Tom Sheppard

Q: Runaway processes burning CPU & hammering disk

I've filed an official bug report with Apple in mid-April and they requested a sysdiagnose dump, but since then I haven't heard a peep from them and this problem is persistent and very annoying, so I'm turning to the community for help.

 

These four processes have been driving me insane for a couple of months, UserEventAgent, launchd, cfprefsd, mds_stores, all running under root. In that order combined, they use over 230% CPU on my quad-core i7 Mac mini. They always appear together.

 

Worse, cfprefsd is hammering my disk hundreds of times a second creating a temporary file and then renaming it to /private/var/root/Library/Preferences/com.apple.xpc.activity2.plist. I'm talking about writing many GB an hour. The file always contains the same contents. Needless to say, the fan is running full blast and the whole system slows down. This occurs within minutes of rebooting and will sometimes clear on its own after a few hours, and sometimes I just have to reboot. Then it will go away for a day or two before rearing its ugly head again. Wash, rinse, repeat.

 

None of the suggested voodoo I've seen in my searches such as turning off Bluetooth, disabling Safari extensions, rebooting in recovery mode and resetting ACLs, has helped. That includes the advice here: Re: cfprefsd using > 90% of CPU.

 

I even tried disabling /System/Library/UserEventPlugins/com.apple.cts.plugin that someone suggested. It appeared to work, but it disables Time Machine so that "solution" is unacceptable.

 

From logs at the time the event started, it seemed related to the Messages app.

 

2016-04-14 8:12:56.111 PM com.apple.spotlight.IndexAgent[14767]: [com.apple.corespotlight.log] Not allowed to pass in bundle ID

2016-04-14 8:12:56.111 PM soagent[656]: Can't allocate SOHelper <SOMessageHelper: 0x7ffb81f23490> inside com.apple.soagent

2016-04-14 8:12:56.111 PM IMDPersistenceAgent[679]: [com.apple.corespotlight.log.index] Finished "index items"(62) with error:Error Domain=CSIndexErrorDomain Code=-1003 "(null)"

2016-04-14 8:12:56.111 PM IMDPersistenceAgent[679]: [Warning] IMDChatAddMessageToSpotlight: indexing searchable items failed with error Error Domain=CSIndexErrorDomain Code=-1003 "(null)"

2016-04-14 8:12:56.111 PM IMDPersistenceAgent[679]: [Warning] IMDChatAddMessageToSpotlight: indexing searchable items failed with error Error Domain=CSIndexErrorDomain Code=-1003 "(null)"

2016-04-14 8:12:56.113 PM com.apple.spotlight.IndexAgent[14767]: [com.apple.corespotlight.log] Not allowed to pass in bundle ID

2016-04-14 8:12:56.113 PM IMDPersistenceAgent[679]: [com.apple.corespotlight.log.index] Finished "index items"(64) with error:Error Domain=CSIndexErrorDomain Code=-1003 "(null)"

2016-04-14 8:12:56.113 PM IMDPersistenceAgent[679]: [Warning] IMDChatAddMessageToSpotlight: deleting message for searchable items failed with error Error Domain=CSIndexErrorDomain Code=-1003 "(null)"

2016-04-14 8:12:56.113 PM IMDPersistenceAgent[679]: [Warning] IMDChatAddMessageToSpotlight: deleting message for searchable items failed with error Error Domain=CSIndexErrorDomain Code=-1003 "(null)"

2016-04-14 8:13:03.890 PM com.apple.CDScheduler[63]: *** LOG MESSAGE QUOTA EXCEEDED - SOME MESSAGES FROM THIS PROCESS HAVE BEEN DISCARDED ***

 

Clearing out the ~/Library/Messages folder and rebooting seemed to help, but that is temporary at best because, even without the Messages app running, the incoming messages still recreate the database there. I'm currently running without Messages launched and yet I'm in the middle of an event as I write this. Is it related? Who knows? Even if I could totally disable Messages, I don't want to.

 

Today, nothing I try seems to help. There you have it gurus. What can I try now?

Mac mini, OS X Mavericks (10.9.4), 2.6 GHz i7, 16 GB RAM; 1 TB Fusion

Posted on May 23, 2016 2:28 PM

Close

Q: Runaway processes burning CPU & hammering disk

  • All replies
  • Helpful answers

Page 1 Next
  • by Tom Sheppard,

    Tom Sheppard Tom Sheppard May 23, 2016 2:49 PM in response to Tom Sheppard
    Level 1 (25 points)
    Mac OS X
    May 23, 2016 2:49 PM in response to Tom Sheppard

    Update: I forgot to mention that I tried turning off Spotlight for the boot disk by adding it to the privacy list, and rebooting, but another event started immediately.

  • by Linc Davis,

    Linc Davis Linc Davis May 23, 2016 2:55 PM in response to Tom Sheppard
    Level 10 (207,926 points)
    Applications
    May 23, 2016 2:55 PM in response to Tom Sheppard

    Have you logged in as root or enabled root logins? If you modified the OS installation, have you reinstalled?

  • by Tom Sheppard,

    Tom Sheppard Tom Sheppard May 23, 2016 3:11 PM in response to Linc Davis
    Level 1 (25 points)
    Mac OS X
    May 23, 2016 3:11 PM in response to Linc Davis

    Yes, I have logged in as root although I don't remember why. It's been a long time since I've felt the need to. Perhaps it was to try some of the suggestions I've read about this problem or perhaps another reason. I'll disable it and then reboot since I can't think of a reason I need root now.

     

    El Capitan was a clean install and then a restore from Time Machine. I can't think of any OS mods I've tried other than suggestions to resolve this problem. But even then, since nothing worked, I've always restored any changes.

