1H cyclic] ).
i.e. WMI subsystem are inconsistent at just after startup, and at other capricious times.
--- This fact is a Big matter.


• My Prefetch/ Superfetch, ReadyBoost flash memory setting/ environment:
( I like ReadyBoost function, very much.).

1. Service/ Superfetch = "auto"
2. 【regedit】 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Memory
Management\PrefetchParameters
 |-- "EnablePrefetcher"  = 2
 |-- "EnableSuperfetch" = 0 (or 2)
3. USB connector: ReadyBoost flash memory
(in Win7; combination: Service/ Superfetch = "auto" & ("EnablePrefetcher" = 0, "EnableSuperfetch" = 0),
---→ can't use ReadyBoost. [is it bug? / odd logic.] )
(If so, combination: Service/ Superfetch = "disable" & ("EnablePrefetcher" ≠ 0, "EnableSuperfetch" ≠ 0) --- suspicious ?)

ex. Mr. Obama likes ReadyBoost, and dislikes Prefetch/ Superfetch. In this case, What shall he do?


--- coffee break ---
Grimm's Law: carnival - knife (c-k, n-n, v-f, l- silent) diverse - different (v-f, r-r, [+n], s-t) /flesh/ kIna @Sanskrit /cutter/ vaptR @Sanskrit /knife/ ganibet @Basque kampit @Tagalog (Filipino) ganivet @Catalonian canivete @Portuguese /sickle/ kin @Sumerian kama @Japanese 鎌 c. additional: (C) etymonline.com "knife" image. knife (n.) late Old English cnif, probably from Old Norse knifr, from Proto-Germanic *knibaz (cognates: Middle Low German knif, Middle Dutch cnijf, German kneif), of uncertain origin. To further confuse the etymology, there also are forms in -p-, such as Dutch knijp, German kneip. French canif "penknife" (mid-15c.) is borrowed from Middle English or Norse. carnival (n.) 1540s, "time of merrymaking before Lent," from French carnaval, from Italian carnevale " Shrove Tuesday," from older Italian forms such as Milanese *carnelevale, Old Pisan carnelevare "to remove meat," literally "raising flesh," from Latin caro "flesh" (see carnage) + levare "lighten, raise, remove" (see lever (n.)). Folk etymology is from Medieval Latin carne vale " 'flesh, farewell!' " Meaning "a circus or fair" is attested by 1931 in North America

c. /flesh/ --- carne (in Europe), niku 肉 (in Japan) ; Reverse has happened.(?) -- interesting !


Link free.      (C) 2015, Unbootable. All Rights Reserved.            [ This is a child page. --- parent (Japanese page). ]