Performance, storage & log diagnosis
Identify the process, disk hog or log error behind a slowdown or crash and remedy it.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- Activity Monitor · Task Manager · Console · Event Viewer
- Class GUI-need label
HY· Hybrid
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R01.07.01.01-T01 Kill a CPU-hogging helper tree and disable its startup entry in Task Manager
Original instruction
The Windows 11 VM is sluggish. A seeded synthetic process `updsvc_helper.exe` (spawned by `updsvc.exe`) keeps two cores at 100%. Using Task Manager, end the whole process tree, disable `Contoso Updater` in the Startup apps tab, and write the culprit's image name and PID (as shown before ending it) to `C:\Users\agent\Desktop\culprit.txt`. Leave every other seeded process running.
- Platforms
win· Windows- Applications
- Task Manager
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
No updsvc*.exe alive; StartupApproved\Run value for Contoso Updater has disabled flag 03; culprit.txt PID equals the seeded PID logged at setup; 5 decoy processes still alive. taskkill/Stop-Process use is read from the PowerShell/Sysmon log and scored 0 for the GUI milestone.
Proposed partial credit
40% correct process tree ended (decoys alive); 30% startup entry disabled; 30% culprit.txt name+PID exact
R01.07.01.01-T02 Find a memory-leaking app with Activity Monitor and capture a process sample
Original instruction
On the macOS VM, memory pressure is red. One of four seeded background apps (`PhotoIndexer`, `SyncAgent`, `ClipKeeper`, `MetaScan`) leaks ~40 MB/min. Using Activity Monitor, identify it, use View > Sample Process and save the sample to `~/Desktop/leak_sample.txt`, then Force Quit only that app. Write its name to `~/Desktop/leaker.txt`.
- Platforms
mac· macOS- Applications
- Activity Monitor
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
leaker.txt equals seeded leaker; leak_sample.txt header lists that process name and its PID; leaker not running, other three alive. eslogger exec events detect a CLI bypass (/usr/bin/sample, kill or killall run by the agent), which voids the sample milestone.
Proposed partial credit
40% correct leaker named; 30% Activity Monitor sample file for the right PID; 30% only leaker quit
R01.07.01.01-T03 Triage an app crash in Event Viewer and save a reusable custom view
Original instruction
`LedgerPro.exe` crashes on launch. In Event Viewer, find the newest Application Error (ID 1000) for it and record faulting module, exception code and module version in `C:\triage\crash.json` (keys module, code, version). Then create a custom view named `CrashTriage` that shows Event IDs 1000 and 1026 from the Application log for the last 24 hours, error level only.
- Platforms
win· Windows- Applications
- Event Viewer
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicknav· Pan/zoom/scrolltype· Text & forms- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
crash.json fields equal the eventcreate-seeded values (latest of 6 seeded crashes, decoys from other apps). %ProgramData%\Microsoft\Event Viewer\Views\*.xml with name CrashTriage has a QueryList selecting Level=2, EventID 1000 or 1026, timediff 86400000.
Proposed partial credit
50% crash.json exact (newest event, right app); 30% custom view exists with correct IDs; 20% level and 24 h window right
R01.07.01.01-T04 Stop a crash-looping LaunchAgent found through Console logs
Original instruction
A user LaunchAgent `com.example.syncd` respawns every 10 s and floods the log. Using Console (streaming or log archive), identify the error that makes it exit, repair the agent's plist in `~/Library/LaunchAgents/` (the fix is in the plist, not the binary) and reload it so it stays running. Record the original error line in `~/Desktop/syncd_error.txt`.
- Platforms
mac· macOS- Applications
- Console · Terminal
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentcode· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
`launchctl print gui/501/com.example.syncd` shows state running, runs==1 over a 120 s window, last exit 0; ProgramArguments points to the existing binary; syncd_error.txt contains the seeded 'No such file' message substring. Binary hash unchanged.
Proposed partial credit
30% error line identified; 40% plist repaired with valid path; 30% agent stable for 120 s
R01.07.01.01-T05 Free 25 GB on a full Windows C: drive without touching user documents
Original instruction
C: has under 2 GB free. Seeded culprits include a runaway log folder, old crash dumps, Delivery Optimization cache, and a 12 GB `.vhdx` in Downloads that IT says is disposable; user videos and Documents must stay. Using Storage settings, Disk Cleanup or TreeSize Free, reclaim at least 25 GB. Write each deleted path and size to `C:\triage\freed.csv`.
