Sleep Study CPU Usage and System Interrupts in Windows 10

spirits247 · 30 Apr 2017 at 09:49

I know most people don't have this issue but I thought I'd post it here because I've come across it a few times now in Windows 10 and it can take a while to find an answer if you're not aware (anyone searching google hopefully).

I've come across a few PC's (Desktops and Laptops) where the CPU usage was pegged at maxing out one core and also Disk usage was constantly writing to the SSD (not good) or hard drive.

After looking into resource monitor, you can see it's the "System" and "System Interrupts" that's causing it, writing loads of information to a log file called SleepStudy/UserNotPresentSession.etl on the C drive (huge clue there!).

Turns out that if certain PC's or laptops (perhaps hardware specific) don't wake up properly or there is a powercut when it was sleeping, next time you boot the system keeps logging all the system devices that would be using power in sleep mode.

Problem is, the computer is no longer sleeping so that would be a huge amount of devices and interrupts it starts to log! Sleep study continues when the user IS present and in a fully powered up state - hence the huge logging and system interrupts being hammered.

My brother complained of a slow dual I3 series 4 desktop PC, it has literally written GBs of data to the SSD and been maxing out one core and hammering the interrupts process until I put it to sleep and woke it up again then everything was fine (shutdown/reboot didn't stop the logging)

Just a heads up as it seems this sleep study has a few bugs still in Windows 10.

yashiro · 30 Apr 2017 at 11:02

After the Anniversary Update, there's a new entry running under Event Trace Sessions on Windows 10 called UserNotPresentTraceSession.
To check this, open the Performance snap-in and expand Event Trace Sessions.
The funny thing is that you don't have the option to disable this under Startup Event Trace Sessionslike you have with all the other entries"

Source: http://superuser.com/questions/1120...sion-under-event-trace-sessions-after-the-ann
and managed to stop the process. Deleting it may be the only option to make it persistent across reboots.

[edit] Nope, after deleting it, it reappears.

Basically, open perfmon and disable the UserNotPresentTraceSession if present.
Right click the entry. Properties. Trace Session tab. Untick Enabled if it's active.

If that doesn't work you could edit said loggers and remove any triggers or uncheck the log mode settings. Probably worth doing to ScreenOnPowerStudyTraceSession too.

If that doesn't work you can just set files in C:\Windows\System32\SleepStudy as read only.

I think the problem here is that something is turning this log on at boot all the time, hence recreating the defaults even if edited. The read only trick is probably the easiest fix.

spirits247 · 30 Apr 2017 at 13:30

Thanks for the tips, I've set that file to read only in case it happens again for the sake of the poor SSD.

Danny75 · 17 Jul 2017 at 21:17

Thanks to both for starting this thread and for the fix. Just happened to me on Win 10 Pro. 14GB worth of writes in one hour. It occurred while playing GTA V, which is what someone in the SuperUser forum mentioned as well. Have made the relevant file in SleepStudy read-only and rebooted.

Sage Badolato · 31 Dec 2018 at 02:24

Danny75 said:
Thanks to both for starting this thread and for the fix. Just happened to me on Win 10 Pro. 14GB worth of writes in one hour. It occurred while playing GTA V, which is what someone in the SuperUser forum mentioned as well. Have made the relevant file in SleepStudy read-only and rebooted.

And thank you for confirming this about GTA V.. I was wondering why my i5-8300H kept getting pegged, and my NVMe would instantly go to 100% usage while alt-tabbed. Happened out of no where after many days of gameplay on the new laptop. It’s a fresh install of 10 as well.

Though in order for the read-only settings to apply correctly for me, I had to take ownership of the folder from system and give it to much user, then place the entire folder into readonly mode.

Danny75 · 10 Jan 2019 at 21:53

You're welcome. I've found I have to repeat that process every time there's a big Windows feature update. Feature updates re-enable stuff like that, disabled services etc.

shaun345 · 14 May 2020 at 09:47

Windows 10 Build 18363. I recently noticed a system process maxing out one core for several days on my computer when i happened to look at task manager. Upon checking it's properties i found it was ntkrnlmp.exe running. Several restarts and shutdowns made no difference so I went looking at resource monitor and found it was constantly writing to the file UserNotPresentSession.etl This lead me here but before trying the above solution (seeing it is related to the computer sleeping) I tried putting my computer to sleep and waking it again. Lo and behold the problem was gone! i have no idea when I last put my computer to sleep as I normally just shut it down.

So if you're *lucky* just putting your computer to sleep and waking it again might solve this problem.

NB. This happened on a brand new install I did about 3 weeks ago

Eddy B · 23 Jul 2020 at 21:29

I had this issue on several windows builds on a pc, high system interrupts and cpu usage when idle, along with high disk usage by windows sleeepstudy (usernotpresent data).
I eventually I noticed the pc it occurred on was using a ps2 connected keyboard, rather than the usb keyboard on my other pcs. I swapped to a usb keyboard on the pc with the issue and the problem disappeared.

yashiro · 31 Jul 2020 at 00:16

Running the following commands from a command prompt will stop the logging if other fixes fail to work.

Code:

logman stop -ets UserNotPresentTraceSession
logman stop -ets ScreenOnPowerStudyTraceSession

Will need to be run every boot. So make a batch file, scheduled task or something along those lines.