     

    While I haven't reinstalled, given the frequency and annoyance level, I'm getting very close to crossing that threshold.

  • by Linc Davis,Solvedanswer

    Linc Davis Linc Davis May 28, 2016 1:27 PM in response to Tom Sheppard
    Level 10 (207,926 points)
    Applications
    May 28, 2016 1:27 PM in response to Tom Sheppard

    Please back up all data before proceeding.

    Triple-click anywhere in the line below on this page to select it:

    /var/root

    Right-click or control-click the highlighted line and select

              Services Reveal in Finder (or just Reveal)

    from the contextual menu.* A folder should open with an item selected. Move the selected item to the Trash. You may be prompted for your administrator login password. Restart the computer and empty the Trash.

    *If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

  • by Tom Sheppard,

    Tom Sheppard Tom Sheppard May 23, 2016 4:50 PM in response to Linc Davis
    Level 1 (25 points)
    Mac OS X
    May 23, 2016 4:50 PM in response to Linc Davis

    Thanks for the suggestion. I'll let you know if the problem returns. It shouldn't take long but if you don't hear from me for awhile, that means it's helped but I'm cautiously monitoring it for a few days.

  • by Tom Sheppard,

    Tom Sheppard Tom Sheppard May 28, 2016 1:26 PM in response to Linc Davis
    Level 1 (25 points)
    Mac OS X
    May 28, 2016 1:26 PM in response to Linc Davis

    Hi Linc. Your fix worked. Thank you very much. I haven't seen any problem for 5 days.

  • by LordLobby,

    LordLobby LordLobby May 30, 2016 12:12 AM in response to Linc Davis
    Level 1 (10 points)
    May 30, 2016 12:12 AM in response to Linc Davis

    Cool, this works in case your

     

    soagent

    storeaccountd

     

    processes run mad too. Thanks.

     

    Any idea what the problem with the root folder is?

  • by Tom Sheppard,

    Tom Sheppard Tom Sheppard May 30, 2016 8:51 AM in response to Tom Sheppard
    Level 1 (25 points)
    Mac OS X
    May 30, 2016 8:51 AM in response to Tom Sheppard

    Aaand it's back less than two days after I declare it fixed. Something recreated /var/root and was generating the .plist file again. Deleting /var/root was temporary as it was immediately recreated. I booted into safe mode, but even then it took several rm -R /var/root commands to get it to stay deleted. Rebooted and /var/root  has been recreated. Let's see how long it takes for the bug to return this time.

  • by Tom Sheppard,

    Tom Sheppard Tom Sheppard May 30, 2016 8:59 AM in response to Tom Sheppard
    Level 1 (25 points)
    Mac OS X
    May 30, 2016 8:59 AM in response to Tom Sheppard

    Literally 5 seconds after I updated my bug report with Apple saying I'd removed /var/root again, the bug returned. Now it's just toying with me.

  • by Linc Davis,

    Linc Davis Linc Davis May 30, 2016 10:45 AM in response to Tom Sheppard
    Level 10 (207,926 points)
    Applications
    May 30, 2016 10:45 AM in response to Tom Sheppard

    It's normal for that folder to be recreated automatically. Have you been logging in as root?

  • by Tom Sheppard,

    Tom Sheppard Tom Sheppard May 30, 2016 11:59 AM in response to Linc Davis
    Level 1 (25 points)
    Mac OS X
    May 30, 2016 11:59 AM in response to Linc Davis

    No, I turned off root before I deleted the directory the first time. I've given up and am reinstalling the OS. I give it a 5% chance of helping.

  • by Tom Sheppard,

    Tom Sheppard Tom Sheppard May 30, 2016 12:50 PM in response to Tom Sheppard
    Level 1 (25 points)
    Mac OS X
    May 30, 2016 12:50 PM in response to Tom Sheppard

    Reinstalled and upgraded to 10.11.5. Runaway processes back before I could finish logging in. Debating if I'm going to format the drive and start from scratch.

  • by Linc Davis,

    Linc Davis Linc Davis May 30, 2016 1:09 PM in response to Tom Sheppard
    Level 10 (207,926 points)
    Applications
    May 30, 2016 1:09 PM in response to Tom Sheppard

    Please read this whole message before doing anything.

    This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.

    The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.

    Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem.

    Note: If FileVault is enabled in OS X 10.9 or earlier, or if a firmware password is set, or if the startup volume is a software RAID, you can’t do this. Ask for further instructions.

    Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.

    The login screen appears even if you usually login automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.

    Test while in safe mode. Same problem?

    After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of the test.

  • by Tom Sheppard,

    Tom Sheppard Tom Sheppard Jun 8, 2016 12:41 PM in response to Linc Davis
    Level 1 (25 points)
    Mac OS X
    Jun 8, 2016 12:41 PM in response to Linc Davis

    I wasn't expecting much from this test because I don't have the luxury of leaving my server in Safe Mode for an extended time. The problem did not arise during that test. I ran it immediately after another incident occurred. But then it often takes days for it to show up after wiping /var/root/ when booted normally. Removing /var/root/ is the best temporary solution as it almost always makes the problem go away for up to a week at a time. Welcome relief. However, as I type this message the problem has been active for 90 minutes so it looks like I'll have to wipe root and reboot once again.

     

    Apple asked for an mddiagnose dump, which I provided, but I may not hear from them for weeks again.

     

    Formatting the drive and reinstalling everything from scratch is almost too much to bear, but I'm getting to the point where that may be the only solution short of Apple finding the bug and assuring me a solution is on the way. Even after installing from scrath, there's no guarantee that whatever is causing the problem doesn't come back because I did a clean install when I upgraded to El Capitan. Frustrating, but I appreciate your suggestions, Linc.

Page 1 Next