- Platforms
win· Windows- Applications
- Storage settings · Disk Cleanup · TreeSize Free
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP08· App/system state- Conditions
risk· Irreversible/risky- Proposed difficulty
- 4 / 5
Proposed verifier
Free space on C: >= 27 GB; SHA-256 of all files under Users\*\Videos and Documents unchanged; no system file in the WinSxS/ProgramFiles manifest removed; freed.csv paths exist in the seeded-junk list and sizes within 5%.
Proposed partial credit
40% free-space threshold met; 40% zero protected files lost; 20% freed.csv accurate
R01.07.01.01-T06 Shrink macOS 'System Data' by clearing snapshots and developer caches
Original instruction
Storage settings show 70 GB of System Data on the Mac VM. Seeded causes: three Time Machine local snapshots, 28 GB of Xcode DerivedData, two unused iOS simulator runtimes, and a 6 GB log in `/Library/Logs/Contoso`. Free at least 40 GB using System Settings > Storage, Finder and Xcode's Settings > Platforms. Do not touch `~/Documents` or `~/Pictures`.
- Platforms
mac· macOS- Applications
- System Settings · Finder · Xcode
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP08· App/system state- Conditions
risk· Irreversible/risky- Proposed difficulty
- 4 / 5
Proposed verifier
df shows >= 40 GB more free than baseline; tmutil listlocalsnapshots / returns none; xcrun simctl runtime list lacks the two seeded runtimes; hashes of Documents and Pictures unchanged; the active simulator runtime still present.
Proposed partial credit
30% snapshots gone; 30% DerivedData and runtimes removed; 20% threshold met; 20% protected data intact
R01.07.01.01-T07 Pinpoint the process and file behind heavy disk I/O in Resource Monitor
Original instruction
Users report that File Explorer stalls every few seconds. Open Resource Monitor's Disk tab and find which process writes the most and the exact file it hammers. Save `C:\triage\disk.json` with keys `process`, `pid`, `file`, and `write_Bps` (average write bytes/s over 30 s as displayed). Do not stop the process.
- Platforms
win· Windows- Applications
- Resource Monitor
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
process, pid and file match the seeded writer (C:\ProgramData\Contoso\cache\idx.tmp) among 3 decoy writers; write_Bps within ±25% of the writer's configured rate; writer still alive.
Proposed partial credit
40% process+PID; 40% exact file path; 20% rate within tolerance
R01.07.01.01-T08 Use Reliability Monitor to find the update that started a crash streak
Original instruction
Since some day last month, `FieldNotes.exe` crashes daily. Using Reliability Monitor, find the first day it crashed and the Windows/app update installed immediately before that. Write `C:\triage\reliability.json` with keys `first_crash_date` (YYYY-MM-DD), `preceding_update` (KB number or product name) and `crash_count_30d`.
- Platforms
win· Windows- Applications
- Reliability Monitor
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
All three values equal the seeded reliability records (synthetic RacEvents + MsiInstaller events seeded with backdated timestamps). Exact date and update string; count exact.
Proposed partial credit
35% first crash date; 35% preceding update; 30% 30-day crash count
R01.07.01.01-T09 Build and run a Performance Monitor data collector set for a slow-boot report
Original instruction
Create a user-defined Data Collector Set named `SlowBoot` in Performance Monitor with counters `\Processor(_Total)\% Processor Time`, `\PhysicalDisk(_Total)\Avg. Disk sec/Read` and `\Memory\Available MBytes`, 5-second interval, output to `C:\PerfLogs\SlowBoot`. Run it for 2 minutes, stop it, and keep the generated report.
- Platforms
win· Windows- Applications
- Performance Monitor
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrolltype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
`logman query SlowBoot` lists exactly the 3 counters, SampleInterval 00:00:05, RootPath as given; a .blg in that path spans 110-140 s with those counters (relog -q). Creation by logman is detected in the command log and fails the GUI milestone (see control pair T10).
Proposed partial credit
40% set configured with right counters; 30% interval and path; 30% .blg from a 2-minute run
R01.07.01.01-T10 Control pair of T04: repair a crash-looping systemd user service from the journal
Original instruction
Control pair of T04 on Ubuntu. The user service `syncd.service` restarts every 10 s. Using journalctl and systemctl only, find the error, fix the unit file in `~/.config/systemd/user/` (the binary is fine), reload and confirm it stays active. Write the original error line to `~/syncd_error.txt`.
- Platforms
lin· Linux- Applications
- journalctl · systemctl
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
`systemctl --user show syncd -p NRestarts` stays constant over 120 s and ActiveState=active; ExecStart path valid; syncd_error.txt contains the seeded message; binary hash unchanged.
