Windows indexing service -- 100s of copies of process suspended

davodavo · 21 Jun 2018

Am running Win10pro 64bit, using windows encrypted file system and standard indexing service.

Everything had been running normally, but for some reason Windows is now throwing the Search Filter Host process into suspend sate every few seconds...and the processes never come out (the Search Filter Host is automatically restarted, leaving the suspended ones in zombie state until a reboot. The frequency of suspension might be 10 seconds or 10 minutes, depending on system load. I've removed/rebuilt the index several times, I've checked the search crawl registry settings and TxR files, changed the index location...no real change. I've disabled lots of services and running programs, and while the frequency of suspension changes, it does not seem to stop. It doesn't seem to matter what kind of files are being indexed.

Nothing in the system event viewer--not even warning messages from the search engine. For whatever reason, there are no windows\system32\config\TxR files at all.

The suspended processes are "C:\windows\system32\SearchFilterHost.exe" 0 748 752 760 8192 756

If I try to restart them in ProcMon, they either do nothing or they become much smaller in memory footprint (from 550 kB to around 80), but they cannot be deleted from the system. After a while, if the system gets 3000 suspended processes, the OS gets driven to its knees (even though these processes are in "nothing" state).

The one process that seemed to make a BIG difference to the frequency of suspension was Nuance's WDS...it is designed to interact with the windows search engine, and it sure did that.

dalchina · 21 Jun 2018

Hi, sounds obscure- maybe interaction with another program as you note.

Try running Windows search troubleshooter anyway:

Windows indexing service -- 100s of copies of process suspended-1.jpg

Considering indexing- is indexing ever complete?
SearchFilterHost.exe is not running on mine (indexing complete).

Compare what happens after a clean boot.

Everything had been running normally, but for some reason Windows is now

Do you have a System Restore point available before this started to happen?

Or a disk image? (We constantly urge users to use disk imaging routinely - e.g. Macrium Reflect (free) + external storage for image sets).

Which build are you using? (Windows key + R, winver)

davodavo · 21 Jun 2018

Thanks for the ideas, Dalchina.
The index troubleshooter says everything is OK.
I have a lot of files to index, and every time I change interesting things to test the problem, the index resets itself. So...I don't know if the index can complete for the real world data. However, when I index just a few folders, it completes just fine (and when it completes, not surprisingly, no new suspended copies appear (because the search filter doesn't need to run at all).

Regarding restore points -- I have no idea why, but the system was delivered to me with restore points turned off. Grrrrrrr... have turned it on now, but too late. No disk image either...so I have to figure out what this really is...

dalchina · 21 Jun 2018

Suggest you try limiting what you index to a minimum- Windows default + 1 folder for test purposes. (Don't fiddle with Users).

Check to see when SearchFilterHost.exe runs - e.g. does it only run when indexing (e.g.. rebuilding the index for test purposes).
I've found no clear definition of it after a bit of searching.

See if you can get a minimal index rebuilt successfully. It sounds as if you can.

when I index just a few folders, it completes just fine

. So then extend what is indexed minimally- just one folder- checking to see if the index completes. Repeat with another folder containing different file types.

If you still have problems - or when- again, try a clean boot.

Note: this may be related to content indexing, so suggest you disable this for test purposes once you encounter a problem and see if that changes anything.

Make sure no other indexing software is running.

Which build are you using? (Windows key + R, winver)

davodavo · 21 Jun 2018

winver = 1803, build 17134.112 with all the patches installed.

You mention "content indexing" --what is that?
The only other thing that does any indexing is my mail tool, and that touches only its directories...which I've put off limits to windows indexing.
I've done several tests where I index a small amount of stuff...it will complete, but almost no matter what folders I index the suspended task problem occurs.
I'll try the clean-boot approach and see what happens.

davodavo · 21 Jun 2018

Just ran in cleanboot for about 10 minutes, and the search filter task put itself into suspend mode.

So, at least we have the data there...

dalchina · 22 Jun 2018

Noted you said

Everything had been running normally,

- what made you first notice the problem- how did it become evident?

And do you know of any change around the time this started?

You mention "content indexing" --what is that?

Note the option per file type here.

Windows indexing service -- 100s of copies of process suspended-2.jpg

And the option in the properties sheet here.

To index the contents of a given file type, you must have the appropriate ifilter installed for non-default file types to be indexed. (See right hand column, 1st screenshot).
These are usually installed by the program set as default for that file type.
Occasionally this can be a problem, particularly with (text based) pdfs.

You can disable content indexing per drive:

Windows indexing service -- 100s of copies of process suspended-3.jpg

Allow File Contents and Properties to be Indexed on a Drive in Windows | Windows 10 Tutorials

I suggest it might be worth disabling content indexing for all drives as a test and rebuild the index for a limited number of folders, and do that after a clean boot. I'd also suggest you limit the file types being indexed, in case there's a correlation with that.

I.e. attempt to reach a point where the process is not suspended.

Beyond that, if it's not possible to identify some peculiarity by eliminated 3rd party programs and what is being indexed, I'd suggest trying an in-place upgrade repair install which keeps programs and data and most settings.

Noted you are on 1803, which I'm avoiding for now. There's always the possibility this is some quirk in 1803, but I've not seen another report- but then, it may be people haven't noticed it.

dalchina · 22 Jun 2018

I've found this- as I suspected, this is related to content indexing.

Search Filter Host process: This process (which runs as SearchFilterHost.exe) hosts IFilters, which are used to extract text from files and other items. IFilters are hosted within a separate process instead of within the main indexer process to protect the Windows Search service from possible crashes and ensure the stability and security of the indexing engine. This process is needed because, although many IFilters are written by Microsoft, other IFilters may be written by third-party vendors and are therefore considered to be untrusted code. Hosting IFilters within a separate process (such as a filtering host) that has very restricted permissions (such as a restricted token) provides a level of isolation that protects the main indexer process if an IFilter crashes. The indexer process runs a single instance of SearchFilterProcess.exe, and this process holds all IFilter parsing documents that come from the system-wide and per-user SearchProtocolHost processes. This Search Filter Host process only reads streams of content, runs IFilters, and returns text to the indexer process.

More:
CIS 170F: Windows 7 Administration

Therefore:
a. Check that with no content indexing enabled, the process is not suspended.
b. Consider whether you installed (or perhaps uninstalled) a program which may have added an ifilter before this problem started.
c. With content indexing enabled, attempt to identify the file type(s) responsible.

You could do this by disabling content indexing for file types with dedicated ifilters (see screenshot above).

davodavo · 22 Jun 2018

How/when did I notice: I keep a process counter up at all times, and normally Win10 wants to be running around 200 of them. One day, I noticed I had 2400 processes so I began to investigate. This was after having installed several software programs, and the one that really perturbed the problem was Nuance PowerPDF. So PDF content would certainly be the place to start looking!!
I have thousands of PDFs that have been OCR'd so they have searchable content...but they can be big, and perhaps the search filter blows up beyond, say 100 kB.
Turning off content filtering on all types now, and will turn them back on one by one to see the culprit. I'm going to guess it's PDF, but testing is better than guessing.

THANK YOU FOR ALL THE RESEARCH WORK ON THIS!!!

davodavo · 22 Jun 2018

When I looked in the file type filter selector, there were maybe 10 of the content filters indicating "registered iFilter not found"...which is certainly an indicator of trouble. Those were all for file types I have almost none of, but I turned the content filter off on them.
The big one is PDF, which was trying to use Nuance's iFilter...turned that off...I'll bet the problem goes away now. If you DON'T hear from me, it's solved.

And THANK YOU again!