Sleep Study CPU Usage and System Interrupts in Windows 10

Associate
Joined
29 Jan 2007
Posts
727
I know most people don't have this issue but I thought I'd post it here because I've come across it a few times now in Windows 10 and it can take a while to find an answer if you're not aware (anyone searching google hopefully).

I've come across a few PC's (Desktops and Laptops) where the CPU usage was pegged at maxing out one core and also Disk usage was constantly writing to the SSD (not good) or hard drive.

After looking into resource monitor, you can see it's the "System" and "System Interrupts" that's causing it, writing loads of information to a log file called SleepStudy/UserNotPresentSession.etl on the C drive (huge clue there!).

Turns out that if certain PC's or laptops (perhaps hardware specific) don't wake up properly or there is a powercut when it was sleeping, next time you boot the system keeps logging all the system devices that would be using power in sleep mode.

Problem is, the computer is no longer sleeping so that would be a huge amount of devices and interrupts it starts to log! Sleep study continues when the user IS present and in a fully powered up state - hence the huge logging and system interrupts being hammered.


My brother complained of a slow dual I3 series 4 desktop PC, it has literally written GBs of data to the SSD and been maxing out one core and hammering the interrupts process until I put it to sleep and woke it up again then everything was fine (shutdown/reboot didn't stop the logging)

Just a heads up as it seems this sleep study has a few bugs still in Windows 10.
 
Soldato
Joined
9 Dec 2003
Posts
3,584
Location
UK
After the Anniversary Update, there's a new entry running under Event Trace Sessions on Windows 10 called UserNotPresentTraceSession.
To check this, open the Performance snap-in and expand Event Trace Sessions.
The funny thing is that you don't have the option to disable this under Startup Event Trace Sessionslike you have with all the other entries"

Source: http://superuser.com/questions/1120...sion-under-event-trace-sessions-after-the-ann
and managed to stop the process. Deleting it may be the only option to make it persistent across reboots.

[edit] Nope, after deleting it, it reappears.

Basically, open perfmon and disable the UserNotPresentTraceSession if present.
Right click the entry. Properties. Trace Session tab. Untick Enabled if it's active.

If that doesn't work you could edit said loggers and remove any triggers or uncheck the log mode settings. Probably worth doing to ScreenOnPowerStudyTraceSession too.

If that doesn't work you can just set files in C:\Windows\System32\SleepStudy as read only.

I think the problem here is that something is turning this log on at boot all the time, hence recreating the defaults even if edited. The read only trick is probably the easiest fix.
 
Last edited:
Soldato
Joined
26 Aug 2013
Posts
8,393
Thanks to both for starting this thread and for the fix. Just happened to me on Win 10 Pro. 14GB worth of writes in one hour. It occurred while playing GTA V, which is what someone in the SuperUser forum mentioned as well. Have made the relevant file in SleepStudy read-only and rebooted.
 
Associate
Joined
31 Dec 2018
Posts
1
Thanks to both for starting this thread and for the fix. Just happened to me on Win 10 Pro. 14GB worth of writes in one hour. It occurred while playing GTA V, which is what someone in the SuperUser forum mentioned as well. Have made the relevant file in SleepStudy read-only and rebooted.
And thank you for confirming this about GTA V.. I was wondering why my i5-8300H kept getting pegged, and my NVMe would instantly go to 100% usage while alt-tabbed. Happened out of no where after many days of gameplay on the new laptop. It’s a fresh install of 10 as well.

Though in order for the read-only settings to apply correctly for me, I had to take ownership of the folder from system and give it to much user, then place the entire folder into readonly mode.
 
Soldato
Joined
26 Aug 2013
Posts
8,393
You're welcome. I've found I have to repeat that process every time there's a big Windows feature update. Feature updates re-enable stuff like that, disabled services etc.
 
Associate
Joined
14 May 2020
Posts
1
Windows 10 Build 18363. I recently noticed a system process maxing out one core for several days on my computer when i happened to look at task manager. Upon checking it's properties i found it was ntkrnlmp.exe running. Several restarts and shutdowns made no difference so I went looking at resource monitor and found it was constantly writing to the file UserNotPresentSession.etl This lead me here but before trying the above solution (seeing it is related to the computer sleeping) I tried putting my computer to sleep and waking it again. Lo and behold the problem was gone! i have no idea when I last put my computer to sleep as I normally just shut it down.

So if you're *lucky* just putting your computer to sleep and waking it again might solve this problem.

NB. This happened on a brand new install I did about 3 weeks ago
 
Associate
Joined
23 Jul 2020
Posts
1
I had this issue on several windows builds on a pc, high system interrupts and cpu usage when idle, along with high disk usage by windows sleeepstudy (usernotpresent data).
I eventually I noticed the pc it occurred on was using a ps2 connected keyboard, rather than the usb keyboard on my other pcs. I swapped to a usb keyboard on the pc with the issue and the problem disappeared.
 
Soldato
Joined
9 Dec 2003
Posts
3,584
Location
UK
Running the following commands from a command prompt will stop the logging if other fixes fail to work.
Code:
logman stop -ets UserNotPresentTraceSession
logman stop -ets ScreenOnPowerStudyTraceSession


Will need to be run every boot. So make a batch file, scheduled task or something along those lines.
 
Back
Top Bottom