Proposed partial credit
30% error identified; 40% unit fixed; 30% stable 120 s
R01.07.01.01-T11 Stop Spotlight from re-indexing a build folder that pins the CPU
Original instruction
`mds_stores` keeps one core busy. Using Activity Monitor, confirm the indexer is the cause; using Console or Activity Monitor's Open Files, find which folder it is indexing. Add that folder (and only it) to Spotlight's Privacy exclusion list in System Settings. Note the folder in `~/Desktop/indexed.txt`.
- Platforms
mac· macOS- Applications
- Activity Monitor · System Settings · Console
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
indexed.txt equals the seeded churn folder (~/Builds/nightly, which rewrites 5k files/min); Spotlight exclusions (VolumeConfiguration.plist Exclusions) contain exactly that path added; mds_stores average CPU < 10% over 60 s afterwards. eslogger exec/file events detect mdutil runs or direct writes to VolumeConfiguration.plist, which fail the task (e.g. `mdutil -i off` on the volume).
Proposed partial credit
30% cause confirmed and folder found; 50% exclusion added for that path only; 20% CPU below threshold
R01.07.01.01-T12 Apply a startup-apps policy in Task Manager to cut boot time
Original instruction
The PDF `C:\input\startup_policy.pdf` lists which startup items are allowed on lab PCs. In Task Manager's Startup apps tab, disable every enabled item not on the allowed list and enable any allowed item that is currently disabled. Do not uninstall anything.
- Platforms
win· Windows- Applications
- Task Manager
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clickvis· Visual judgment- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
StartupApproved Run/StartupFolder values: every allowed item enabled (02), every other of the 11 seeded items disabled (03); Uninstall keys unchanged. Registry edits made outside Task Manager are detected by Procmon writer image != Taskmgr.exe.
Proposed partial credit
50% non-allowed items disabled; 30% allowed items enabled; 20% nothing uninstalled
R01.07.01.01-T13 Fix a nightly Task Scheduler job that fails with 0x80070002
Original instruction
The task `\Contoso\NightlyExport` shows Last Run Result 0x80070002. Using Task Scheduler's History tab and Event Viewer, find why it fails, fix the task (not the script), run it once on demand, and confirm success. The export script lives somewhere under `C:\Ops`.
- Platforms
win· Windows- Applications
- Task Scheduler · Event Viewer
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrolltype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Task XML action path/working directory point to the real script; LastTaskResult 0x0 after an on-demand run; export output file created with today's timestamp; script hash unchanged; trigger and principal unchanged.
Proposed partial credit
30% cause identified (wrong path/start-in); 40% task action fixed; 30% on-demand run succeeds
R01.07.01.01-T14 Summarize three app crash reports from Console into a triage table
Original instruction
Console > Crash Reports contains three `.ips` reports for `Inkwell.app` from different days. For each, record date, exception type, crashed thread number, and top symbolicated frame of the crashed thread in `~/Desktop/triage.csv` (header `date,exception,thread,top_frame`). Then state in `~/Desktop/verdict.txt` whether all three share one root cause (yes/no).
- Platforms
mac· macOS- Applications
- Console
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmenttype· Text & forms- Work product
WP02· Records/table- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
triage.csv rows equal the seeded .ips fields (exact exception type, thread index, frame symbol); verdict equals the seeded truth (two share a frame, one differs -> 'no'). Order-insensitive row match.
Proposed partial credit
60% rows correct (one third per row); 20% header/format; 20% verdict
R01.07.01.01-T15 Find which shared-svchost service leaks handles and restart only it
Original instruction
Handle count of one `svchost.exe` climbs by thousands per hour. It hosts three seeded synthetic services (`CtxIndex`, `CtxPolicy`, `CtxBeacon`). Using Task Manager details/services tabs, Resource Monitor or Process Explorer, determine which service leaks, write its name to `C:\triage\leak.txt`, and restart only that service.
- Platforms
win· Windows- Applications
- Task Manager · Process Explorer · Services
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
leak.txt equals the seeded leaker; its service start time is after task start; the other two services' start times are unchanged; svchost not killed (no unexpected service restarts in System log 7036 events).
Proposed partial credit
50% correct service identified; 30% only it restarted; 20% no collateral restarts
R01.07.01.01-T16 Find the process locking a file and release it without killing system processes
Original instruction
Deleting `D:\Exports\q3_export.lock` fails with 'file in use'. Use Process Explorer's Find Handle or Resource Monitor's Associated Handles to find the holder, close that application gracefully (File > Exit, not End Task), then delete the lock file. Write holder name and PID to `C:\triage\holder.txt`.
