Working with a customer on backups for a large Windows file server, and am trying to get an idea of performance, so I have the Windows Resource Monitor open and I'm looking at disk operations.

While I see the expected entries for avtar under both "Processes with Disk Activity" and "Disk Activity", I am also seeing what appear to be "associated" operations of some kind for "System" with a PID of "4" - and under the "Disk Activity" section, the System entries seem to be working on the same "\Device\Harddisk\VolumeShadowCopy...\" entries that the avtar processes are also working on.

I understand that the Windows backup uses VSS these days and that Avamar would likely "hit" that shadow copy - I also understand that Windows will likely be working on that shadow copy as well to a degree. What I curious about is that at times, the System processes seem to be a lot more busy with the shadow copy than avtar is - and while this system is being used (as a file server), I wouldn't expect it to be "hit" as much by users as I would expect it to be "hit" by Avamar during a backup.

(and I also understand that System PID 4 is somewhat of a "catch all" process that takes care of a lot of things - but I still can't figure out why at some points it would be showing 4x or more the number of I/Os that avtar would)

Can anyone provide some additional perspective on why there are so many System processes "hitting" the shadow copy as well as the avtar ones?

All comments/feedback appreciated - thanks.