Recently my laptop started to become sluggish and the ventilator was constantly on. In Task Manager it was clear the system process (pid 4) ate 1 cpu core.
Process explorer did not bring any interesting results.
Then I started an investigation using xperf.exe, a Windows Performance Toolkit utility. It is very similar to the profilers you might use for .NET, so I encourage my developer mates to use it when they have a native-code performance problem.
Here is what I saw:
Process Explorer did not show more than the ExpWorkerThread level. Ok, I did not configure debug symbols for it, it might have shown stacks correctly, but it is just a snapshot, a sample of the state of the threads as opposed to xperf, which profiles processes in sampling mode.
However, xperf clearly shows us that volsnap.sys constantly uses the disk. I suppose it is stuck in some kind of infinite loop.
Volsnap is the volume snapshot service, which supports backup and recovery. So, at first I stopped Volume Shadow Copy service. It did not help.
Then, I deleted system restore points for my drives.
It took several minutes to finish deleting old restore points. After the reset, the System process now behaves correctly.
System restore points are very important for certain scenarios, so be careful to turn it off. This is just a workaround, to clean up bogus system restore points.
After deleting them and restarting, you should re-enable it!
I re-enabled it, and the problem did not manifest again. So, I think deleting and recreating restore points solves this kind of weird problem.