- Platforms
win· Windows- Applications
- Process Explorer · Resource Monitor
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Lock file deleted; holder.txt equals the seeded holder (a tray app among 2 decoy apps holding other files); holder exited with code 0 via its own shutdown hook (seeded app logs 'clean exit'); no other process terminated.
Proposed partial credit
40% correct holder; 40% graceful exit (clean-exit log line); 20% file deleted
R01.07.01.01-T17 Restore a slow Mac to baseline across login items, background tasks and disk
Original instruction
A user's Mac is slow after a week of installs. Targets: idle CPU < 15% over 2 minutes, at least 20 GB free, and Login Items & Extensions matching `~/Desktop/allowed_login_items.txt`. Seeded causes include a runaway background item, two unapproved login items, a 25 GB disposable cache and a stuck Photos analysis. Fix it and write `~/Desktop/report.md` listing each cause and the action taken.
- Platforms
mac· macOS- Applications
- Activity Monitor · System Settings · Finder
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP08· App/system state- Conditions
long· Long-horizonrisk· Irreversible/risky- Proposed difficulty
- 5 / 5
Proposed verifier
Sampled idle CPU < 15% over 120 s; df free >= 20 GB; sfltool dumpbtm login/background items equal the allowed list; user data hashes unchanged; report.md names all 4 seeded causes (string match on item ids).
Proposed partial credit
25% CPU target; 25% disk target; 30% login items exact; 20% report covers causes
R01.07.01.01-T18 Identify the boot-delaying driver from a Windows Performance Analyzer trace
Original instruction
`C:\input\boot.etl` is a boot trace captured with WPR. Open it in Windows Performance Analyzer, find which driver or service contributes the largest delay in the Boot Phases / Generic Events graphs, and write `C:\triage\boot.json` with keys `culprit`, `phase`, `delay_ms`. Then set that (synthetic, non-critical) service to Manual start.
- Platforms
win· Windows- Applications
- Windows Performance Analyzer · Services
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & clickdrag· Drag & drop- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 5 / 5
Proposed verifier
culprit and phase equal the seeded injected delay (ContosoFilter, PostBoot); delay_ms within ±10% of 18,000; service StartType Manual. xperf, tracerpt and wpaexporter are removed from the VM, and Sysmon plus PowerShell script-block logging detect any other parser (e.g. Get-WinEvent on boot.etl), voiding the culprit/phase milestones.
Proposed partial credit
50% culprit; 20% phase; 15% delay value; 15% service set to Manual
R01.07.01.01-T19 Mine a unified log archive for an intermittent sync failure
Original instruction
Open `~/Desktop/input/sync.logarchive` (24 h) in Console. The app `com.example.drive` fails to sync intermittently. Determine the error domain and code behind the failures, the timestamp of the first occurrence, and the total number of failure events. Write `~/Desktop/sync.json` with keys `domain`, `code`, `first_seen`, `count`.
- Platforms
mac· macOS- Applications
- Console · log
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmenttype· Text & forms- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Values equal the seeded injected events among ~400k unrelated lines and a decoy error with a different code; first_seen within 1 s; count exact. Either Console search or `log show --predicate` is accepted.
Proposed partial credit
30% domain+code; 30% first_seen; 40% exact count
R01.07.01.01-T20 Triage a blue-screen minidump in WinDbg and disable the faulting test driver
Original instruction
The VM bugchecked twice. Open `C:\Windows\Minidump\101426-01.dmp` in WinDbg, run the analysis, and record bugcheck code, faulting module and the first non-OS stack frame in `C:\triage\bsod.json`. The faulting module is a synthetic test driver; disable its service so it no longer loads, and reboot once to confirm no new dump appears.
- Platforms
win· Windows- Applications
- WinDbg · Services
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
type· Text & formsnav· Pan/zoom/scrollvis· Visual judgment- Work product
WP12· Answer/decision- Conditions
risk· Irreversible/risky- Proposed difficulty
- 5 / 5
Proposed verifier
bsod.json bugcheck, module and frame equal the seeded crash (testdrv.sys, 0xD1); HKLM\...\Services\testdrv Start=4; after reboot, no new minidump and System log shows no testdrv load. Other drivers' Start values unchanged.
Proposed partial credit
30% bugcheck code; 30% module and frame; 25% driver disabled; 15% clean reboot
Mapped research references
Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.